Get 100% Success with Latest CWNP CWSP CWSP-208 Exam Dumps Dec 31, 2025
The Best CWSP-208 Exam Study Material and Preparation Test Question Dumps
CWNP CWSP-208 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 35
You are using a utility that takes input and generates random output. For example, you can provide the input of a known word as a secret word and then also provide another known word as salt input. When you process the input it generates a secret code which is a combination of letters and numbers with case sensitivity. For what is the described utility used? (Choose 3)
- A. Generating passwords for WLAN infrastructure equipment logins
- B. Generating passphrases for WLAN systems secured with WPA2-Personal
- C. Generating PMKs that can be imported into 802.11 RSN-compatible devices
- D. Generating dynamic session keys used for IPSec VPNs
- E. Generating secret keys for RADIUS servers and WLAN infrastructure devices
Answer: B,C,E
Explanation:
A utility that combines a secret and salt to generate a random string is effectively a key derivation tool. It can be used to:
Generate PMKs (Pairwise Master Keys) to preload ready-made keys into RSN devices Generate shared secrets (e.g., RADIUS shared secrets, WLAN controller keys) Create strong passphrases for WPA2-Personal networks Using it for IPSec session keys is less common (those are usually dynamically negotiated), and creating management passwords is possible but not the main us
NEW QUESTION # 36
You must locate non-compliant 802.11 devices. Which one of the following tools will you use and why?
- A. A spectrum analyzer, because it can show the energy footprint of a device using WPA differently from a device using WPA2.
- B. A spectrum analyzer, because it can decode the PHY preamble of a non-compliant device.
- C. A protocol analyzer, because it can be used to view the spectrum energy of non-compliant 802.11 devices, which is always different from compliant devices.
- D. A protocol analyzer, because it can be used to report on security settings and regulatory or rule compliance
Answer: D
Explanation:
In a security context, outdated firmware is one of the most critical vulnerabilities. Firmware updates typically patch known security issues, fix bugs, and provide new features or improved encryption support. If the APs have not been updated or checked in over 18 months, they could be running firmware with known exploits or lacking critical security patches, making firmware review a top priority.
References:
CWSP-208 Study Guide, Chapter 8 - WLAN Security Lifecycle and Maintenance CWNP CWSP-208 Objectives: "Firmware and Security Patch Management"
NEW QUESTION # 37
ABC Company uses the wireless network for highly sensitive network traffic. For that reason, they intend to protect their network in all possible ways. They are continually researching new network threats and new preventative measures. They are interested in the security benefits of 802.11w, but would like to know its limitations.
What types of wireless attacks are protected by 802.11w? (Choose 2)
- A. Layer 2 Disassociation attacks
- B. Robust management frame replay attacks
- C. Social engineering attacks
- D. RF DoS attacks
Answer: A,B
Explanation:
802.11w, also known as Protected Management Frames (PMF), is designed to protect specific types of 802.11 management frames such as disassociation and deauthentication frames. These frames were previously sent unencrypted and could be spoofed by attackers to disconnect clients (DoS attacks). With 802.11w, these frames are cryptographically protected, mitigating such attacks.
PMF also includes replay protection for these management frames, preventing attackers from capturing and replaying them to disrupt network connectivity.
References:
CWSP-208 Study Guide, Chapter 6 (Wireless LAN Security Solutions)
IEEE 802.11w-2009 amendment
CWNP Whitepapers on PMF and Management Frame Protection
NEW QUESTION # 38
What EAP type supports using MS-CHAPv2, EAP-GTC or EAP-TLS for wireless client authentication?
- A. LEAP
- B. EAP-TTLS
- C. PEAP
- D. EAP-GTC
- E. H-REAP
Answer: B
Explanation:
EAP-TTLS (Tunneled Transport Layer Security) supports flexible inner authentication methods including:
MS-CHAPv2
EAP-GTC (Generic Token Card)
EAP-TLS (in some configurations)
This versatility allows EAP-TTLS to be used with a wide range of back-end authentication systems, while only requiring a server-side certificate.
Incorrect:
A). H-REAP (now FlexConnect) is a Cisco AP deployment mode, not an EAP type.
