Free CWSP-206: CWSP Certified Wireless Security Professional Exam Questions and Answers

Last updated: September 19, 2026

Exam code

CWSP-206

Provider

CWNP

Questions in our bank

1000+

Free to read

First 10, with answers

Our test mode duration & pass mark

130 mins · 70%

Verified answers

Reviewed weekly

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   You have a Windows laptop computer with an integrated, dual-band, Wi-Fi compliant adapter. Your laptop computer has protocol analyzer software installed that is capable of capturing and decoding 802.11ac data. What statement best describes the likely ability to capture 802.11ac frames for security testing purposes?

   • A. Integrated 802.11ac adapters are not typically compatible with protocol analyzers in Windows laptop
   • B. It is often best to use a USB adapter or carefully select a laptop with an integrated adapter that will work.
   • C. Laptops cannot be used to capture 802.11ac frames because they do not support MU-MIMO.
   • D. Only Wireshark can be used to capture 802.11ac frames as no other protocol analyzer has implemented the proper frame decodes.
   • E. All integrated 802.11ac adapters will work with most protocol analyzers for frame capture, including the Radio Tap Header.
   • F. The only method available to capture 802.11ac frames is to perform a remote capture with a compatible access point.
   Reveal Answer

2. Question #2

   What WLAN client device behavior is exploited by an attacker during a hijacking attack?

   • A. After the initial association and 4-way handshake, client stations and access points do not need to perform another 4-way handshake, even if connectivity is lost.
   • B. Client drivers scan for and connect to access point in the 2.4 GHz band before scanning the 5 GHz band.
   • C. When the RF signal between a client and an access point is disrupted for more than a few seconds, the client device will attempt to associate to an access point with better signal quality.
   • D. When the RF signal between a client and an access point is lost, the client will not seek to reassociate with another access point until the 120 second hold down timer has expired.
   • E. As specified by the Wi-Fi Alliance, clients using Open System authentication must allow direct client-to-client connections, even in an infrastructure BSS.
   Reveal Answer

3. Question #3

   During 802.1X/LEAP authentication, the username is passed across the wireless medium in clear text. From a security perspective, why is this significant?

   • A. The username can be looked up in a dictionary file that lists common username/password combinations.
   • B. The username is needed for Personal Access Credential (PAC) and X.509 certificate validation.
   • C. 4-Way Handshake nonces are based on the username in WPA and WPA2 authentication.
   • D. The username is an input to the LEAP challenge/response hash that is exploited, so the username must be known to conduct authentication cracking.
   Reveal Answer

4. Question #4

   ABC Hospital wishes to create a strong security policy as a first step in securing their 802.11 WLAN. Before creating the WLAN security policy, what should you ensure you possess?

   • A. Management support for the process.
   • B. Security policy generation software.
   • C. End-user training manuals for the policies to be created.
   • D. Awareness of the exact vendor devices being installed.
   Reveal Answer

5. Question #5

   You must implement 7 APs for a branch office location in your organizations. All APs will be autonomous and provide the same two SSIDs (CORP1879 and Guest). Because each AP is managed directly through a web-based interface, what must be changed on every AP before enabling the WLANs to ensure proper staging procedures are followed?

   • A. Output power
   • B. Fragmentation threshold
   • C. Administrative password
   • D. Cell radius
   Reveal Answer

6. Question #6

   You are installing 6 APs on the outside of your facility. They will be mounted at a height of 6 feet. What must you do to implement these APs in a secure manner beyond the normal indoor AP implementations? (Choose the single best answer.)

   • A. Ensure proper physical and environmental security using outdoor ruggedized APs or enclosures.
   • B. Use internal antennas.
   • C. Use external antennas.
   • D. Power the APs using PoE.
   Reveal Answer

7. Question #7

   A WLAN consultant has just finished installing a WLAN controller with 15 controller-based APs. Two SSIDs with separate VLANs are configured for this network, and both VLANs are configured to use the same RADIUS server. The SSIDs are configured as follows: * 1. SSID Blue – VLAN 10 – Lightweight EAP (LEAP) authentication – CCMP cipher suite * 2. SSID Red – VLAN 20 – PEAPv0/EAP-TLS authentication – TKIP cipher suite The consultant’s computer can successfully authenticate and browse the Internet when using the Blue SSID. The same computer cannot authenticate when using the Red SSID. What is a possible cause of the problem?

   • A. The consultant does not have a valid Kerberos ID on the Blue VLAN.
   • B. The client does not have a proper certificate installed for the tunneled authentication within the established TLS tunnel.
   • C. The TKIP cipher suite is not a valid option for PEAPv0 authentication.
   • D. The Red VLAN does not use server certificate, but the client requires one.
   Reveal Answer

8. Question #8

   In an IEEE 802.11-compliant WLAN, when is the 802.1X Controlled Port placed into the unblocked state?

   • A. After EAP authentication is successful
   • B. After Open System authentication
   • C. After the 4-Way Handshake
   • D. After any Group Handshake
   Reveal Answer

9. Question #9

   When using a tunneled EAP type, such as PEAP, what component is protected inside the TLS tunnel so that it is not sent in clear text across the wireless medium?

   • A. Server credentials
   • B. User credentials
   • C. RADIUS shared secret
   • D. X.509 certificates
   Reveal Answer

10. Question #10

    What protocol, listed here, allows a network manager to securely administer the network?

    • A. TFTP
    • B. Telnet
    • C. HTTPS
    • D. SNMPv2
    Reveal Answer