Passing CWNP CWSP-208 Exam Using 2026 Practice Tests
CWSP-208 Study Guide Brilliant CWSP-208 Exam Dumps PDF
CWNP CWSP-208 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 63
ABC Company has deployed a Single Channel Architecture (SCA) solution to help overcome some of the common problems with client roaming. In such a network, all APs are configured with the same channel and BSSID. PEAPv0/EAP-MSCHAPv2 is the only supported authentication mechanism.
As the Voice over Wi-Fi (STA-1) client moves throughout this network, what events are occurring?
- A. STA-1 controls when and where to roam by using signal and performance metrics in accordance with the chipset drivers and 802.11k.
- B. The WLAN controller is querying the RADIUS server for authentication before the association of STA-
1 is moved from one AP to the next. - C. STA-1 initiates open authentication and 802.11 association with each AP prior to roaming.
- D. The WLAN controller controls the AP to which STA-1 is associated and transparently moves this association in accordance with the physical location of STA-1.
Answer: B
Explanation:
An 802.11a/g-based WIPS cannot detect rogue activity that occurs in 802.11n/ac-specific modes, including Greenfield (HT-only) operation and use of 40 MHz channels, which are not part of the 802.11a/g specification. Greenfield mode disables legacy support, so a WIPS limited to 802.11a/g radios won't even
"see" these frames. This leaves a significant blind spot for detecting certain types of rogue devices or attacks using newer PHYs.
References:
CWSP-208 Study Guide, Chapter 7 - WIPS Capabilities and Limitations
CWNP CWSP-208 Objectives: "Protocol Compatibility and Threat Detection"
NEW QUESTION # 64
You must support a TSN as you have older wireless equipment that will not support the required processing of AES encryption. Which one of the following technologies will you use on the network so that a TSN can be implemented that would not be required in a network compliant with 802.11-2012 non-deprecated technologies?
- A. WEP
- B. CCMP
- C. WPA2
- D. RC4
Answer: D
Explanation:
A Transitional Security Network (TSN) allows legacy stations to interoperate by using older encryption methods. If AES (CCMP) is unsupported by older equipment, the network can fall back to TKIP, which uses RC4 as its encryption algorithm. TKIP enables AES encryption on newer devices while accommodating legacy clients.
Options A, C, D are current or deprecated standards with AES; only RC4 matches the transitional need.
References:
CWSP#207 Study Guide, Chapter 3 (TSN, TKIP, AES-CCMP)
NEW QUESTION # 65
Given: An 802.1X/EAP implementation includes an Active Directory domain controller running Windows Server 2012 and an AP from a major vendor. A Linux server is running RADIUS and it queries the domain controller for user credentials. A Windows client is accessing the network.
What device functions as the EAP Supplicant?
- A. Windows server
- B. An unlisted switch
- C. Access point
- D. Linux server
- E. Windows client
- F. An unlisted WLAN controller
Answer: E
Explanation:
In an 802.1X/EAP authentication model:
Supplicant: The device requesting access (the Windows client).
Authenticator: The AP or switch enforcing access decisions.
Authentication Server: The RADIUS server (Linux in this case), which communicates with a backend credential database (Active Directory).
The Windows client runs the EAP supplicant software to initiate authentication.
Incorrect:
A). The Linux server is the Authentication Server (not Supplicant).
C). The AP acts as the Authenticator.
D). The Windows Server is the credential store, not the supplicant.
References:
CWSP-208 Study Guide, Chapter 4 (802.1X Roles and Communication)
CWNP 802.1X Architecture Diagram
NEW QUESTION # 66
What drawbacks initially prevented the widespread acceptance and use of Opportunistic Key Caching (OKC)?
- A. Key exchanges during fast roams required processor-intensive cryptography, which was prohibitive for legacy devices supporting only TKIP.
- B. Sharing cached keys between controllers during inter-controller roaming created vulnerabilities that exposed the keys to attackers.
- C. The Wi-Fi Alliance continually delayed the creation of a client certification for OKC, even though it was defined by IEEE 802.11r.