B). EAP-GTC is a simple authentication method and not a tunnel or container for others.
D). PEAP typically supports MS-CHAPv2 but not EAP-GTC or EAP-TLS as inner methods.
E). LEAP uses MS-CHAPv1 and is considered deprecated and insecure.
References:
CWSP-208 Study Guide, Chapter 4 (EAP Methods)
NEW QUESTION # 39
Given: XYZ Company has recently installed an 802.11ac WLAN. The company needs the ability to control access to network services, such as file shares, intranet web servers, and Internet access based on an employee's job responsibilities.
What WLAN security solution meets this requirement?
- A. A WLAN router with wireless VLAN support
- B. A WLAN controller with RBAC features
- C. An autonomous AP system with MAC filters
- D. WPA2-Personal with support for LDAP queries
- E. A VPN server with multiple DHCP scopes
Answer: B
Explanation:
Role-Based Access Control (RBAC) enables dynamic assignment of permissions and access rights based on a user's job function. A WLAN controller with RBAC:
Can apply policies post-authentication.
Controls access to internal services (e.g., file shares, apps).
Assigns users to different VLANs or applies firewall rules based on roles.
Incorrect:
A). MAC filtering is not scalable or secure.
B). WPA2-Personal does not support user-based policies or LDAP integration.
C). DHCP scope assignment is not linked to user roles.
E). VLAN assignment via SSID is static and does not consider job function.
References:
CWSP-208 Study Guide, Chapter 6 (Access Control and Role-Based Policies) CWNP Enterprise WLAN Design Practices
NEW QUESTION # 40
What preventative measures are performed by a WIPS against intrusions?
- A. EAPoL Reject frame flood against a rogue AP
- B. Evil twin attack against a rogue AP
- C. Uses SNMP to disable the switch port to which rogue APs connect
- D. ASLEAP attack against a rogue AP
- E. Deauthentication attack against a classified neighbor AP
Answer: C
Explanation:
Wireless Intrusion Prevention Systems (WIPS) can proactively respond to detected threats using various techniques. One such preventative measure is integration with the wired infrastructure to mitigate rogue APs by disabling the switch port they are connected to. This is typically done through SNMP or other switch management interfaces.
This form of wired-side containment is more secure and compliant than wireless-side attacks (e.g., deauthentication), which can violate regulations in some jurisdictions.
References:
CWSP-208 Study Guide, Chapter 7 - WIPS Architecture and Countermeasures CWNP CWSP-208 Exam Objectives: "WIPS Prevention and Containment Techniques"
NEW QUESTION # 41
Joe's new laptop is experiencing difficulty connecting to ABC Company's 802.11 WLAN using 802.1X/EAP PEAPv0. The company's wireless network administrator assured Joe that his laptop was authorized in the WIPS management console for connectivity to ABC's network before it was given to him. The WIPS termination policy includes alarms for rogue stations, roque APs, DoS attacks and unauthorized roaming.
What is a likely reason that Joe cannot connect to the network?
- A. Joe configured his 802.11 radio card to transmit at 100 mW to increase his SNR. The WIPS is detecting this much output power as a DoS attack.
- B. Joe disabled his laptop's integrated 802.11 radio and is using a personal PC card radio with a different chipset, drivers, and client utilities.
- C. An ASLEAP attack has been detected on APs to which Joe's laptop was trying to associate. The WIPS responded by disabling the APs.
- D. Joe's integrated 802.11 radio is sending multiple Probe Request frames on each channel.
Answer: B
Explanation:
WIPS systems often enforce policies based on MAC addresses and associated hardware fingerprints. If Joe uses a different wireless adapter than the one authorized, it may trigger a rogue device or unauthorized client alarm-even if it's the same laptop. This behavior is common in environments with strict WIPS enforcement policies.
