CWSP-208 Exam Dumps, CWSP-208 Practice Test Questions
PDF (New 2026) Actual CWNP CWSP-208 Exam Questions
CWNP CWSP-208 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 57
Given: Your network implements an 802.1X/EAP-based wireless security solution. A WLAN controller is installed and manages seven APs. FreeRADIUS is used for the RADIUS server and is installed on a dedicated server named SRV21. One example client is a MacBook Pro with 8 GB RAM.
What device functions as the 802.1X/EAP Authenticator?
- A. MacBook Pro
- B. SRV21
- C. RADIUS server
- D. WLAN Controller/AP
Answer: D
Explanation:
Comprehensive Detailed Explanation:
In the 802.1X/EAP framework:
The Authenticator is the device that controls access to the network - typically the AP or WLAN controller.
The Authenticator passes EAP messages between the Supplicant (client) and the Authentication Server (RADIUS).
Incorrect:
A). SRV21 is the RADIUS server (Authentication Server), not the Authenticator.
C). The MacBook Pro is the Supplicant.
D). RADIUS server handles Authentication, not Authenticator functionality.
References:
CWSP-208 Study Guide, Chapter 4 (802.1X Architecture Roles)
CWNP AAA and Authentication Design
NEW QUESTION # 58
Given: Many corporations configure guest VLANs on their WLAN controllers that allow visitors to have Internet access only. The guest traffic is tunneled to the DMZ to prevent some security risks.
In this deployment, what risks are still associated with implementing the guest VLAN without any advanced traffic monitoring or filtering features enabled? (Choose 2)
- A. Intruders can send spam to the Internet through the guest VLAN.
- B. Unauthorized users can perform Internet-based network attacks through the WLAN.
- C. Guest users can reconfigure AP radios servicing the guest VLAN unless unsecure network management protocols (e.g. Telnet, HTTP) are blocked.
- D. Peer-to-peer attacks can still be conducted between guest users unless application-layer monitoring and filtering are implemented.
- E. Once guest users are associated to the WLAN, they can capture 802.11 frames from the corporate VLANs.
Answer: A,B
Explanation:
Without traffic monitoring or filtering on guest VLANs, the following threats remain possible:
Spammers can exploit the open Internet access to send unsolicited traffic en.wikipedia.org Guests may launch external network attacks (e.g., scanning, DDoS) Peer-to-peer attacks are prevented if client isolation is enabled. AP management plane security is a separate concern from VLAN separation, and VLAN isolation prevents frame sniffing into corporate networks.
NEW QUESTION # 59
In the basic 4-way handshake used in secure 802.11 networks, what is the purpose of the ANonce and SNonce? (Choose 2)
- A. They are used to pad Message 1 and Message 2 so each frame contains the same number of bytes.
- B. They are added together and used as the GMK, from which the GTK is derived.
- C. They allow the participating STAs to create dynamic keys while avoiding sending unicast encryption keys across the wireless medium.
- D. They are input values used in the derivation of the Pairwise Transient Key.
- E. The IEEE 802.11 standard requires that all encrypted frames contain a nonce to serve as a Message Integrity Check (MIC).
Answer: C,D
Explanation:
In the 802.11 4-Way Handshake:
D: The ANonce (from the AP) and SNonce (from the STA) are critical entropy values used along with the PMK, MAC addresses, etc., to derive the PTK securely.
E: This process ensures both parties derive the same PTK without ever transmitting the key over the air, mitigating interception risk.
Incorrect:
A). Nonces are not padding bytes.
B). Nonces are not the MIC; MIC is a separate integrity mechanism.
C). GMK and GTK are for group keys, not derived from nonces.
References:
CWSP-208 Study Guide, Chapter 3 (4-Way Handshake Mechanics)
IEEE 802.11i Specification
NEW QUESTION # 60
What preventative measures are performed by a WIPS against intrusions?