- D. Because OKC is not defined by any standards or certification body, client support was delayed and sporadic early on.
Answer: D
Explanation:
Opportunistic Key Caching (OKC) is a non-standardized fast roaming method that allows clients to roam between APs without repeating the full 802.1X/EAP authentication process.
OKC was proposed by vendors (not the IEEE or Wi-Fi Alliance), so there was no formal certification early on.
This led to inconsistent and delayed client support, preventing widespread adoption.
Incorrect:
A). OKC does not involve inter-controller roaming in most scenarios; it's a local caching method.
C). The cryptographic overhead was not a significant barrier compared to lack of standardization.
D). OKC was not defined in IEEE 802.11r-Fast BSS Transition (FT) was.
References:
CWSP-208 Study Guide, Chapter 6 (Fast Secure Roaming)
CWNP Wireless Mobility Standards Overview
NEW QUESTION # 67
What type of WLAN attack is prevented with the use of a per-MPDU TKIP sequence counter (TSC)?
- A. Bit-flipping
- B. Weak-IV
- C. Replay
- D. Forgery
- E. Session hijacking
Answer: C
Explanation:
TKIP (Temporal Key Integrity Protocol) was introduced with WPA to enhance WEP security. One of the security mechanisms used in TKIP is a per-MPDU (MAC Protocol Data Unit) sequence counter called the TSC (TKIP Sequence Counter). The TSC acts as a form of replay protection by assigning a unique sequence number to each transmitted frame. If a packet is received with a sequence number lower than or equal to a previously received number, it is discarded. This directly prevents replay attacks, where a malicious actor resends previously captured frames in an attempt to spoof the session or extract data.
References:
CWSP-208 Official Study Guide, Chapter 5 (WLAN Threats and Attacks)
CWNP Exam Objectives: WLAN Encryption and Key Management
IEEE 802.11i-2004 standard (Replay protection mechanisms in TKIP)
NEW QUESTION # 68
Given: You must implement 7 APs for a branch office location in your organization. All APs will be autonomous and provide the same two SSIDs (CORP1879 and Guest).
Because each AP is managed directly through a web-based interface, what must be changed on every AP before enabling the WLANs to ensure proper staging procedures are followed?
- A. Fragmentation threshold
- B. Administrative password
- C. Output power
- D. Cell radius
Answer: B
Explanation:
For security and proper management, each autonomous AP must have:
A unique, non-default administrative password.
This ensures attackers cannot guess login credentials and access AP settings.
Especially critical when managing via web interface, which may expose login portals to the local network.
Incorrect:
A). Fragmentation threshold is rarely adjusted except for special performance tuning.
C & D. Output power and cell radius settings are adjusted during RF design, but they don't relate to staging
/security directly.
References:
CWSP-208 Study Guide, Chapter 7 (AP Deployment Security)
CWNP WLAN Deployment Hardening Best Practices
NEW QUESTION # 69
Given: You are using a Wireless Aggregator utility to combine multiple packet captures. One capture exists for each of channels 1, 6 and 11. What kind of troubleshooting are you likely performing with such a tool?
- A. Wireless adapter failure analysis.
- B. Fast secure roaming problems.
- C. Interference source location.
- D. Narrowband DoS attack detection.
Answer: B
Explanation:
When using a wireless aggregator to combine packet captures from channels 1, 6, and 11 (the three non- overlapping 2.4 GHz channels), you're most likely analyzing multi-channel behavior. This is particularly relevant when troubleshooting roaming issues, such as fast secure roaming (e.g., 802.11r). These captures help determine whether authentication or association events occur smoothly across APs operating on different channels.
Incorrect:
A). Adapter failure doesn't require multi-channel capture.
B). Interference location is typically single-channel and spectrum-analysis focused.
D). Narrowband DoS attacks are also usually identified using RF spectrum analysis, not packet capture across all channels.
