Free CWAP-403: Certified Wireless Analysis Professional Exam Questions and Answers

Which description best fits a sticky client?

• AA. A client that sends Reassociation Request frames to its current AP after every DTIM beacon
• BB. A client that remains on its current AP as the signal weakens, although a stronger AP is in range
• CC. A client that roams back and forth between two APs several times a minute while stationary
• DD. A client that keeps using a cached PMK after the AP has deleted it from its PMK cache

In a capture of QoS Data frames, which subfield of the QoS Control field carries the user priority that determines the access category of the frame?

• AA. EOSP
• BB. Ack Policy
• CC. TID
• DD. A-MSDU Present

An analyst has opened a saved trace file that contains frames from three BSSs on channel 36. The analyst needs to see only the frames exchanged with one client, without altering the saved file. What should the analyst do?

• AA. Apply a colorization rule that matches the client MAC address as source or destination
• BB. Apply a capture filter that matches the client MAC address as source or destination
• CC. Apply a packet slicing setting that retains only the first 64 bytes of each frame
• DD. Apply a display filter that matches the client MAC address as source or destination

In an HT mixed format PPDU, which preamble field carries the MCS index that the receiver uses to demodulate the data portion?

• AA. HT-STF
• BB. HT-SIG
• CC. HT-LTF
• DD. L-SIG

An analyst captures traffic from a WPA2-Personal WLAN and enters the correct passphrase and SSID in the analyzer's decryption settings. The beacons decode normally, but the data frames from one laptop still show as encrypted payload. The trace contains no EAPOL-Key frames for that laptop. What is the most likely reason the data frames are not decrypted?

• AA. The data frames were sent as an A-MPDU, which prevents the analyzer from applying the keys
• BB. CCMP encryption cannot be decoded by an analyzer even when the passphrase and SSID are entered
• CC. The capture does not include the laptop's 4-Way Handshake, so the analyzer cannot derive its PTK
• DD. The analyzer must be configured with the GTK instead of the passphrase to decode unicast data frames

An engineer must analyze the Reassociation exchange of a client roaming from AP1 on channel 36 to AP2 on channel 149. A first capture taken with one adapter fixed on channel 36 shows the client's last frames to AP1 but nothing afterward. What should the engineer do to capture the entire roam?

• AA. Use one adapter in scanning mode with a 500 ms dwell time on each of the two channels
• BB. Use two adapters, one fixed on each channel, and aggregate their captures into a single timeline
• CC. Use one adapter fixed on channel 149 and apply a capture filter on the client MAC address
• DD. Use one adapter fixed on channel 36 with the channel width set to 80 MHz to cover both APs

Users of handheld scanners report intermittent disconnects. A capture shows the AP sending Disassociation frames with reason code 4 (disassociated due to inactivity) to scanners that were idle for a few minutes. The analyst forms the hypothesis that the AP idle timeout on that SSID is shorter than the idle periods of the scanners. What should the analyst do next?

• AA. Raise the transmit power of the AP radios, then repeat the capture and compare the signal strength of the scanners
• BB. Increase the idle timeout on that SSID only, then repeat the capture and observe whether the Disassociation frames stop
• CC. Increase the idle timeout on every SSID of every AP at once, then document the change after users confirm it works
• DD. Update the wireless adapter drivers in all of the scanners, then ask users whether the disconnects continue

Which term describes the level of ambient RF energy measured on a channel when no intentional transmissions are present?

• AA. Duty cycle
• BB. Received signal strength indicator
• CC. Noise floor
• DD. Signal-to-noise ratio

A WLAN engineer is investigating an interferer that transmits short bursts every few seconds on the 2.4 GHz band. The real-time FFT view usually shows nothing at the moment the engineer looks at it. Which view accumulates several minutes of sweeps into a single plot, with color indicating how often each frequency and amplitude combination was measured?

• AA. Real-time FFT view
• BB. Channel utilization chart
• CC. Waterfall view
• DD. Density view

Which capture configuration setting reduces the storage used per frame by saving only the first part of each frame, such as the headers, and discarding the rest of the payload?

• AA. Capture filtering
• BB. Event triggering
• CC. Packet slicing
• DD. Dwell time