- A. EAPoL Reject frame flood against a rogue AP
- B. Deauthentication attack against a classified neighbor AP
- C. Uses SNMP to disable the switch port to which rogue APs connect
- D. ASLEAP attack against a rogue AP
- E. Evil twin attack against a rogue AP
Answer: C
Explanation:
Wireless Intrusion Prevention Systems (WIPS) can proactively respond to detected threats using various techniques. One such preventative measure is integration with the wired infrastructure to mitigate rogue APs by disabling the switch port they are connected to. This is typically done through SNMP or other switch management interfaces.
This form of wired-side containment is more secure and compliant than wireless-side attacks (e.g., deauthentication), which can violate regulations in some jurisdictions.
References:
CWSP-208 Study Guide, Chapter 7 - WIPS Architecture and Countermeasures CWNP CWSP-208 Exam Objectives: "WIPS Prevention and Containment Techniques"
NEW QUESTION # 61
When using a tunneled EAP type, such as PEAP, what component is protected inside the TLS tunnel so that it is not sent in clear text across the wireless medium?
- A. RADIUS shared secret
- B. User credentials
- C. Server credentials
- D. X.509 certificates
Answer: B
Explanation:
In tunneled EAP types (e.g., PEAP, EAP-TTLS):
A secure TLS tunnel is first established using the server's certificate.
Then, user credentials (e.g., username/password) are sent through the encrypted tunnel to ensure confidentiality.
Incorrect:
A). Certificates are exchanged during tunnel establishment, not protected within it.
C). Server credentials are used to establish the tunnel, not protected inside it.
D). The RADIUS shared secret secures communication between AP/controller and RADIUS server-not sent via the tunnel.
References:
CWSP-208 Study Guide, Chapter 4 (Tunneled EAP Methods)
IEEE 802.1X and EAP Specifications
NEW QUESTION # 62
What statement is true regarding the nonces (ANonce and SNonce) used in the IEEE 802.11 4 Way Handshake?
- A. Both nonces are used by the Supplicant and Authenticator in the derivation of a single PTK.
- B. Nonces are sent in EAPoL frames to indicate to the receiver that the sending station has installed and validated the encryption keys.
- C. The Supplicant uses the SNonce to derive its unique PTK and the Authenticator uses the ANonce to derive its unique PTK, but the nonces are not shared.
- D. The nonces are created by combining the MAC addresses of the Supplicant, Authenticator, and Authentication Server into a mixing algorithm.
Answer: A
Explanation:
The PTK derivation requires:
PMK
ANonce (generated by the Authenticator)
SNonce (generated by the Supplicant)
MAC addresses of both Authenticator and Supplicant
Both the Supplicant and Authenticator derive the same PTK using identical inputs during the 4-Way Handshake.
Incorrect:
B). The nonces are shared-each party uses both ANonce and SNonce.
C). Nonces indicate no such validation message.
D). The MACs are part of the PTK input but not used to generate the nonces themselves.
References:
CWSP-208 Study Guide, Chapter 3 (4-Way Handshake)
IEEE 802.11i Key Management Process
NEW QUESTION # 63
When TKIP is selected as the pairwise cipher suite, what frame types may be protected with data confidentiality? (Choose 2)
- A. Control
- B. Robust broadcast management
- C. QoS Data
- D. Robust unicast management
- E. ACK
- F. Data
Answer: C,F
Explanation:
TKIP (Temporal Key Integrity Protocol) is a pairwise encryption method introduced with WPA to enhance WEP security. TKIP can protect:
D). Data frames: These are the core unicast data transmissions between clients and access points.
F). QoS Data frames: These are a subtype of data frames supporting 802.11e/WMM enhancements and are also protected under TKIP.
Incorrect:
A & B. TKIP does not support robust management frame protection. Management frame protection is handled by 802.11w with AES-CCMP and BIP.
C & E. Control frames and ACKs are never encrypted, as they need to be read by all stations regardless of encryption status.
