CWNA-109 Exam Dumps - Certified Wireless Network Administrator

The authentication method that is referenced in the 802.11-2016 and 802.11-2020 specifications and is recommended for robust WLAN client security is 802.1X/EAP. 802.1X/EAP stands for IEEE 802.1X Port-Based Network Access Control with Extensible Authentication Protocol and is a framework that provides strong authentication and dynamic encryption key generation for WLAN clients. 802.1X/EAP involves three parties: the supplicant (the client), the authenticator (the AP or the controller), and the authentication server (usually a RADIUS server). The supplicant sends its credentials (such as username and password, certificate, or token) to the authenticator, which forwards them to the authentication server. The authentication server verifies the credentials and sends a response to the authenticator, which grants or denies access to the supplicant. The authentication server also generates a master key that is used to derive encryption keys for the data frames between the supplicant and the authenticator. 802.1X/EAP supports various EAP methods that offer different levels of security and flexibility, such as EAP-TLS, EAP-PEAP, EAP-TTLS, EAP-FAST, and EAP-SIM. SSL, IPSec, and WEP are not authentication methods, but rather encryption or security protocols that are not specific to WLANs or referenced in the 802.11 specifications. References: [CWNP Certified Wireless Network Administrator Official Study Guide: ExamCWNA-109], page 299; [CWNA: Certified Wireless Network Administrator Official Study Guide: ExamCWNA-109], page 289.

SAE (Simultaneous Authentication of Equals) is required when operating 802.11ax APs in the 6 GHz band using passphrase-based authentication. SAE is a secure and robust authentication method that is defined in the IEEE 802.11s amendment and is also known as WPA3-Personal or WPA3-SAE. SAE is based on a cryptographic technique called Dragonfly Key Exchange, which allows two parties to establish a shared secret key using a passphrase, without revealing the passphrase or the key to an eavesdropper or an attacker. SAE also provides forward secrecy, which means that if the passphrase or the key is compromised in the future, it does not affect the security of past communications.

SAE is required when operating 802.11ax APs in the 6 GHz band using passphrase-based authentication because of the new regulations and standards that apply to this band. The 6 GHz band is a new frequency band that was opened for unlicensed use by the FCC and other regulatory bodies in 2020. The 6 GHz band offers more spectrum and less interference than the existing 2.4 GHz and 5 GHz bands, which can enable higher performance and efficiency for Wi-Fi devices. However, the 6 GHz band also has some restrictions and requirements that are different from the other bands, such as:

• The 6 GHz band is divided into two sub-bands: U-NII-5 (5925-6425 MHz) and U-NII-7 (6525-6875 MHz). The U-NII-5 sub-band is subject to DFS (Dynamic Frequency Selection) rules, which require Wi-Fi devices to monitor and avoid using channels that are occupied by radar systems or other primary users. The U-NII-7 sub-band is not subject to DFS rules, but it has a lower maximum transmit power limit than the U-NII-5 sub-band.
• The Wi-Fi devices that operate in the 6 GHz band are called 6E devices, which stands for Extended Spectrum. 6E devices must support 802.11ax technology, which is also known as Wi-Fi 6 or High Efficiency (HE). 802.11ax is a new standard that improves the performance and efficiency of Wi-Fi networks by using features such as OFDMA (Orthogonal Frequency Division Multiple Access), MU-MIMO (Multi-User Multiple Input Multiple Output), BSS Coloring, TWT (Target Wake Time), and HE PHY and MAC enhancements.
• The 6E devices that operate in the 6 GHz band must also support WPA3 security, which is a new security protocol that replaces WPA2 and provides stronger encryption and authentication for Wi-Fi networks. WPA3 has two modes: WPA3-Personal and WPA3-Enterprise. WPA3-Personal uses SAE as its authentication method, which requires a passphrase to establish a secure connection between two devices. WPA3-Enterprise uses EAP (Extensible Authentication Protocol) as its authentication method, which requires a certificate or a credential to authenticate with a server.

Therefore, SAE is required when operating 802.11ax APs in the 6 GHz band using passphrase-based authentication because it is part of WPA3-Personal security, which is mandatory for 6E devices in this band. References: , Chapter 3, page 120; , Section 3.2

9of30

TVHT stands for Television Very High Throughput and it is a PHY defined by the 802.11af amendment. It uses the TV white space (TVWS) spectrum in the VHF and UHF bands between 54 and 790 MHz, which are not in use by broadcast video signals at the time. It can provide long-range and low-power connectivity for WLAN devices.

The two IEEE amendments that should be supported to provide the management frame protection and fast secure roaming security features are 802.11r and 802.11w12.

• 802.11r (Fast BSS Transition): This amendment to the IEEE 802.11 standard permits continuous connectivity aboard wireless devices in motion, with fast and secure client transitions from one Basic Service Set to another1.
• 802.11w (Management Frame Protection): This amendment increases the security of its management frames2.

