Get Ready to Pass the CWSP-208 exam Right Now Using Our CWNP CWSP Exam Package
Enhance Your Career With Available Preparation Guide for CWSP-208 Exam
NEW QUESTION # 69
What attack cannot be detected by a Wireless Intrusion Prevention System (WIPS)?
- A. MAC Spoofing
- B. Deauthentication flood
- C. Hot-spotter
- D. Soft AP
- E. EAP flood
- F. Eavesdropping
Answer: F
Explanation:
WIPS (Wireless Intrusion Prevention Systems) monitor the RF environment and detect unauthorized activities. However, eavesdropping involves passive listening to wireless communications without transmitting any signals. Because the attacker is not transmitting or generating any detectable activity, a WIPS has no RF signal to detect and is thus unable to identify or prevent this attack.
References:
CWSP-208 Study Guide, Chapter 5 - Threats and Attacks
CWNP CWSP-208 Official Exam Objectives: "WLAN Threats", "WIPS Capabilities and Limitations"
NEW QUESTION # 70
Given: You are using WEP as an encryption solution. You are using VLANs for network segregation.
Why can you not establish an RSNA?
- A. RSNA connections require BIP and do not support TKIP, CCMP or WEP.
- B. RSNA connections do not work in conjunction with VLANs.
- C. RSNA connections require CCMP and do not support TKIP or WEP.
- D. RSNA connections require TKIP or CCMP.
Answer: D
Explanation:
RSNA (Robust Security Network Association), as defined by 802.11i, requires:
TKIP (WPA) or CCMP (WPA2) for encryption.
WEP is deprecated and not supported for RSNA since it does not meet RSN standards.
Incorrect:
B & C. BIP is not required for RSNA formation-it is used for management frame protection (802.11w).
D). VLANs are orthogonal to RSNA-network segmentation does not interfere with RSNA formation.
References:
CWSP-208 Study Guide, Chapter 3 (RSNA Formation and Key Hierarchy)
IEEE 802.11i and 802.11-2012 Standards
NEW QUESTION # 71
Given: Your network implements an 802.1X/EAP-based wireless security solution. A WLAN controller is installed and manages seven APs. FreeRADIUS is used for the RADIUS server and is installed on a dedicated server named SRV21. One example client is a MacBook Pro with 8 GB RAM.
What device functions as the 802.1X/EAP Authenticator?
- A. WLAN Controller/AP
- B. MacBook Pro
- C. SRV21
- D. RADIUS server
Answer: A
Explanation:
Comprehensive Detailed Explanation:
In the 802.1X/EAP framework:
The Authenticator is the device that controls access to the network - typically the AP or WLAN controller.
The Authenticator passes EAP messages between the Supplicant (client) and the Authentication Server (RADIUS).
Incorrect:
A). SRV21 is the RADIUS server (Authentication Server), not the Authenticator.
C). The MacBook Pro is the Supplicant.
D). RADIUS server handles Authentication, not Authenticator functionality.
References:
CWSP-208 Study Guide, Chapter 4 (802.1X Architecture Roles)
CWNP AAA and Authentication Design
NEW QUESTION # 72
When using the 802.1X/EAP framework for authentication in 802.11 WLANs, why is the 802.1X Controlled Port still blocked after the 802.1X/EAP framework has completed successfully?
- A. The 802.1X Controlled Port remains blocked until an IP address is requested and accepted by the Supplicant.
- B. The 4-Way Handshake must be performed before the 802.1X Controlled Port changes to the unblocked state.
- C. The 802.1X Controlled Port is blocked until Vender Specific Attributes (VSAs) are exchanged inside a RADIUS packet between the Authenticator and Authentication Server.
- D. The 802.1X Controlled Port is always blocked, but the Uncontrolled Port opens after the EAP authentication process completes.
Answer: B
Explanation:
The 802.1X Controlled Port remains blocked after EAP authentication is complete. It is only unblocked once the 4-Way Handshake completes successfully. This handshake:
Confirms that both client and AP have the same PMK.