References:
CWSP-208 Study Guide, Chapter 6 (Roaming and Mobility)
CWNP Whitepaper: WLAN Troubleshooting Methodologies
CWNP Learning Portal: 802.11 Roaming and Analysis
NEW QUESTION # 70
Given: ABC Corporation is evaluating the security solution for their existing WLAN. Two of their supported solutions include a PPTP VPN and 802.1X/LEAP. They have used PPTP VPNs because of their wide support in server and desktop operating systems. While both PPTP and LEAP adhere to the minimum requirements of the corporate security policy, some individuals have raised concerns about MS-CHAPv2 (and similar) authentication and the known fact that MS-CHAPv2 has proven vulnerable in improper implementations.
As a consultant, what do you tell ABC Corporation about implementing MS-CHAPv2 authentication?
(Choose 2)
- A. MS-CHAPv2 is subject to offline dictionary attacks.
- B. MS-CHAPv2 is compliant with WPA-Personal, but not WPA2-Enterprise.
- C. MS-CHAPv2 uses AES authentication, and is therefore secure.
- D. LEAP's use of MS-CHAPv2 is only secure when combined with WEP.
- E. When implemented with AES-CCMP encryption, MS-CHAPv2 is very secure.
- F. MS-CHAPv2 is only appropriate for WLAN security when used inside a TLS-encrypted tunnel.
Answer: A,F
Explanation:
MS-CHAPv2 is a widely used authentication protocol, but it has notable weaknesses:
B). MS-CHAPv2 is vulnerable to offline dictionary attacks. Attackers can capture authentication exchanges and attempt password guesses offline due to predictable hashing behavior.
D). The only secure use of MS-CHAPv2 is inside a secure tunnel (e.g., EAP-TTLS or PEAP), where credentials are protected during transmission.
Incorrect:
A). MS-CHAPv2 is used in WPA2-Enterprise, not WPA-Personal, and it is allowed under WPA2-Enterprise via PEAP.
C). WEP does not enhance LEAP's security; it compounds vulnerabilities.
E and F. MS-CHAPv2 does not use AES for authentication. Using AES-CCMP for encryption does not fix MS-CHAPv2's weaknesses.
References:
CWSP-208 Study Guide, Chapter 4 (EAP Methods and Authentication Protocols) CWNP MS-CHAPv2 and PEAP Implementation Guidelines Microsoft MS-CHAPv2 Vulnerability Advisories
NEW QUESTION # 71
Given: The Marketing department's WLAN users need to reach their file and email server as well as the Internet, but should not have access to any other network resources.
What single WLAN security feature should be implemented to comply with these requirements?
- A. Role-based access control
- B. RADIUS policy accounting
- C. Captive portal
- D. Mutual authentication
- E. Group authentication
Answer: A
Explanation:
Role-Based Access Control (RBAC) allows administrators to define user roles and enforce network access permissions based on the user's identity. By implementing RBAC in the WLAN, you can:
Grant the Marketing group access only to the file/email server and the Internet Prevent access to other internal resources This single feature enables fine-grained restriction without needing multiple SSIDs or ACLs.
Other options don't provide the necessary flexibility:
A). Mutual authentication ensures secure identity verification but doesn't control network access scope B & D & E do not provide targeted resource-level access control References:
CWSP#207 Study Guide, Chapter 6 (Access Control Policy and RBAC)
NEW QUESTION # 72
Your organization required compliance reporting and forensics features in relation to the 802.11ac WLAN they have recently installed. These features are not built into the management system provided by the WLAN vendor. The existing WLAN is managed through a centralized management console provided by the AP vendor with distributed APs and multiple WLAN controllers configured through this console.
What kind of system should be installed to provide the required compliance reporting and forensics features?
- A. WNMS
- B. Cloud management platform
- C. WIPS integrated
- D. WIPS overlay
Answer: D
Explanation:
When compliance reporting and forensic analysis are required and the WLAN vendor's centralized management system does not provide it, deploying a dedicated overlay WIPS is the most effective solution.
Overlay WIPS uses dedicated sensors independent of the WLAN's operational radios, offering detailed threat detection, compliance logging, and reporting capabilities that often surpass native WLAN features.
References:
CWSP-208 Study Guide, Chapter 7 - Overlay vs Integrated WIPS
CWNP CWSP-208 Objectives: "Compliance Monitoring and Forensics"
NEW QUESTION # 73
Given: You are using WEP as an encryption solution. You are using VLANs for network segregation.