An IBSS is used instead of a BSS is a network configuration that would result in multiple stations broadcasting Beacon frames with the same BSSID but with different source addresses. An IBSS (Independent Basic Service Set) is a type of WLAN that does not use an AP but rather allows stations to communicate directly with each other in a peer-to-peer manner. An IBSS is also known as an ad-hoc network or a peer-to-peer network. In an IBSS, each station generates its own Beacon frames to announce its presence and capabilities to other stations within range. The Beacon frames have the same BSSID, which is randomly generated by one of the stations when creating the IBSS, but they have different source addresses, which are the MAC addresses of each station’s radio interface. The BSSID is used to identify the IBSS and prevent stations from joining other IBSSs with different BSSIDs. References: , Chapter 1, page 25; , Section 1.1

In the 802.11 wireless networking protocols, when a client station sends a broadcast probe request frame with a wildcard SSID (Service Set Identifier), it is essentially asking for any nearby access points (APs) to identify themselves. The way APs respond to such a probe request is governed by standard 802.11 behavior, which includes:

• Probe Request Handling: Upon receiving a broadcast probe request, each AP that can serve the client prepares a probe response. The response includes information about the AP, such as its SSID, supported data rates, and other capabilities.
• Contention-Based Mechanism: Wireless networks use a contention-based mechanism (CSMA/CA - Carrier Sense Multiple Access with Collision Avoidance) for medium access. Each AP must wait for a clear channel and win the contention process before it can send its probe response.
• Independent Responses: Each AP operates independently in responding to the probe request. There is no coordination between APs to decide which one responds first or at all, leading to multiple APs sending probe responses, each after winning the contention for the medium.

Option A accurately reflects this process, indicating that each AP prepares and sends a probe response in turn, contingent upon winning the medium contention. The other options suggest mechanisms (such as coordination with a DHCP server or simultaneous responses after a Short Interframe Space (SIFS)) that do not align with standard 802.11 procedures for handling broadcast probe requests.

References:

• IEEE 802.11 Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications.
• CWNA Certified Wireless Network Administrator Official Study Guide: Exam PW0-105, by David D. Coleman and David A. Westcott.

The client drivers are faulty and should be upgraded is the likely problem for the laptop that can see and connect to 2.4 GHz APs, but does not even see 5 GHz APs. The client drivers are the software components that enable the wireless adapter of the laptop to communicate with the operating system and the network. The client drivers are responsible for scanning the available wireless channels, detecting and connecting to the access points, negotiating the security and data rate parameters, and transmitting and receiving data frames. If the client drivers are faulty, outdated, or incompatible, they may cause various issues with the wireless performance and functionality, such as low data rates, poor signal strength, frequent disconnections, or inability to see or connect to certain access points or channels.

One of the possible causes of faulty client drivers is that they do not support or recognize some of the features or standards of the 802.11ac technology, such as wider channel bandwidths, higher modulation schemes, or DFS (Dynamic Frequency Selection) channels. This could explain why the laptop can see and connect to 2.4 GHz APs, but not 5 GHz APs, as 802.11ac operates only in the 5 GHz band and uses channels that are wider (up to 160 MHz) and higher (up to channel 165) than those used by previous standards. Moreover, some of the 5 GHz channels are subject to DFS rules, which require the access points and client stations to monitor and avoid using channels that are occupied by radar systems or other primary users. If the client drivers do not support or comply with DFS rules, they may not be able to see or connect to access points that use DFS channels.

To solve this problem, the client drivers should be upgraded to the latest version that supports and is compatible with 802.11ac features and standards. This can be done by downloading and installing the updated driver software from the manufacturer’s website or using a device manager tool. Upgrading the client drivers may also improve other aspects of wireless performance and functionality, such as data rates, signal strength, security, and stability. References: 1, Chapter 12, page 493; 2, Section 8.1

 iPerf is an open source tool that is designed to perform a throughput test on the WLAN. iPerf is a cross-platform command-line tool that can measure the bandwidth and quality of network links by generating TCP or UDP traffic between two endpoints.iPerf can run as either a server or a client mode, depending on whether it receives or sends traffic. iPerf can also report various metrics of network performance, such as throughput, jitter, packet loss, delay, and TCP window size. To perform a throughput test on the WLAN using iPerf, one device needs to run iPerf in server mode and another device needs to run iPerf in client mode. The devices need to be connected to the same WLAN network and have their IP addresses configured properly. The device running iPerf in client mode needs to specify the IP address of the device running iPerf in server mode as well as other parameters such as protocol, port number, duration, interval, bandwidth limit, packet size, etc. The device running iPerf in server mode will listen for incoming connections from the client device and send back acknowledgments or responses depending on the protocol used. The device running iPerf in client mode will send traffic to the server device according to the specified parameters and measure the network performance. The device running iPerf in client mode will display the results of the throughput test at the end of the test or at regular intervals during the test. The results can show the average, minimum, maximum, and instantaneous throughput of the network link, as well as other metrics such as jitter, packet loss, delay, and TCP window size. References: 1, Chapter 7, page 287; 2, Section 4.3