Derives the PTK and installs keys.
Once encryption keys are in place, the Controlled Port is opened for data.
Incorrect:
A). The Controlled Port is what opens after successful authentication and key establishment.
B). IP addressing (via DHCP) happens after the Controlled Port is open.
D). Vendor-Specific Attributes may play a role in policy assignment but do not govern port control timing.
References:
CWSP-208 Study Guide, Chapter 4 (802.1X and Controlled Port Behavior)
IEEE 802.1X and 802.11i Standards
NEW QUESTION # 73
In the basic 4-way handshake used in secure 802.11 networks, what is the purpose of the ANonce and SNonce? (Choose 2)
- A. They are added together and used as the GMK, from which the GTK is derived.
- B. The IEEE 802.11 standard requires that all encrypted frames contain a nonce to serve as a Message Integrity Check (MIC).
- C. They are input values used in the derivation of the Pairwise Transient Key.
- D. They allow the participating STAs to create dynamic keys while avoiding sending unicast encryption keys across the wireless medium.
- E. They are used to pad Message 1 and Message 2 so each frame contains the same number of bytes.
Answer: C,D
Explanation:
In the 802.11 4-Way Handshake:
D: The ANonce (from the AP) and SNonce (from the STA) are critical entropy values used along with the PMK, MAC addresses, etc., to derive the PTK securely.
E: This process ensures both parties derive the same PTK without ever transmitting the key over the air, mitigating interception risk.
Incorrect:
A). Nonces are not padding bytes.
B). Nonces are not the MIC; MIC is a separate integrity mechanism.
C). GMK and GTK are for group keys, not derived from nonces.
References:
CWSP-208 Study Guide, Chapter 3 (4-Way Handshake Mechanics)
IEEE 802.11i Specification
NEW QUESTION # 74
What wireless authentication technologies may build a TLS tunnel between the supplicant and the authentication server before passing client authentication credentials to the authentication server? (Choose 3)
- A. EAP-TTLS
- B. EAP-TLS
- C. EAP-MD5
- D. PEAPv0/MSCHAPv2
- E. LEAP
Answer: A,B,D
Explanation:
All three EAP methods - EAP-TLS, PEAPv0, and EAP-TTLS - establish a secure TLS tunnel between the supplicant and the authentication server before client credentials are passed:
B). EAP-TLS uses mutual certificate authentication inside a TLS tunnel.
D). PEAPv0/MSCHAPv2 creates a TLS tunnel and then authenticates the user with MSCHAPv2 inside the tunnel.
E). EAP-TTLS creates a TLS tunnel and then supports legacy credentials (e.g., PAP, CHAP, MSCHAPv2) securely within it.
Incorrect:
A). EAP-MD5 does not use TLS at all.
C). LEAP is not TLS-based and is considered insecure.
References:
CWSP-208 Study Guide, Chapter 4 (TLS-Based EAP Methods)
CWNP EAP Protocol Comparison Matrix
NEW QUESTION # 75
What EAP type supports using MS-CHAPv2, EAP-GTC or EAP-TLS for wireless client authentication?
- A. PEAP
- B. EAP-TTLS
- C. H-REAP
- D. EAP-GTC
- E. LEAP
Answer: B
Explanation:
EAP-TTLS (Tunneled Transport Layer Security) supports flexible inner authentication methods including:
MS-CHAPv2
EAP-GTC (Generic Token Card)
EAP-TLS (in some configurations)
This versatility allows EAP-TTLS to be used with a wide range of back-end authentication systems, while only requiring a server-side certificate.
Incorrect:
A). H-REAP (now FlexConnect) is a Cisco AP deployment mode, not an EAP type.
B). EAP-GTC is a simple authentication method and not a tunnel or container for others.
D). PEAP typically supports MS-CHAPv2 but not EAP-GTC or EAP-TLS as inner methods.
E). LEAP uses MS-CHAPv1 and is considered deprecated and insecure.