References:
CWSP-208 Study Guide, Chapter 3 (Frame Types and Encryption)
IEEE 802.11i Standard
NEW QUESTION # 64
You are using a protocol analyzer for random checks of activity on the WLAN. In the process, you notice two different EAP authentication processes. One process (STA1) used seven EAP frames (excluding ACK frames) before the 4-way handshake and the other (STA2) used 11 EAP frames (excluding ACK frames) before the 4- way handshake.
Which statement explains why the frame exchange from one STA required more frames than the frame exchange from another STA when both authentications were successful? (Choose the single most probable answer given a stable WLAN.)
- A. STA2 has retransmissions of EAP frames.
- B. STA1 is a reassociation and STA2 is an initial association.
- C. STA1 is a TSN, and STA2 is an RSN.
- D. STA1 and STA2 are using different cipher suites.
- E. STA1 and STA2 are using different EAP types.
Answer: E
Explanation:
Different EAP types involve varying numbers of exchanges:
EAP-TLS, for example, involves more exchanges due to certificate negotiation.
EAP-MD5 or PEAP might involve fewer steps.
Thus, the most likely reason for different frame counts during successful authentication is the use of different EAP types.
Incorrect:
A). Cipher suites are negotiated after EAP, not during it.
B). Retransmissions would typically cause noticeable delay and not result in exactly 11 frames.
C). Reassociation does not significantly reduce EAP frame count.
D). RSN/TSN differences are not directly related to EAP exchange length.
References:
CWSP-208 Study Guide, Chapter 4 (EAP Protocol Operation)
IEEE 802.1X and EAP Behavior Documentation
NEW QUESTION # 65
A single AP is configured with three separate WLAN profiles, as follows:
1. SSID: ABCData - BSSID: 00:11:22:00:1F:C3 - VLAN 10 - Security: PEAPv0/EAP-MSCHAPv2 with AES-CCMP - 3 current clients
2. SSID: ABCVoice - BSSID: 00:11:22:00:1F:C4 - VLAN 60 - Security: WPA2-Personal with AES-CCMP
- 2 current clients
3. SSID: Guest - BSSID: 00:11:22:00:1F:C5 - VLAN 90 - Security: Open with captive portal authentication
- 3 current clients
Three STAs are connected to ABCData. Three STAs are connected to Guest. Two STAs are connected to ABCVoice.
How many unique GTKs and PTKs are currently in place in this scenario?
- A. 2 GTKs - 5 PTKs
- B. 2 GTKs - 8 PTKs
- C. 1 GTK - 8 PTKs
- D. 3 GTKs - 8 PTKs
Answer: D
Explanation:
PTK (Pairwise Transient Key) is established per-client, so:
ABCData: 3 clients = 3 PTKs
ABCVoice: 2 clients = 2 PTKs
Guest: 3 clients = 3 PTKs
Total: 8 PTKs
GTK (Group Temporal Key) is shared per SSID, so:
One GTK per SSID (ABCData, ABCVoice, Guest)
Total: 3 GTKs
References:
CWSP-208 Study Guide, Chapter 3 (Key Hierarchy)
IEEE 802.11 Key Management Architecture
NEW QUESTION # 66
What WLAN client device behavior is exploited by an attacker during a hijacking attack?
- A. As specified by the Wi-Fi Alliance, clients using Open System authentication must allow direct client- to-client connections, even in an infrastructure BSS.
- B. Client drivers scan for and connect to access points in the 2.4 GHz band before scanning the 5 GHz band.
- C. When the RF signal between a client and an access point is disrupted for more than a few seconds, the client device will attempt to associate to an access point with better signal quality.
- D. After the initial association and 4-way handshake, client stations and access points do not need to perform another 4-way handshake, even if connectivity is lost.
- E. When the RF signal between a client and an access point is lost, the client will not seek to reassociate with another access point until the 120 second hold down timer has expired.
Answer: C
Explanation:
Hijacking attacks often rely on exploiting client behavior during signal disruption. Clients will seek better connections when RF is weak or interrupted. An attacker may:
Disrupt the signal (e.g., with a deauth attack)
Present a rogue access point (evil twin) with stronger signal
Trick the client into associating with the rogue AP, hijacking the session Incorrect:
B). There is no standard 120-second timer behavior.
