CWAP-405 Certified Wireless Analysis Professional (CWAP) Practice Questions
Prepare for CWAP-405 with more than an answer.
Unlock the full exam and previous versions
- v1Certified Wireless Analysis Professional (CWAP) 240 questions Current
- CWAP-403Legacy Certified Wireless Analysis Professional (CWAP) 60 questions Locked
- Exam fee
- $349.99 USD
- Level
- Professional
- Valid for
- 3 years
Domains covered on the exam 6
- Protocol Analysis15%
- Spectrum Analysis10%
- PHY Layers and Technologies10%
- MAC Sublayer and Functions25%
- WLAN Medium Access10%
- 802.11 Frame Exchanges30%
- 1
A hospital's telemetry monitoring system, which uses a proprietary 2.4 GHz FHSS protocol in the 2450-2480 MHz range, is experiencing frequent data loss. The hospital's Wi-Fi network uses channels 1, 6, and 11 for patient and guest access.
An analyst is brought in to investigate the RF environment. Using a spectrum analyzer in swept spectrogram view, the analyst observes the Wi-Fi signals on their respective channels. In the space between channels 6 and 11, the analyst sees very short duration, narrow-band signals that rapidly change frequency across the entire 2450-2480 MHz range. The duty cycle is low, but the amplitude of these signals is 15 dB higher than the Wi-Fi APs.
Based on the spectrum analysis, what is the most likely root cause of the telemetry data loss?
mindmap root((Troubleshooting)) Problem :Telemetry Data Loss Environment :Hospital (2.4 GHz) Wi-Fi (Ch 1, 6, 11) Telemetry (FHSS, 2450-2480 MHz) Spectrum Analysis Findings :Fast, narrow-band signals :Hopping between Ch 6 & 11 :High amplitude (+15 dB) :Low duty cycleShow answer details
Correct answer: D
The description of short-duration, narrow-band signals rapidly changing frequency is the classic signature of an FHSS device. Since the signals are observed between the Wi-Fi channels and are much stronger than the Wi-Fi, they are likely from an independent source. When this unknown hopper lands on the same frequency that the telemetry system is momentarily using, the high-power interference causes a 'collision' and corrupts the telemetry data. This explains the intermittent data loss. A microwave would be a wideband, high duty-cycle interferer, and Wi-Fi ACI would not appear as hopping narrow-band signals.
- 2
An analyst is troubleshooting a client connectivity issue and has a 500 MB capture file containing traffic from dozens of devices. The goal is to isolate the entire conversation for a single client, identify any retransmissions for that client, and view the timing between its frames. Which THREE protocol analyzer features would be most efficient for this task? (Select THREE)
Show answer details
Correct answer: B, C, E
A display filter (e.g., 'wlan.addr == client_mac') is the primary tool for isolating traffic to/from a specific client after the capture is complete.
Setting up colorization rules to highlight specific frame types, such as retransmissions (based on the 'Retry' bit) or error frames, makes them easy to spot visually within the client's conversation.
Changing the time column format to 'Seconds Since Previous Displayed Frame' is crucial for analyzing the timing and latency between frames specifically within the filtered conversation, helping to pinpoint delays.
- 3
True or False: 802.11n (HT) was the first 802.11 amendment to introduce the use of 40 MHz channels in the 2.4 GHz band.
Show answer details
Correct answer: A
This statement is true. Prior amendments like 802.11b/g used 20 MHz (or 22 MHz) channels. The 802.11n amendment introduced channel bonding to create 40 MHz channels for higher throughput, and this capability was defined for both the 2.4 GHz and 5 GHz bands.
- 4
In a WMM-enabled network, a video streaming client is associated with the Video Access Category (AC_VI). The AP's beacon indicates a TXOP limit of 3008 µs for AC_VI. During a video stream, the client wins contention and begins transmitting. It sends a burst of four data frames, each followed by a SIFS and an ACK from the AP. The entire exchange takes 2800 µs. The medium is now idle. What can the client do next according to WMM rules?
Show answer details
Correct answer: B
A Transmission Opportunity (TXOP) allows a station that wins contention to transmit multiple frames in a burst without re-contending, as long as the total time does not exceed the TXOP limit. Since the client has only used 2800 µs of its 3008 µs TXOP, it is allowed to send another frame (or frames) after waiting only a SIFS period, provided the total duration stays within the limit. This is a key QoS mechanism for improving efficiency for applications like voice and video.
- 5
A protocol analyzer is configured in monitor mode on a laptop. When observing traffic, the analyzer's statistics report a high percentage (25%) of frames with FCS errors. However, users connected to the AP are not reporting any significant performance issues. Which of the following is the most plausible explanation for this discrepancy?
Show answer details
Correct answer: B
A high FCS error rate in a capture often reflects the quality of the signal at the capture device, not necessarily the quality of the link between the actual communicating stations. If the laptop running the analyzer is in a location with a poor signal-to-noise ratio (SNR) relative to the BSS, it will fail to correctly receive many frames, flagging them with FCS errors. The actual clients, being closer to the AP with better SNR, may be receiving the frames perfectly fine.