Why can you not establish an RSNA?
- A. RSNA connections do not work in conjunction with VLANs.
- B. RSNA connections require CCMP and do not support TKIP or WEP.
- C. RSNA connections require BIP and do not support TKIP, CCMP or WEP.
- D. RSNA connections require TKIP or CCMP.
Answer: D
Explanation:
RSNA (Robust Security Network Association), as defined by 802.11i, requires:
TKIP (WPA) or CCMP (WPA2) for encryption.
WEP is deprecated and not supported for RSNA since it does not meet RSN standards.
Incorrect:
B & C. BIP is not required for RSNA formation-it is used for management frame protection (802.11w).
D). VLANs are orthogonal to RSNA-network segmentation does not interfere with RSNA formation.
References:
CWSP-208 Study Guide, Chapter 3 (RSNA Formation and Key Hierarchy)
IEEE 802.11i and 802.11-2012 Standards
NEW QUESTION # 74
Given: The ABC Corporation currently utilizes an enterprise Public Key Infrastructure (PKI) to allow employees to securely access network resources with smart cards. The new wireless network will use WPA2- Enterprise as its primary authentication solution. You have been asked to recommend a Wi-Fi Alliance-tested EAP method.
What solutions will require the least change in how users are currently authenticated and still integrate with their existing PKI?
- A. EAP-TLS
- B. EAP-TTLS/MSCHAPv2
- C. PEAPv0/EAP-MSCHAPv2
- D. LEAP
- E. EAP-FAST
- F. PEAPv0/EAP-TLS
Answer: A
Explanation:
ABC Corporation already uses PKI and smart cards. EAP-TLS:
Is a certificate-based authentication protocol.
Integrates seamlessly with PKI infrastructure.
Is supported and certified by the Wi-Fi Alliance.
Incorrect:
A). EAP-FAST uses PACs, not certificates.
C). PEAPv0/EAP-MSCHAPv2 does not use certificates on the client side and is less secure.
D). LEAP is deprecated and insecure.
E). PEAPv0/EAP-TLS is not a standardized combination.
F). EAP-TTLS/MSCHAPv2 requires password-based authentication inside a tunnel, not certificate-based authentication.
References:
CWSP-208 Study Guide, Chapter 4 (EAP-TLS and PKI)
CWNP WPA2-Enterprise Integration Guidelines
NEW QUESTION # 75
After completing the installation of a new overlay WIPS for the purpose of rogue detection and security monitoring at your corporate headquarters, what baseline function MUST be performed in order to identify security threats?
- A. Authorized PEAP usernames must be added to the WIPS server's user database.
- B. Separate security profiles must be defined for network operation in different regulatory domains
- C. Upstream and downstream throughput thresholds must be specified to ensure that service-level agreements are being met.
- D. WLAN devices that are discovered must be classified (rogue, authorized, neighbor, etc.) and a WLAN policy must define how to classify new devices.
Answer: D
Explanation:
After deploying a WIPS, an essential baseline activity is to classify all detected devices in the RF environment. These classifications allow the system to enforce security policies and detect policy violations.
Classifications include:
Authorized (managed devices)
Rogue (unauthorized, possibly dangerous)
Neighbor (not part of your network but legitimate)
External or Ad hoc devices
Without this initial classification, WIPS cannot properly assess threats or trigger alarms.
References:
CWSP-208 Study Guide, Chapter 7 - WIPS Classification and Threat Management CWNP CWSP-208 Objectives: "Device Classification and Policy Enforcement"
NEW QUESTION # 76
Given: ABC Hospital wishes to create a strong security policy as a first step in securing their 802.11 WLAN.
Before creating the WLAN security policy, what should you ensure you possess?
- A. End-user training manuals for the policies to be created
- B. Security policy generation software
- C. Awareness of the exact vendor devices being installed
- D. Management support for the process
Answer: D
Explanation:
Developing a robust WLAN security policy requires buy-in from executive or senior management. Without management support, it's difficult to enforce compliance, allocate resources, or prioritize security among other organizational objectives. This foundational step ensures that policy creation and enforcement are feasible and aligned with organizational goals.