C). Loss of connectivity typically triggers reassociation and reauthentication.
D). Direct client-to-client connections are not required in infrastructure mode.
E). Band selection logic varies and is unrelated to hijacking attacks.
References:
CWSP-208 Study Guide, Chapter 5 (Hijacking and Client Behavior)
CWNP Wi-Fi Threat Analysis
NEW QUESTION # 67
While performing a manual scan of your environment using a spectrum analyzer on a laptop computer, you notice a signal in the real time FFT view. The signal is characterized by having peak power centered on channel 11 with an approximate width of 20 MHz at its peak. The signal widens to approximately 40 MHz after it has weakened by about 30 dB.
What kind of signal is displayed in the spectrum analyzer?
- A. An 802.11g AP operating normally in 2.4 GHz
- B. An 802.11a AP operating normally in 5 GHz
- C. A low-power wideband RF attack is in progress in 2.4 GHz, causing significant 802.11 interference
- D. A frequency hopping device is being used as a signal jammer in 5 GHz
Answer: A
Explanation:
An 802.11g AP uses a 20 MHz-wide channel centered around a specific frequency (e.g., channel 11 at 2.462 GHz). On a spectrum analyzer:
The signal will peak at the center frequency with high power.
The width of approximately 20 MHz at peak and extending to 40 MHz as it drops 30 dB is typical for OFDM- based transmissions (802.11g uses OFDM).
Incorrect:
A). Frequency hopping is characteristic of Bluetooth and looks different on the spectrum (bursty, narrow signals that shift rapidly).
B). A wideband attack would appear more constant and not centered like a normal AP.
D). 802.11a operates in the 5 GHz band, not channel 11 (which is 2.4 GHz).
References:
CWSP-208 Study Guide, Chapter 6 (RF Analysis and Interference)
CWNP RF Spectrum Interpretation Guide
NEW QUESTION # 68
You are configuring seven APs to prevent common security attacks. The APs are to be installed in a small business and to reduce costs, the company decided to install all consumer-grade wireless routers. The wireless routers will connect to a switch, which connects directly to the Internet connection providing 50 Mbps of Internet bandwidth that will be shared among 53 wireless clients and 17 wired clients.
To ensure the wireless network is as secure as possible from common attacks, what security measure can you implement given only the hardware referenced?
- A. 802.1X/EAP-PEAP
- B. WPA-Enterprise
- C. WPA2-Personal
- D. WPA2-Enterprise
Answer: C
Explanation:
Given that only consumer-grade routers are used and no RADIUS server or enterprise infrastructure is mentioned, WPA2-Personal is the most secure option available. It uses a pre-shared key (PSK) for authentication and AES-CCMP for encryption, offering strong protection for small businesses lacking enterprise equipment.
Enterprise methods such as WPA2-Enterprise, 802.1X, and EAP-PEAP require a RADIUS server or authentication backend, which isn't supported in typical consumer-grade routers.
References:
CWSP-208 Study Guide, Chapter 3 (WLAN Security Technologies)
CWNP Wi-Fi Security Deployment Guide for Small Businesses
CWNP E-Learning Modules: WPA2-PSK vs WPA2-Enterprise
NEW QUESTION # 69
What is the purpose of the Pairwise Transient Key (PTK) in IEEE 802.11 Authentication and Key Management?
- A. The PTK contains keys that are used to encrypt unicast data frames that traverse the wireless medium.
- B. The PTK is a type of master key used as an input to the GMK, which is used for encrypting multicast data frames.
- C. The PTK is used to encrypt the Pairwise Master Key (PMK) for distribution to the 802.1X Authenticator prior to the 4-Way Handshake.
- D. The PTK is XOR'd with the PSK on the Authentication Server to create the AAA key.