- 6
A corporate office complains of intermittent Wi-Fi drops on channel 149 (5745 MHz). A spectrum analyzer shows a signal with a ~75% duty cycle that appears for 2-3 seconds at a time, sweeps across a 20 MHz channel width, and has a very fast rise time. The signal is present even when no Wi-Fi devices are actively transmitting. Which non-802.11 device is the most likely source of this interference?
Show answer details
Correct answer: C
Analog wireless video cameras operating in the 5.8 GHz ISM band are notorious for this RF signature. They transmit a wideband signal with a high duty cycle that can completely occupy a 20 MHz channel. Bluetooth operates in the 2.4 GHz band, and microwave ovens, while powerful interferers, also operate at 2.4 GHz. A misconfigured AP would show a valid 802.11 preamble and modulation, which is not described.
- 7
A network uses WMM for QoS. A protocol capture of a VoIP call shows that voice packets (AC_VO) are experiencing high latency. Analysis of the AP's beacon frames reveals the following EDCA Parameter Set for AC_VO: AIFSN=2, CWmin=3, CWmax=7, TXOP Limit=1504 µs. The capture also shows frequent transmissions from clients in the Best Effort queue (AC_BE) with AIFSN=3, CWmin=15, CWmax=1023, TXOP Limit=0. What is the most likely cause of the high latency for voice traffic?
flowchart TD Start((Start Contention)) --> CheckIdle{Medium Idle for AIFS?} CheckIdle -- No --> Start CheckIdle -- Yes --> Backoff[Select Random Backoff] Backoff --> Decrement{Decrement Counter} Decrement -- Counter > 0 --> CheckIdle Decrement -- Counter == 0 --> Transmit[Transmit Frame] Transmit --> End((End Contention)) subgraph AC_VO AIFS_VO(AIFSN=2) CW_VO(CWmin=3, CWmax=7) end subgraph AC_BE AIFS_BE(AIFSN=3) CW_BE(CWmin=15, CWmax=1023) endShow answer details
Correct answer: C
The provided EDCA parameters are the default and recommended values. AIFSN=2 for Voice gives it a shorter medium contention time than Best Effort (AIFSN=3). The CWmin/max values for Voice are much smaller than for Best Effort, giving it a significant statistical advantage. The TXOP allows for bursting. If voice traffic is still experiencing high latency with these correct parameters, it's highly indicative of extreme medium contention, where even the prioritized access for AC_VO is not enough to overcome the sheer volume of other traffic.
- 8
A user is unable to connect to a WPA2-Personal network. A frame capture shows the client receiving Message 1 (ANonce) from the AP and sending Message 2 (SNonce, MIC). However, the AP never sends Message 3. Instead, after a timeout, the AP retransmits Message 1. This cycle repeats. What is the most probable cause of this failure?
Show answer details
Correct answer: A
In the 4-way handshake, Message 2 contains a Message Integrity Code (MIC) calculated using the PSK. When the AP receives Message 2, it calculates its own MIC and compares it. If they don't match (indicating an incorrect PSK on the client), the AP will discard the frame and not proceed to Message 3. It will typically retransmit Message 1 after a timeout, leading to the observed cycle. The other options would result in different failure symptoms.
- 9
A wireless analyzer captures a data frame where the
To DSbit is 1 and theFrom DSbit is 1 in the Frame Control field. Which type of communication does this frame represent?graph TD subgraph BSS1 STA1[Client STA 1] end subgraph BSS2 STA2[Client STA 2] end AP1((Access Point 1)) AP2((Access Point 2)) STA1 -- Frame --> AP1 AP1 -- WDS Link --- AP2 AP2 -- Frame --> STA2 linkStyle 1 stroke:#f00,stroke-width:2px,fill:none;Show answer details
Correct answer: D
The combination of To DS=1 and From DS=1 is used exclusively for frames that are being forwarded from one access point to another over a Wireless Distribution System (WDS) or a mesh link. This indicates the frame has been received from the wireless medium by the first AP and is being sent back out onto the wireless medium to reach the second AP.
- 10
A large retail warehouse uses handheld scanners connected via a 5 GHz 802.11ac network. Scanners frequently disconnect and reconnect, taking 5-10 seconds each time, which causes significant productivity loss. The network uses WPA2-Enterprise with EAP-TLS.
A wireless engineer is tasked with identifying the root cause. The engineer performs a multi-channel capture near a problematic area and filters for the MAC address of a failing scanner. The capture shows the scanner roams from AP-1 to AP-2. The reassociation with AP-2 is successful and happens within 50ms.
However, a full EAP-TLS exchange follows the reassociation, which takes over 6 seconds to complete before the 4-way handshake can begin. The RADIUS server is located on a remote corporate network accessible over a WAN link. Analysis of the EAP exchange shows significant delays between the RADIUS server's messages.
What is the most likely issue and the best remediation step?
Show answer details
Correct answer: C
The capture analysis clearly shows that the reassociation itself is fast (50ms), but the subsequent full EAP-TLS authentication is taking over 6 seconds. This is the root cause of the delay. EAP-TLS requires multiple round trips to the RADIUS server, which is slow over a WAN. Implementing 802.11r (Fast BSS Transition) is the designed solution for this problem. It allows the client to establish security keys with the new AP via the existing AP (over-the-DS) or directly, bypassing the lengthy RADIUS exchange on subsequent roams within the same mobility domain.