NEW QUESTION # 42
Given: You view a protocol analyzer capture decode with the following protocol frames listed in the following order (excluding the ACK frames):
1) 802.11 Probe Request and 802.11 Probe Response
2) 802.11 Auth and another 802.11 Auth
2) 802.11 Assoc Req and 802.11 Assoc Rsp
4) EAPOL-Start
5) EAP Request and EAP Response
6) EAP Request and EAP Response
7) EAP Request and EAP Response
8) EAP Request and EAP Response
9) EAP Request and EAP Response
10) EAP Success
19) EAPOL-Key (4 frames in a row)
What are you seeing in the capture file? (Choose 4)
- A. 802.1X with Dynamic WEP
- B. WPA2-Personal authentication
- C. Active Scanning
- D. 802.11 Open System authentication
- E. Wi-Fi Protected Setup with PIN
- F. WPA2-Enterprise authentication
- G. 4-Way Handshake
Answer: C,D,F,G
Explanation:
A). WPA2-Enterprise authentication: The multiple EAP Request/Response exchanges followed by an EAP Success and a 4-Way Handshake (EAPOL-Key frames) indicate 802.1X authentication, characteristic of WPA2-Enterprise.
C). 802.11 Open System authentication: Two Auth frames (request and response) without encryption negotiation signify Open System Authentication - a default in RSN setups.
F). Active Scanning: Begins with Probe Request and Probe Response - part of an active scan process.
G). 4-Way Handshake: Identified by four sequential EAPOL-Key frames, completing the authentication process in WPA2.
References:
CWSP-208 Study Guide, Chapter 6 - Frame Analysis of Enterprise Authentication CWNP CWSP-208 Objectives: "EAP Authentication Flow" and "4-Way Handshake Analysis"
NEW QUESTION # 43
When TKIP is selected as the pairwise cipher suite, what frame types may be protected with data confidentiality? (Choose 2)
- A. Robust unicast management
- B. QoS Data
- C. Control
- D. Robust broadcast management
- E. ACK
- F. Data
Answer: B,F
Explanation:
TKIP (Temporal Key Integrity Protocol) is a pairwise encryption method introduced with WPA to enhance WEP security. TKIP can protect:
D). Data frames: These are the core unicast data transmissions between clients and access points.
F). QoS Data frames: These are a subtype of data frames supporting 802.11e/WMM enhancements and are also protected under TKIP.
Incorrect:
A & B. TKIP does not support robust management frame protection. Management frame protection is handled by 802.11w with AES-CCMP and BIP.
C & E. Control frames and ACKs are never encrypted, as they need to be read by all stations regardless of encryption status.
References:
CWSP-208 Study Guide, Chapter 3 (Frame Types and Encryption)
IEEE 802.11i Standard
NEW QUESTION # 44
What TKIP feature was introduced to counter the weak integrity check algorithm used in WEP?
- A. RC5 stream cipher
- B. 32-bit ICV (CRC-32)
- C. Michael
- D. Sequence counters
- E. Block cipher support
Answer: C
Explanation:
TKIP (used with WPA) introduced "Michael" as a message integrity check (MIC) algorithm to replace the insecure CRC-32 used in WEP. Michael:
Adds tamper protection to each packet.
Helps detect packet forgery.
Incorrect:
A). CRC-32 was used in WEP and proven weak.
B). Sequence counters help prevent replay attacks, not integrity checking.
C). RC5 is not used in WLAN security.
E). TKIP does not support block ciphers-it uses RC4, a stream cipher.
References:
CWSP-208 Study Guide, Chapter 3 (TKIP Security Features)
NEW QUESTION # 45
Given: Your company has just completed installation of an IEEE 802.11 WLAN controller with 20 controller- based APs. The CSO has specified PEAPv0/EAP-MSCHAPv2 as the only authorized WLAN authentication mechanism. Since an LDAP-compliant user database was already in use, a RADIUS server was installed and is querying authentication requests to the LDAP server.
Where must the X.509 server certificate and private key be installed in this network?
- A. Controller-based APs
- B. WLAN controller
- C. RADIUS server
- D. Supplicant devices
- E. LDAP server
Answer: C
Explanation:
With PEAPv0/EAP-MSCHAPv2:
The TLS tunnel is created between the supplicant and the RADIUS server.
Therefore, the RADIUS server must have the X.509 server certificate and private key to authenticate itself and establish the tunnel.
Incorrect:
A). Supplicants verify the server's certificate, not hold it.