Answer: A
Explanation:
The Pairwise Transient Key (PTK) is derived during the 4-Way Handshake and is used to generate:
The EAPOL-Key Confirmation Key (KCK)
The EAPOL-Key Encryption Key (KEK)
The Temporal Key (TK), which encrypts unicast traffic
Incorrect:
A). The Group Master Key (GMK) is used to derive the GTK, not the PTK.
C). PTK is not XOR'd with the PSK-PTK is derived from PMK + other session parameters.
D). PMK is never encrypted or transmitted; it is pre-shared or derived and remains local.
References:
CWSP-208 Study Guide, Chapter 3 (PTK and 4-Way Handshake)
IEEE 802.11i-2004 Specification
NEW QUESTION # 70
Role-Based Access Control (RBAC) allows a WLAN administrator to perform what network function?
- A. Provide two or more user groups connected to the same SSID with different levels of network privileges.
- B. Allow simultaneous support for multiple EAP types on a single access point.
- C. Allow access to specific files and applications based on the user's WMM access category.
- D. Minimize traffic load on an AP by requiring mandatory admission control for use of the Voice access category.
Answer: A
Explanation:
RBAC enables dynamic assignment of different access privileges (e.g., VLAN, ACLs, bandwidth) to users even when they connect through the same SSID. This simplifies SSID management while maintaining fine- grained access control.
Incorrect:
A). Admission control is a QoS/WMM function, not RBAC.
B). Access category (AC) affects frame prioritization, not file/app access.
D). Multiple EAP types are supported in authentication servers-not directly tied to RBAC.
References:
CWSP-208 Study Guide, Chapter 6 (Role-Based Access Control and SSID Simplification)
NEW QUESTION # 71
You have an AP implemented that functions only using 802.11-2012 standard methods for the WLAN communications on the RF side and implementing multiple SSIDs and profiles on the management side configured as follows:
1. SSID: Guest - VLAN 90 - Security: Open with captive portal authentication - 2 current clients
2. SSID: ABCData - VLAN 10 - Security: PEAPv0/EAP-MSCHAPv2 with AES-CCMP - 5 current clients
3. SSID: ABCVoice - VLAN 60 - Security: WPA2-Personal - 2 current clients Two client STAs are connected to ABCData and can access a media server that requires authentication at the Application Layer and is used to stream multicast video streams to the clients.
What client stations possess the keys that are necessary to decrypt the multicast data packets carrying these videos?
- A. Only the members of the executive team that are part of the multicast group configured on the media server
- B. All clients that are associated to the AP with a shared GTK, which includes ABCData and ABCVoice.
- C. All clients that are associated to the AP using the ABCData SSID
- D. All clients that are associated to the AP using any SSID
Answer: C
Explanation:
The GTK (Group Temporal Key) is used to encrypt multicast/broadcast traffic.
Each SSID has a unique GTK.
Only clients on the same SSID (ABCData) will receive and be able to decrypt multicast traffic encrypted with ABCData's GTK.
Incorrect:
A). Application-layer authentication does not affect GTK distribution.
C). Clients on other SSIDs (e.g., Guest, ABCVoice) have different GTKs and cannot decrypt ABCData's multicast traffic.
D). Each SSID uses a unique GTK; GTKs are not shared across SSIDs.
References:
CWSP-208 Study Guide, Chapter 3 (GTK Usage in Multicast)
IEEE 802.11i and CCMP Specifications
NEW QUESTION # 72
Given: Fred works primarily from home and public wireless hot-spots rather than commuting to the office. He frequently accesses the office network remotely from his Mac laptop using the local 802.11 WLAN.
In this remote scenario, what single wireless security practice will provide the greatest security for Fred?
- A. Use only HTTPS when agreeing to acceptable use terms on public networks
- B. Use an IPSec VPN for connectivity to the office network
- C. Use secure protocols, such as FTP, for remote file transfers.
- D. Use WIPS sensor software on the laptop to monitor for risks and attacks
- E. Use enterprise WIPS on the corporate office network
- F. Use 802.1X/PEAPv0 to connect to the corporate office network from public hot-spots
Answer: B
Explanation:
When connecting over untrusted public networks:
An IPSec VPN provides encryption and authentication from the client to the corporate network.
