Free CWAP-404: Certified Wireless Analysis Professional Exam Questions and Answers

While capturing on channel 11, you see a data frame flagged by the analyzer as having a bad FCS. The Transmitter Address in the decode has an OUI that does not match any AP or client in your inventory, and no other frame from that address appears in the capture. What is the most reasonable conclusion?

• AA. A rogue AP is transmitting on the channel and should be located immediately
• BB. The analyzer's OUI database is outdated and must be updated
• CC. A spoofed client is attempting to impersonate a device in the BSS
• DD. The address was probably corrupted, so the frame cannot be attributed to a device

Users in three buildings report that video calls over Wi-Fi drop several times a week, always at different times and places. No analyst is on site, and the problem cannot be predicted. Which approach is best suited to gathering evidence?

• AA. A spectrum analyzer placed in the building where the first complaint was received
• BB. Wireless sensors running scheduled client tests and reporting results to a central server
• CC. A handheld WLAN scanner used to record SSIDs and signal levels during a building walkthrough
• DD. A laptop protocol analyzer left capturing on a single channel in one of the buildings overnight

Which pair of maximum A-MSDU lengths may an HT STA advertise in its HT Capabilities element?

• AA. 1,500 and 2,304 octets
• BB. 2,304 and 4,095 octets
• CC. 3,839 and 7,935 octets
• DD. 7,935 and 11,454 octets

A VoIP server marks its packets with DSCP 46 (EF), and the traffic arrives untagged at the AP on the wired side. In your capture, downlink QoS Data frames carrying this voice stream to a Wi-Fi phone have a QoS Control TID of 5, and call quality is poor. You expected the frames to use AC_VO. What is the most likely cause?

• AA. The AP maps DSCP to user priority using the upper three bits of the DSCP value
• BB. The EDCA parameters for AC_VO have been swapped with those of AC_VI
• CC. The phone's WMM-Power Save setting causes the AP to demote voice frames to video
• DD. The wired switch overrides the DSCP value with an 802.1Q CoS 5 tag

A captured QoS Data frame has To DS = 0 and From DS = 1. The decode shows Address 1 = 3C:22:FB:10:A4:07, Address 2 = 00:1A:1E:5C:20:B1 and Address 3 = 00:50:56:8F:12:C4. The BSSID of the AP is 00:1A:1E:5C:20:B1. Which address belongs to the device that originally generated the payload?

• AA. 3C:22:FB:10:A4:07 in Address 1
• BB. 00:50:56:8F:12:C4 in Address 3
• CC. The source cannot be determined because Address 4 is not present
• DD. 00:1A:1E:5C:20:B1 in Address 2

A spectrum analyzer in a break room shows energy in the 2.4 GHz band between about 2.45 GHz and 2.48 GHz. The waterfall displays bursts of roughly 8 ms followed by about 8 ms of silence, repeating at 60 Hz. The duty cycle reads about 50%, and the energy sweeps across the range during each burst. Which device is the most likely source?

• AA. A residential microwave oven
• BB. A DSSS cordless phone
• CC. A frequency-hopping Bluetooth headset
• DD. An analog video camera

Which 802.11 PHY operates exclusively in the 5 GHz band?

• AA. VHT
• BB. HE
• CC. ERP
• DD. HT

Which two statements about 802.11 frame aggregation are true? (Choose two.)

Select 2 answers.

• AA. An A-MSDU subframe can be retransmitted individually after a Block Ack reports it lost
• BB. An A-MPDU is protected by a single FCS that covers all of its subframes
• CC. An A-MSDU carries multiple MSDUs behind a single MAC header and a single FCS
• DD. An A-MPDU carries multiple MPDUs, and each MPDU has its own MAC header and FCS

You are decoding a Data frame in which To DS = 0 and From DS = 1. The address fields are: Address 1: 3C:22:FB:10:A1:07 Address 2: 70:5A:0F:44:19:C0 (BSSID of the AP) Address 3: B8:27:EB:90:55:12 (file server on the wired LAN) Which statement describes this frame?

• AA. The AP sent it to the server, which is a station on the wireless medium
• BB. The AP sent it to the client, and the server originated the data
• CC. The client at 3C:22:FB:10:A1:07 sent it to the AP, destined for the server
• DD. The frame was sent between two APs over a wireless distribution system

A warehouse client roams between APs operating on channel 36 and channel 149. You must capture the entire roam, including the Reassociation Request and the following 4-Way Handshake, to find out why it takes several seconds. Which capture method is MOST appropriate?

• AA. One adapter locked on channel 149 with a capture filter for the client MAC address
• BB. One adapter scanning channels 36 and 149 with a 250 ms dwell time
• CC. One adapter locked on channel 36 placed midway between the APs
• DD. Two adapters, one locked on each channel, with their captures merged by timestamp