CWNP CWNA Certification CWNA-109 Questions & Answers

• Question 1:

  What statement is true concerning the use of Orthogonal Frequency Division Multiplexing (OFDM) modulation method in IEEE 802.11 WLANs?

  A. OFDM implements BPSK modulation to allow for data rates up to 7 Gbps.

  B. OFDM was first introduced in 802.11a and is used by the ERP, HT and VHT PHYs as well.

  C. OFDM modulation is used only in 5 GHz 802.11 transmissions.

  D. OFDM was used by Frequency Hopping Spread Spectrum (FHSS) PHY devices.

  Correct Answer: B

  OFDM is a modulation method that divides the channel bandwidth into multiple subcarriers, each carrying a single data symbol. This allows for higher data rates and more robust transmissions in multipath environments. OFDM was first introduced inthe 802.11a standard, which operates in the 5 GHz band and supports data rates up to 54 Mbps. Later, the 802.11g standard adopted OFDM for the 2.4 GHz band, and the 802.11n and 802.11ac standards enhanced OFDM with features such as MIMO (Multiple Input Multiple Output), channel bonding, and higher-order modulation schemes to achieve data rates up to 600 Mbps and 6.9 Gbps, respectively. These standards are collectively known as the ERP (Extended Rate PHY), HT (High Throughput), and VHT (Very High Throughput) PHYs . References: [CWNA-109 Study Guide], Chapter 4: Radio Frequency Signal and Antenna Concepts, page 163; [CWNA-109Study Guide], Chapter 4: Radio Frequency Signal and Antenna Concepts, page 157.

• Question 2:

  In a long-distance RF link, what statement about Fade Margin is true?

  A. A Fade Margin is unnecessary on a long-distance RF link if more than 80% of the first Fresnel zone is clear of obstructions.

  B. The Fade Margin is a measurement of signal loss through free space and is a function of frequency and distance.

  C. Fade Margin is an additional pad of signal strength designed into the RF system to compensate for unpredictable signal fading.

  D. The Fade Margin of a long-distance radio link should be equivalent to the receiver's low noise filter gain.

  Correct Answer: C

  Fade Margin is an additional pad of signal strength designed into the RF system to compensate for unpredictable signal fading. It is the difference between the receiver's sensitivity and the actual received signal level. A higher Fade Margin indicates a more robust link that can withstand interference, attenuation, or other factors that may reduce the signal strength. A lower Fade Margin means that the link is more susceptible to failure or performance degradation. Fade Margin is usually expressed in decibels (dB) and can be calculated by subtracting the receiver sensitivity from the received signal level. References: 1, Chapter 2, page 51; 2, Section 2.1

• Question 3:

  XYZ Company has decided to install an 802.11 WLAN system that will support 1083 wireless users, but they are concerned about network security. XYZ is interested in deploying standardized security features. In addition to WPA2-Enterprise with PEAP and role-based access control, XYZ would like to support management frame protection as well as a fast secure roaming protocol for future mobile handsets.

  As XYZ Company selects a product to deploy, what two IEEE amendments, which are included in 802.11-2016, and 802.11-2020 should be supported to provide the management frame protection and fast secure roaming security features?

  A. 802.11j and 802.11z

  B. 802.11r and 802.11w

  C. 802.11j and 802.11k

  D. 802.11k and 802.11v

  Correct Answer: B

  The two IEEE amendments that should be supported to provide the management frame protection and fast secure roaming security features are 802.11r and 802.11w12. 802.11r (Fast BSS Transition): This amendment to the IEEE 802.11 standard permits continuous connectivity aboard wireless devices in motion, with fast and secure client transitions from one Basic Service Set to another1. 802.11w (Management Frame Protection): This amendment increases the security of its management frames2.

• Question 4:

  Return Loss is the decrease of forward energy in a system when some of the power is being reflected back toward the transmitter. What will cause high return loss in an RF transmission system, including the radio, cables, connectors and antenna?

  A. The use of 50 ohm cables longer than one meter in the RF system

  B. High output power at the transmitter and use of a low-gain antenna

  C. A significant impedance mismatch between components in the RF system

  D. A Voltage Standing Wave Ratio (VSWR) of 1:1

  Correct Answer: C

  Return loss is a measure of how well the components of an RF system are matched in terms of their impedance. Impedance is the opposition to the flow of alternating current in a circuit, and it depends on the frequency, resistance,

  capacitance, and inductance of the components. When the impedance of the source, the transmission line, and the load are not equal, some of the power is reflected back to the source, causing a loss of forward power. This loss is expressed

  in decibels (dB) as return loss. The higher the return loss, the lower the reflection and the better the impedance matching. Conversely, the lower the return loss, the higher the reflection and the worse the impedance matching. VSWR (Voltage

  Standing Wave Ratio) is another way of expressing the same concept. It is the ratio of the maximum voltage to the minimum voltage along a transmission line due to the interference of the incident and reflected waves. A VSWR of 1:1 means

  that there is no reflection and perfect impedance matching. A VSWR higher than 1:1 means that there is some reflection and impedance mismatch. The higher the VSWR, the higher the reflection and the lower the return loss.