This protects against eavesdropping, man-in-the-middle attacks, and spoofed hotspots.
Incorrect:
B). HTTPS only protects web sessions-not all traffic.
C). Enterprise WIPS at the office won't protect remote users.
D). Laptop-based WIPS software is rare and less effective than using a VPN.
E). 802.1X/PEAP is not designed for remote use over public hotspots.
F). FTP is not secure; secure alternatives include SFTP or FTPS.
References:
CWSP-208 Study Guide, Chapter 6 (VPNs and Remote Security)
CWNP Remote Access Security Best Practices
NEW QUESTION # 73
What drawbacks initially prevented the widespread acceptance and use of Opportunistic Key Caching (OKC)?
- A. Because OKC is not defined by any standards or certification body, client support was delayed and sporadic early on.
- B. The Wi-Fi Alliance continually delayed the creation of a client certification for OKC, even though it was defined by IEEE 802.11r.
- C. Sharing cached keys between controllers during inter-controller roaming created vulnerabilities that exposed the keys to attackers.
- D. Key exchanges during fast roams required processor-intensive cryptography, which was prohibitive for legacy devices supporting only TKIP.
Answer: A
Explanation:
Opportunistic Key Caching (OKC) is a non-standardized fast roaming method that allows clients to roam between APs without repeating the full 802.1X/EAP authentication process.
OKC was proposed by vendors (not the IEEE or Wi-Fi Alliance), so there was no formal certification early on.
This led to inconsistent and delayed client support, preventing widespread adoption.
Incorrect:
A). OKC does not involve inter-controller roaming in most scenarios; it's a local caching method.
C). The cryptographic overhead was not a significant barrier compared to lack of standardization.
D). OKC was not defined in IEEE 802.11r-Fast BSS Transition (FT) was.
References:
CWSP-208 Study Guide, Chapter 6 (Fast Secure Roaming)
CWNP Wireless Mobility Standards Overview
NEW QUESTION # 74
Given: A network security auditor is preparing to perform a comprehensive assessment of an 802.11ac network's security.
What task should be performed at the beginning of the audit to maximize the auditor's ability to expose network vulnerabilities?
- A. Identify the IP subnet information for each network segment.
- B. Identify the wireless security solution(s) currently in use.
- C. Identify the manufacturer of the wireless infrastructure hardware.
- D. Identify the manufacturer of the wireless intrusion prevention system.
- E. Identify the skill level of the wireless network security administrator(s).
Answer: B
Explanation:
Before conducting a security audit of an 802.11ac WLAN, it is essential to know the current security implementations-such as the use of WPA2-Enterprise, 802.1X, or MAC filtering. This helps the auditor tailor tests to identify gaps, weaknesses, or misconfigurations in the existing system. Understanding the security solutions provides the most immediate insight into potential vulnerabilities.
NEW QUESTION # 75
Given: WLAN attacks are typically conducted by hackers to exploit a specific vulnerability within a network.
What statement correctly pairs the type of WLAN attack with the exploited vulnerability? (Choose 3)
- A. RF DoS attacks prevent successful wireless communication on a specific frequency or frequency range.
- B. Hijacking attacks interrupt a user's legitimate connection and introduce a new connection with an evil twin AP.
- C. Zero-day attacks are always authentication or encryption cracking attacks.
- D. Association flood attacks are Layer 3 DoS attacks performed against authenticated client stations
- E. Social engineering attacks are performed to collect sensitive information from unsuspecting users
- F. Management interface exploit attacks are attacks that use social engineering to gain credentials from managers.
Answer: A,B,E
Explanation:
C). RF DoS attacks use signal jamming or interference to prevent communication.
D). Hijacking uses deauthentication and re-association to force users onto rogue APs.
E). Social engineering uses manipulation to acquire credentials or sensitive information.
Incorrect:
A). Management interface exploit attacks typically involve web or CLI interface vulnerabilities, not social engineering.