References:
CWSP-208 Study Guide, Chapter 4 (EAP Methods)
NEW QUESTION # 76
Given: An 802.1X/EAP implementation includes an Active Directory domain controller running Windows Server 2012 and an AP from a major vendor. A Linux server is running RADIUS and it queries the domain controller for user credentials. A Windows client is accessing the network.
What device functions as the EAP Supplicant?
- A. Windows client
- B. Access point
- C. An unlisted WLAN controller
- D. Windows server
- E. Linux server
- F. An unlisted switch
Answer: A
Explanation:
In an 802.1X/EAP authentication model:
Supplicant: The device requesting access (the Windows client).
Authenticator: The AP or switch enforcing access decisions.
Authentication Server: The RADIUS server (Linux in this case), which communicates with a backend credential database (Active Directory).
The Windows client runs the EAP supplicant software to initiate authentication.
Incorrect:
A). The Linux server is the Authentication Server (not Supplicant).
C). The AP acts as the Authenticator.
D). The Windows Server is the credential store, not the supplicant.
References:
CWSP-208 Study Guide, Chapter 4 (802.1X Roles and Communication)
CWNP 802.1X Architecture Diagram
NEW QUESTION # 77
You have been recently hired as the wireless network administrator for an organization spread across seven locations. They have deployed more than 100 APs, but they have not been managed in either an automated or manual process for more than 18 months. Given this length of time, what is one of the first things you should evaluate from a security perspective?
- A. The VLANs in use
- B. The firmware revision
- C. The channels in use
- D. The channel widths configured
Answer: B
Explanation:
In a security context, outdated firmware is one of the most critical vulnerabilities. Firmware updates typically patch known security issues, fix bugs, and provide new features or improved encryption support. If the APs have not been updated or checked in over 18 months, they could be running firmware with known exploits or lacking critical security patches, making firmware review a top priority.
References:
CWSP-208 Study Guide, Chapter 8 - WLAN Security Lifecycle and Maintenance CWNP CWSP-208 Objectives: "Firmware and Security Patch Management"
NEW QUESTION # 78
The following numbered items show some of the contents of each of the four frames exchanged during the 4- way handshake:
1. Encrypted GTK sent
2. Confirmation of temporal key installation
3. Anonce sent from authenticator to supplicant
4. Snonce sent from supplicant to authenticator, MIC included
Arrange the frames in the correct sequence beginning with the start of the 4-way handshake.
- A. 1, 2, 3, 4
- B. 2, 3, 4, 1
- C. 4, 3, 1, 2
- D. 3, 4, 1, 2
Answer: D
Explanation:
The correct sequence of the 4-Way Handshake frames in WPA/WPA2 is:
Message 1: Authenticator sends ANonce to the supplicant # (3)
Message 2: Supplicant sends SNonce and a MIC to the authenticator # (4) Message 3: Authenticator sends GTK and confirms keys with MIC # (1) Message 4: Supplicant confirms installation of PTK/GTK # (2) This process ensures mutual key confirmation and integrity before data traffic begins.
NEW QUESTION # 79
Joe's new laptop is experiencing difficulty connecting to ABC Company's 802.11 WLAN using 802.1X/EAP PEAPv0. The company's wireless network administrator assured Joe that his laptop was authorized in the WIPS management console for connectivity to ABC's network before it was given to him. The WIPS termination policy includes alarms for rogue stations, roque APs, DoS attacks and unauthorized roaming.
What is a likely reason that Joe cannot connect to the network?
- A. Joe configured his 802.11 radio card to transmit at 100 mW to increase his SNR. The WIPS is detecting this much output power as a DoS attack.
- B. Joe's integrated 802.11 radio is sending multiple Probe Request frames on each channel.
- C. Joe disabled his laptop's integrated 802.11 radio and is using a personal PC card radio with a different chipset, drivers, and client utilities.
- D. An ASLEAP attack has been detected on APs to which Joe's laptop was trying to associate. The WIPS responded by disabling the APs.
