CWAP-403 Certified Wireless Analysis Professional (CWAP) Practice Questions
Prepare for CWAP-403 with more than an answer.
Unlock the full exam and previous versions
- v1Certified Wireless Analysis Professional (CWAP) 240 questions Locked
- CWAP-403Legacy Certified Wireless Analysis Professional (CWAP) 60 questions Current
- 1
What interframe space would be expected between a CTS and a Data frame?
Show answer details
Correct answer: A
SIFS (Short Interframe Space) would be expected between a CTS and Data frame. SIFS is the shortest interframe space used for immediate responses and frame sequences that must be atomic, such as RTS/CTS/Data/ACK exchanges. DIFS is used for initial channel access, AIFS is used in QoS environments, and PIFS is used for point coordination function access.
- 2
Using a portable analyzer you perform a packet capture next to a client STA and you can see that the STA is associated to a BSS. You observe the STA sending packets to the AP and the AP sending packets to the STA. Less the 2% of all packets are retransmissions. You move to capture packets by the AP and, while the retry rate is still very low, you now only see unidirectional traffic from the AP to the client. How do you explain this behavior?
Show answer details
Correct answer: B
The portable analyzer has a lower receive sensitivity than the AP and cannot capture weak packets from the client STA that the AP can still receive successfully. This is a common issue with portable analyzers which may not have the same antenna gain or receiver sensitivity as enterprise access points. The low retransmission rate indicates successful communication between STA and AP, ruling out power mismatches, spatial stream issues, or analyzer interference.
- 3
You are analyzing a packet decode of a Probe Request and notice the SSID element has a length of zero.
What do you conclude about the transmitting STA?
Show answer details
Correct answer: B
When a Probe Request has an SSID element with zero length, this indicates the STA is performing active scanning to discover all available BSSs in the area. This is called a wildcard or broadcast probe request. The STA is not in Ad-Hoc mode, promiscuous mode is unrelated to SSID length in transmitted frames, and a disabled adapter would not be transmitting frames.
- 4
What does the value of the Listen Interval field in an Association Request frame indicate?
Show answer details
Correct answer: C
The Listen Interval field in an Association Request frame indicates how often a STA in power save mode wakes up to listen to Beacon frames. This value is measured in beacon intervals and tells the AP how many beacon periods the STA will remain asleep before waking to check for buffered frames. Active scanning probe response timing and off-channel scanning are not related to this field, and it has no connection to ACK timeouts. Reference: https://mrncciew.com/2014/10/28/802-11-mgmt-association-reqresponse/
- 5
An RST frame should be acknowledged bywhich frame?
Show answer details
Correct answer: A
An RST frame should be acknowledged by an ACK frame according to 802.11 protocol specifications. All unicast frames in 802.11 require acknowledgment to ensure reliable delivery, and RST frames follow this standard acknowledgment procedure. CTS frames are used in RTS/CTS exchanges, BlockAck is for aggregated frames, and RTS-Ack is not a valid frame type in 802.11.
- 6
Which one of the following statements is nottrue concerning DTIMs?
Show answer details
Correct answer: B
The statement that the DTIM interval can dictate when an STA will wake up to listen to beacon frames is NOT true. STAs use their Listen Interval setting, not the DTIM interval, to determine wake-up timing for beacon reception. DTIM (Delivery Traffic Indication Map) is used to indicate when buffered broadcast/multicast traffic will be transmitted, and while every beacon contains a TIM, not every beacon contains a DTIM.