B). Zero-day attacks are based on unknown vulnerabilities, not just limited to authentication or encryption.
F). Association flood attacks occur at Layer 2, not Layer 3.
References:
CWSP-208 Study Guide, Chapter 5 (Types of Wireless Attacks)
CWNP Security Essentials - WLAN Threat Matrix
CWNP Whitepapers on Rogue APs and Social Engineering
NEW QUESTION # 76
What type of WLAN attack is prevented with the use of a per-MPDU TKIP sequence counter (TSC)?
- A. Forgery
- B. Replay
- C. Weak-IV
- D. Session hijacking
- E. Bit-flipping
Answer: B
Explanation:
TKIP (Temporal Key Integrity Protocol) was introduced with WPA to enhance WEP security. One of the security mechanisms used in TKIP is a per-MPDU (MAC Protocol Data Unit) sequence counter called the TSC (TKIP Sequence Counter). The TSC acts as a form of replay protection by assigning a unique sequence number to each transmitted frame. If a packet is received with a sequence number lower than or equal to a previously received number, it is discarded. This directly prevents replay attacks, where a malicious actor resends previously captured frames in an attempt to spoof the session or extract data.
References:
CWSP-208 Official Study Guide, Chapter 5 (WLAN Threats and Attacks)
CWNP Exam Objectives: WLAN Encryption and Key Management
IEEE 802.11i-2004 standard (Replay protection mechanisms in TKIP)
NEW QUESTION # 77
Given: Your organization is using EAP as an authentication framework with a specific type that meets the requirements of your corporate policies.
Which one of the following statements is true related to this implementation?
- A. The client STAs must use a different, but complementary, EAP type than the AP STAs.
- B. The client STAs may communicate over the uncontrolled port in order to authenticate as soon as Open System authentication completes.
- C. The client will be the authenticator in this scenario.
- D. The client STAs may communicate over the controlled port in order to authenticate as soon as the Open System authentication completes.
Answer: B
Explanation:
Comprehensive Detailed Explanation:
In 802.1X/EAP-based authentication:
After Open System authentication, clients send EAP messages via the uncontrolled port.
The Controlled Port remains blocked until the 802.1X/EAP and 4-Way Handshake processes are complete.
Incorrect:
A). The AP or controller is the authenticator, not the client.
B). EAP types must match between supplicant and server.
D). Controlled port remains blocked until full authentication and key negotiation completes.
References:
CWSP-208 Study Guide, Chapter 4 (802.1X Controlled and Uncontrolled Port Behavior) IEEE 802.1X Framework Details
NEW QUESTION # 78
What disadvantage does EAP-TLS have when compared with PEAPv0 EAP/MSCHAPv2 as an 802.11 WLAN security solution?
- A. Fast/secure roaming in an 802.11 RSN is significantly longer when EAP-TLS is in use.
- B. EAP-TLS does not protect the client's username and password inside an encrypted tunnel.
- C. EAP-TLS cannot establish a secure tunnel for internal EAP authentication.
- D. EAP-TLS requires extensive PKI use to create X.509 certificates for both the server and all clients, which increases administrative overhead.
- E. EAP-TLS is supported only by Cisco wireless infrastructure and client devices.
Answer: D
Explanation:
EAP-TLS is considered one of the most secure EAP types, but:
It requires a Public Key Infrastructure (PKI).
Every client device must have a unique certificate, adding to administrative burden and cost.
Incorrect:
A). Roaming speed is not inherently slower with EAP-TLS if supported by the infrastructure.
B). EAP-TLS protects client credentials; passwords aren't even used-it uses certificates.
C). EAP-TLS does establish a secure tunnel-it's the original TLS-based method.
D). EAP-TLS is vendor-agnostic and supported by most enterprise WLAN infrastructure.