Answer: C
Explanation:
WIPS systems often enforce policies based on MAC addresses and associated hardware fingerprints. If Joe uses a different wireless adapter than the one authorized, it may trigger a rogue device or unauthorized client alarm-even if it's the same laptop. This behavior is common in environments with strict WIPS enforcement policies.
NEW QUESTION # 80
What security benefits are provided by endpoint security solution software? (Choose 3)
- A. Can prevent connections to networks with security settings that do not conform to company policy
- B. Can restrict client connections to networks with specific SSIDs and encryption types
- C. Can collect statistics about a user's network use and monitor network threats while they are connected
- D. Can be used to monitor for and prevent network attacks by nearby rogue clients or APs
Answer: A,B,C
Explanation:
Endpoint security software can:
A). Enforce network access policies by validating that security settings meet organizational standards.
B). Monitor usage for auditing and threat detection.
C). Limit network connectivity based on SSID names, encryption, and authentication parameters.
Incorrect:
D). Detecting rogue APs and clients is typically done by WIPS, not endpoint security agents.
References:
CWSP-208 Study Guide, Chapter 7 (Client Security and Endpoint Enforcement) CWNP Endpoint Security and Compliance Policies
NEW QUESTION # 81
Given: You are the WLAN administrator in your organization and you are required to monitor the network and ensure all active WLANs are providing RSNs. You have a laptop protocol analyzer configured.
In what frame could you see the existence or non-existence of proper RSN configuration parameters for each BSS through the RSN IE?
- A. RTS
- B. CTS
- C. Probe request
- D. Data frames
- E. Beacon
Answer: E
Explanation:
The RSN (Robust Security Network) Information Element (IE) is used to advertise the security capabilities of a wireless network, particularly for WPA2 and WPA3 networks. This RSN IE is contained in Beacon and Probe Response management frames, not in Probe Request, RTS, CTS, or Data frames. The Beacon frame is sent periodically by an AP to announce its presence and includes critical information about the BSS, including security settings like the RSN IE.
You would use a protocol analyzer to capture Beacon frames and inspect the RSN IE field to confirm if a BSS is properly configured to use RSN protections such as WPA2-Enterprise or WPA2-Personal.
References:
CWSP-208 Study Guide, Chapter 6 - WLAN Discovery & Enumeration
CWNP CWSP-208 Objectives: "802.11 Frame Analysis" and "Understanding RSN Information Element Fields"
NEW QUESTION # 82
After completing the installation of a new overlay WIPS for the purpose of rogue detection and security monitoring at your corporate headquarters, what baseline function MUST be performed in order to identify security threats?
- A. WLAN devices that are discovered must be classified (rogue, authorized, neighbor, etc.) and a WLAN policy must define how to classify new devices.
- B. Upstream and downstream throughput thresholds must be specified to ensure that service-level agreements are being met.
- C. Authorized PEAP usernames must be added to the WIPS server's user database.
- D. Separate security profiles must be defined for network operation in different regulatory domains
Answer: A
Explanation:
After deploying a WIPS, an essential baseline activity is to classify all detected devices in the RF environment. These classifications allow the system to enforce security policies and detect policy violations.
Classifications include:
Authorized (managed devices)
Rogue (unauthorized, possibly dangerous)
Neighbor (not part of your network but legitimate)
External or Ad hoc devices
Without this initial classification, WIPS cannot properly assess threats or trigger alarms.
References:
CWSP-208 Study Guide, Chapter 7 - WIPS Classification and Threat Management CWNP CWSP-208 Objectives: "Device Classification and Policy Enforcement"
NEW QUESTION # 83
Given: A WLAN consultant has just finished installing a WLAN controller with 15 controller-based APs.
Two SSIDs with separate VLANs are configured for this network, and both VLANs are configured to use the same RADIUS server. The SSIDs are configured as follows:
SSID Blue - VLAN 10 - Lightweight EAP (LEAP) authentication - CCMP cipher suite SSID Red - VLAN 20 - PEAPv0/EAP-TLS authentication - TKIP cipher suite The consultant's computer can successfully authenticate and browse the Internet when using the Blue SSID.