B). LDAP server is used for querying, not for EAP termination.
C). APs and
D). Controllers pass the authentication info but don't require certificates for PEAP termination.
References:
CWSP-208 Study Guide, Chapter 4 (EAP Types and TLS Tunnel Establishment) CWNP EAP Deployment Guidelines
NEW QUESTION # 46
What 802.11 WLAN security problem is directly addressed by mutual authentication?
- A. MAC spoofing
- B. Wireless hijacking attacks
- C. Offline dictionary attacks
- D. Weak password policies
- E. Disassociation attacks
- F. Weak Initialization Vectors
Answer: B
Explanation:
Mutual authentication involves both the client and the authentication server verifying each other's identity before network access is granted. This prevents attackers from spoofing an access point (AP) and luring clients to connect to rogue APs (often used in wireless hijacking or evil twin attacks). When mutual authentication (typically via 802.1X with EAP-TLS) is used, clients will not connect unless they can verify the server certificate, which thwarts hijacking attempts.
References:
CWSP-208 Study Guide, Chapter 4 (Authentication and Access Control)
CWNP E-Learning: 802.1X and EAP Authentication Framework
IEEE 802.1X and WPA2-Enterprise concepts
NEW QUESTION # 47
What statement accurately describes the functionality of the IEEE 802.1X standard?
- A. Port-based access control with support for authenticated-user VLANs only
- B. Port-based access control with EAP encapsulation over the LAN (EAPoL)
- C. Port-based access control with mandatory support of AES-CCMP encryption
- D. Port-based access control with dynamic encryption key management and distribution
- E. Port-based access control, which allows three frame types to traverse the uncontrolled port: EAP, DHCP, and DNS.
Answer: B
Explanation:
IEEE 802.1X is a port-based Network Access Control (PNAC) protocol that:
Provides authentication at the edge of the LAN (such as a wireless access point or switch port).
Encapsulates EAP messages over the LAN using the EAPoL (EAP over LAN) protocol.
This standard defines how devices are granted or denied access based on authentication status.
Incorrect:
B). Key management is part of 802.11i (not 802.1X directly).
C). VLAN assignment may occur, but it's not limited to authenticated-user VLANs.
D). AES-CCMP is a function of WPA2/802.11i, not 802.1X.
E). Only EAP is allowed over the uncontrolled port; DHCP/DNS pass only after authentication.
References:
CWSP-208 Study Guide, Chapter 4 (802.1X Framework)
IEEE 802.1X-2010 Standard
NEW QUESTION # 48
In what deployment scenarios would it be desirable to enable peer-to-peer traffic blocking?
- A. In corporate Voice over Wi-Fi networks with push-to-talk multicast capabilities
- B. In university environments using multicast video training sourced from professor's laptops
- C. In home networks in which file and printer sharing is enabled
- D. At public hot-spots in which many clients use diverse applications
Answer: D
Explanation:
Peer-to-peer blocking (also called client isolation) is useful in open or public WLANs to prevent devices from communicating directly with each other.
B). In public hot-spots, isolating users helps protect against malware spread, snooping, and attacks from nearby devices.
Incorrect:
A). In home networks, peer-to-peer communication is often desired for file sharing.
C). Voice over Wi-Fi may rely on peer communication (e.g., multicast).
D). In university setups using multicast, peer-to-peer restrictions could hinder functionality.
References:
CWSP-208 Study Guide, Chapter 3 (Access Control and WLAN Policies)
CWNP WLAN Best Practices for Public Networks
NEW QUESTION # 49
Wireless Intrusion Prevention Systems (WIPS) provide what network security services? (Choose 2)
- A. Policy enforcement and compliance management
- B. Analysis and reporting of AP CPU utilization
- C. Wireless vulnerability assessment
- D. Configuration distribution for autonomous APs
- E. Application-layer traffic inspection
Answer: A,C
Explanation:
WIPS systems provide proactive security by continuously scanning for threats and ensuring WLAN policy compliance. Their capabilities include:
B). Wireless vulnerability assessment: Scanning for misconfigured APs, weak encryption, and unauthorized devices.