References:
CWSP-208 Study Guide, Chapter 4 (EAP Comparison and TLS Overview)
CWNP EAP Method Deployment Guide
NEW QUESTION # 79
Joe's new laptop is experiencing difficulty connecting to ABC Company's 802.11 WLAN using 802.1X/EAP PEAPv0. The company's wireless network administrator assured Joe that his laptop was authorized in the WIPS management console for connectivity to ABC's network before it was given to him. The WIPS termination policy includes alarms for rogue stations, roque APs, DoS attacks and unauthorized roaming.
What is a likely reason that Joe cannot connect to the network?
- A. Joe configured his 802.11 radio card to transmit at 100 mW to increase his SNR. The WIPS is detecting this much output power as a DoS attack.
- B. Joe's integrated 802.11 radio is sending multiple Probe Request frames on each channel.
- C. An ASLEAP attack has been detected on APs to which Joe's laptop was trying to associate. The WIPS responded by disabling the APs.
- D. Joe disabled his laptop's integrated 802.11 radio and is using a personal PC card radio with a different chipset, drivers, and client utilities.
Answer: D
Explanation:
WIPS systems often enforce policies based on MAC addresses and associated hardware fingerprints. If Joe uses a different wireless adapter than the one authorized, it may trigger a rogue device or unauthorized client alarm-even if it's the same laptop. This behavior is common in environments with strict WIPS enforcement policies.
NEW QUESTION # 80
In the IEEE 802.11-2012 standard, what is the purpose of the 802.1X Uncontrolled Port?
- A. To pass general data traffic after the completion of 802.11 authentication and key management
- B. To allow only authentication frames to flow between the Supplicant and Authentication Server
- C. To block authentication traffic until the 4-Way Handshake completes
- D. To block unencrypted user traffic after a 4-Way Handshake completes
Answer: B
Explanation:
The 802.1X Uncontrolled Port exists before a client is fully authenticated. It:
Permits only EAP/EAPoL frames to pass between the Supplicant and the Authenticator (AP or switch).
Blocks general data traffic until authentication completes.
After authentication, the Controlled Port is opened, allowing normal data flow.
Incorrect:
B). Authentication must complete before the 4-Way Handshake, not the other way around.
C). General data traffic uses the Controlled Port, not the Uncontrolled Port.
D). The Uncontrolled Port doesn't specifically deal with encrypted or decrypted user traffic.
References:
CWSP-208 Study Guide, Chapter 4 (802.1X Port Behavior)
IEEE 802.1X Overview
NEW QUESTION # 81
Given: ABC Company has a WLAN controller using WPA2-Enterprise with PEAPv0/MS-CHAPv2 and AES- CCMP to secure their corporate wireless data. They wish to implement a guest WLAN for guest users to have Internet access, but want to implement some security controls. The security requirements for the hot-spot include:
* Cannot access corporate network resources
* Network permissions are limited to Internet access
* All stations must be authenticated
What security controls would you suggest? (Choose the single best answer.)
- A. Implement separate controllers for the corporate and guest WLANs.
- B. Use a WIPS to deauthenticate guest users when their station tries to associate with the corporate WLAN.
- C. Force all guest users to use a common VPN protocol to connect.
- D. Require guest users to authenticate via a captive portal HTTPS login page and place the guest WLAN and the corporate WLAN on different VLANs.
- E. Configure access control lists (ACLs) on the guest WLAN to control data types and destinations.
Answer: D
Explanation:
This solution meets all the requirements:
Captive portals allow simple authentication for guest users.
VLAN separation enforces network segmentation.
HTTPS ensures authentication is encrypted.
Incorrect:
A). Separate controllers are unnecessary and costly.
B). WIPS enforcement is reactive, not proactive for normal access control.
C). ACLs alone don't enforce authentication.
E). VPN requirements would be overly complex for guests.
References:
CWSP-208 Study Guide, Chapter 6 (Guest Network Architecture & Captive Portal Authentication)
NEW QUESTION # 82
......
Updated Apr-2026 Pass CWSP-208 Exam - Real Practice Test Questions: https://torrentpdf.validvce.com/CWSP-208-exam-collection.html