The same computer cannot authenticate when using the Red SSID.
What is a possible cause of the problem?
- A. The consultant does not have a valid Kerberos ID on the Blue VLAN.
- B. The client does not have a proper certificate installed for the tunneled authentication within the established TLS tunnel.
- C. The TKIP cipher suite is not a valid option for PEAPv0 authentication.
- D. The Red VLAN does not use server certificate, but the client requires one.
Answer: B
Explanation:
PEAPv0/EAP-TLS is a tunneled EAP method that requires:
The server to present a certificate for TLS tunnel establishment.
The client to present a valid client certificate within the tunnel (in the case of EAP-TLS).
If the client does not have a valid X.509 certificate installed, authentication will fail.
Incorrect:
A). The server certificate is required for the TLS tunnel, and it is typically present; the issue here lies with the client cert.
B). TKIP is technically compatible with PEAPv0, although AES-CCMP is preferred.
D). Kerberos is unrelated to EAP authentication and VLAN use.
References:
CWSP-208 Study Guide, Chapter 4 (PEAP and EAP-TLS Authentication)
IEEE 802.1X and TLS Frameworks
NEW QUESTION # 84
Given: A network security auditor is preparing to perform a comprehensive assessment of an 802.11ac network's security.
What task should be performed at the beginning of the audit to maximize the auditor's ability to expose network vulnerabilities?
- A. Identify the wireless security solution(s) currently in use.
- B. Identify the IP subnet information for each network segment.
- C. Identify the manufacturer of the wireless intrusion prevention system.
- D. Identify the skill level of the wireless network security administrator(s).
- E. Identify the manufacturer of the wireless infrastructure hardware.
Answer: A
Explanation:
Before conducting a security audit of an 802.11ac WLAN, it is essential to know the current security implementations-such as the use of WPA2-Enterprise, 802.1X, or MAC filtering. This helps the auditor tailor tests to identify gaps, weaknesses, or misconfigurations in the existing system. Understanding the security solutions provides the most immediate insight into potential vulnerabilities.
NEW QUESTION # 85
Which one of the following describes the correct hierarchy of 802.1X authentication key derivation?
- A. If passphrase-based client authentication is used by the EAP type, the PMK is mapped directly from the user's passphrase. The PMK is then used during the 4-way handshake to create data encryption keys.
- B. The MSK is generated from the 802.1X/EAP authentication. The PMK is derived from the MSK. The PTK is derived from the PMK, and the keys used for actual data encryption are a part of the PTK.
- C. The PMK is generated from a successful mutual EAP authentication. When mutual authentication is not used, an MSK is created. Either of these two keys may be used to derive the temporal data encryption keys during the 4-way handshake.
- D. After successful EAP authentication, the RADIUS server generates a PMK. A separate key, the MSK, is derived from the AAA key and is hashed with the PMK to create the PTK and GTK.
Answer: B
Explanation:
In 802.1X/EAP authentication:
The EAP method (e.g., EAP-TLS, PEAP) results in the generation of a Master Session Key (MSK).
The Pairwise Master Key (PMK) is derived from the MSK.
The Pairwise Transient Key (PTK) is derived from the PMK using nonces and MAC addresses during the 4- Way Handshake.
The PTK includes the actual keys used for data encryption.
Incorrect:
B). This applies to WPA/WPA2-Personal, not 802.1X/EAP.
C). The RADIUS server sends the MSK, not the PMK directly.
D). The MSK is always derived during EAP authentication, mutual or not.
References:
CWSP-208 Study Guide, Chapter 3 (Key Hierarchy)
IEEE 802.11i Specification
NEW QUESTION # 86
......
Get Special Discount Offer of CWSP-208 Certification Exam Sample Questions and Answers: https://examsforall.actual4dump.com/CWNP/CWSP-208-actualtests-dumps.html