Incorrect:
A). Device/vendor specifics are addressed later during implementation.
C). End-user training materials are created after the policy is finalized.
D). Security policy software can assist, but is not essential compared to management support.
References:
CWSP-208 Study Guide, Chapter 2 (Policy Development and Implementation) CWNP WLAN Lifecycle Framework
NEW QUESTION # 77
What is a primary criteria for a network to qualify as a Robust Security Network (RSN)?
- A. WLAN controllers and APs must not support SSHv1.
- B. Token cards must be used for authentication.
- C. WEP may not be used for encryption.
- D. Dynamic WEP-104 encryption must be enabled.
- E. WPA-Personal must be supported for authentication and encryption.
Answer: C
Explanation:
A Robust Security Network (RSN) is defined by the IEEE 802.11i standard and is designed to provide a framework for secure wireless LAN communications. One of the primary criteria for a network to qualify as an RSN is that WEP (Wired Equivalent Privacy) must not be used for encryption, as WEP has well-known vulnerabilities and is considered insecure. RSN-compliant networks must use either CCMP (AES) or GCMP for encryption and 802.1X/EAP or WPA2-Personal for authentication.
Incorrect:
A). Token cards are not part of RSN criteria.
B). Dynamic WEP is still WEP and disqualifies RSN status.
D). WPA-Personal may be supported, but alone does not define an RSN.
E). SSHv1 concerns device management security, not RSN qualification.
References:
CWSP-208 Study Guide, Chapter 3 (Robust Security Networks)
IEEE 802.11i Standard
CWNP Exam Objectives: Security Standards and Protocols
NEW QUESTION # 78
You are using a utility that takes input and generates random output. For example, you can provide the input of a known word as a secret word and then also provide another known word as salt input. When you process the input it generates a secret code which is a combination of letters and numbers with case sensitivity. For what is the described utility used? (Choose 3)
- A. Generating secret keys for RADIUS servers and WLAN infrastructure devices
- B. Generating dynamic session keys used for IPSec VPNs
- C. Generating passwords for WLAN infrastructure equipment logins
- D. Generating passphrases for WLAN systems secured with WPA2-Personal
- E. Generating PMKs that can be imported into 802.11 RSN-compatible devices
Answer: A,D,E
Explanation:
A utility that combines a secret and salt to generate a random string is effectively a key derivation tool. It can be used to:
Generate PMKs (Pairwise Master Keys) to preload ready-made keys into RSN devices Generate shared secrets (e.g., RADIUS shared secrets, WLAN controller keys) Create strong passphrases for WPA2-Personal networks Using it for IPSec session keys is less common (those are usually dynamically negotiated), and creating management passwords is possible but not the main us
NEW QUESTION # 79
What 802.11 WLAN security problem is directly addressed by mutual authentication?
- A. Offline dictionary attacks
- B. MAC spoofing
- C. Disassociation attacks
- D. Weak Initialization Vectors
- E. Weak password policies
- F. Wireless hijacking attacks
Answer: F
Explanation:
Mutual authentication involves both the client and the authentication server verifying each other's identity before network access is granted. This prevents attackers from spoofing an access point (AP) and luring clients to connect to rogue APs (often used in wireless hijacking or evil twin attacks). When mutual authentication (typically via 802.1X with EAP-TLS) is used, clients will not connect unless they can verify the server certificate, which thwarts hijacking attempts.
References:
CWSP-208 Study Guide, Chapter 4 (Authentication and Access Control)
CWNP E-Learning: 802.1X and EAP Authentication Framework
IEEE 802.1X and WPA2-Enterprise concepts
NEW QUESTION # 80
......
Free CWSP-208 Test Questions Real Practice Test Questions: https://www.practicetorrent.com/CWSP-208-practice-exam-torrent.html
View CWSP-208 Exam Question Dumps With Latest Demo: https://drive.google.com/open?id=1WDv0FlzMKiClhgN0B6OdGHtxKgf0t1JT