E). Policy enforcement and compliance: Ensuring security settings adhere to enterprise or regulatory requirements and alerting on deviations.
Other options like application-layer inspection and AP CPU monitoring are outside the WIPS function scope.
References:
CWSP-208 Study Guide, Chapter 7 - WIPS Services and Capabilities
CWNP CWSP-208 Objectives: "WIPS Threat Mitigation and Enforcement"
NEW QUESTION # 50
Given: XYZ Hospital plans to improve the security and performance of their Voice over Wi-Fi implementation and will be upgrading to 802.11n phones with 802.1X/EAP authentication. XYZ would like to support fast secure roaming for the phones and will require the ability to troubleshoot reassociations that are delayed or dropped during inter-channel roaming.
What portable solution would be recommended for XYZ to troubleshoot roaming problems?
- A. Laptop-based protocol analyzer with multiple 802.11n adapters
- B. WIPS sensor software installed on a laptop computer
- C. An autonomous AP mounted on a mobile cart and configured to operate in monitor mode
- D. Spectrum analyzer software installed on a laptop computer
Answer: A
Explanation:
For troubleshooting fast roaming (e.g. 802.11r) across channels, a portable protocol analyzer with dual- or multi-band 802.11n adapters enables:
Simultaneous packet capture on different channels
Capturing handoff-related frames and timing analysis in roaming scenarios This setup allows detailed capture of reassociation, authentication, and 4-Way Handshake processes, essential for diagnosing roaming delays.
Other options (WIPS, spectrum analyzer, autonomous AP) do not support detailed 802.11 frame capture across multiple channels during roaming events.
References:
CWSP#207 Study Guide, Chapter 6 (Roaming Troubleshooting)
NEW QUESTION # 51
Given: You are installing 6 APs on the outside of your facility. They will be mounted at a height of 6 feet.
What must you do to implement these APs in a secure manner beyond the normal indoor AP implementations? (Choose the single best answer.)
- A. Ensure proper physical and environmental security using outdoor ruggedized APs or enclosures.
- B. Use internal antennas.
- C. User external antennas.
- D. Power the APs using PoE.
Answer: A
Explanation:
Outdoor APs must be:
Protected from theft or tampering (physical security).
Shielded from weather/environmental conditions (IP-rated enclosures).
Mounted and secured to prevent unauthorized physical access or damage.
Incorrect:
A & B. Antenna type is relevant to RF coverage but does not address outdoor-specific security needs.
C). PoE is useful for power delivery but not a security solution.
References:
CWSP-208 Study Guide, Chapter 7 (Physical Security for Wireless Devices) CWNP Outdoor WLAN Deployment Guidelines
NEW QUESTION # 52
What is a primary criteria for a network to qualify as a Robust Security Network (RSN)?
- A. Dynamic WEP-104 encryption must be enabled.
- B. WEP may not be used for encryption.
- C. WLAN controllers and APs must not support SSHv1.
- D. Token cards must be used for authentication.
- E. WPA-Personal must be supported for authentication and encryption.
Answer: B
Explanation:
A Robust Security Network (RSN) is defined by the IEEE 802.11i standard and is designed to provide a framework for secure wireless LAN communications. One of the primary criteria for a network to qualify as an RSN is that WEP (Wired Equivalent Privacy) must not be used for encryption, as WEP has well-known vulnerabilities and is considered insecure. RSN-compliant networks must use either CCMP (AES) or GCMP for encryption and 802.1X/EAP or WPA2-Personal for authentication.
Incorrect:
A). Token cards are not part of RSN criteria.
B). Dynamic WEP is still WEP and disqualifies RSN status.
D). WPA-Personal may be supported, but alone does not define an RSN.
E). SSHv1 concerns device management security, not RSN qualification.
References:
CWSP-208 Study Guide, Chapter 3 (Robust Security Networks)
IEEE 802.11i Standard
CWNP Exam Objectives: Security Standards and Protocols
NEW QUESTION # 53
......
Get Ready to Pass the CWSP-208 exam Right Now Using Our CWNP CWSP Exam Package: https://skillmeup.examprepaway.com/CWNP/braindumps.CWSP-208.ete.file.html