  Therefore, a significant impedance mismatch between components in an RF system will cause high reflection, high VSWR, and low return loss.

• Question 5:

  When an ACK frame is not received by the transmitting STA, what is assumed?

  A. The receiver processed the frame, but did not respond with an ACK frame because 802.11w is enabled

  B. The frame was correctly delivered

  C. The frame was not delivered and must be retransmitted

  D. The receiver is offline

  Correct Answer: C

  An ACK (Acknowledgement) frame is a short control frame that is sent by the receiver of a data or management frame to confirm that the frame was received correctly. The ACK frame is sent after a SIFS (Short Interframe Space) interval, which is the shortest time gap between frames in 802.11. If the transmitter does not receive an ACK frame within a specified time, it assumes that the frame was not delivered and must be retransmitted. This is part of the 802.11 reliability mechanism that ensures reliable data delivery over an unreliable wireless medium . References: [CWNA-109 Study Guide], Chapter 5: IEEE 802.11 Medium Access, page 209; [CWNA-109Study Guide], Chapter 5: IEEE 802.11 Medium Access, page 203.

• Question 6:

  What security option for 802.11 networks supports SAE and requires protected management frames?

  A. WPA

  B. WPA2

  C. WPA3

  D. OWE

  Correct Answer: C

  The security option for 802.11 networks that supports SAE and requires protected management frames is WPA3. WPA3 stands for Wi-Fi Protected Access version 3 and is the latest security standard for WLANs. WPA3 supports two modes:

  WPA3-Personal and WPA3-Enterprise. WPA3-Personal uses Simultaneous Authentication of Equals (SAE) as the key exchange protocol, which provides stronger protection against offline dictionary attacks and password guessing than

  WPA2-Personal. WPA3 also requires protected management frames, which are encrypted frames that prevent spoofing, replay, or denial- of-service attacks on management frames such as deauthentication or disassociation frames. WPA,

  WPA2, and OWE do not support SAE or require protected management frames. References: [CWNP Certified Wireless Network Administrator Official Study Guide:

  ExamCWNA-109], page 307; [CWNA: Certified Wireless Network Administrator Official Study Guide: ExamCWNA-109], page 297.

• Question 7:

  What statement describes the authorization component of a AAA implementation?

  A. Verifying that a user is who he says he is.

  B. Implementing a WIPS as a full-time monitoring solution to enforce policies.

  C. Granting access to specific network services or resources according to a user profile.

  D. Validating client device credentials against a database.

  Correct Answer: C

  Granting access to specific network services or resources according to a user profile describes the authorization component of a AAA implementation. AAA stands for Authentication, Authorization, and Accounting, which are three functions that are used to control and monitor access to network resources and services. Authentication is the process of verifying that a user is who he says he is, by using credentials such as username, password, certificate, token, or biometric data. Authorization is the process of granting access to specific network services or resources according to a user profile, which defines the user's role, privileges, and permissions. Accounting is the process of recording and reporting the usage of network services or resources by a user, such as the duration, volume, type, and location of the access. AAA can be implemented by using different protocols andservers, such as RADIUS, TACACS+, LDAP, Kerberos, or Active Directory. References: 1, Chapter 11, page 449; 2, Section 7.1

• Question 8:

  ABC Company is planning a point-to-multipoint outdoor bridge deployment with standalone (autonomous) 802.11 bridge units. 802.1X/EAP will be used for bridge authentication. A Linux-based RADIUS server will be used for authentication. What device in the bridge implementation acts as the 802.1X Authenticator?

  A. The Ethernet switch

  B. The RADIUS server

  C. All non-root bridges

  D. The root bridge

  Correct Answer: D

  The device in the bridge implementation that acts as the 802.1X Authenticator is the root bridge. The root bridge is the bridge that connects to the wired network and acts as the central point for all other bridges in the point-to-multipoint

  topology. The root bridge authenticates the non-root bridges using 802.1X/EAP and forwards their authentication requests to the RADIUS server. The non-root bridges act as the 802.1X Supplicants and use EAP methods such as EAP-TLS or

  EAP-PEAP to authenticate with the root bridge. References: [CWNP Certified Wireless Network Administrator Official Study Guide:

  ExamCWNA-109], page 459; [Cisco Aironet Wireless Bridges FAQ], question 29.

• Question 9:

  Three access points are used within a facility. One access point is on channel 11 and the other two are on channel 1. The two access points using channel 1 are on either side of the access point using channel 11 and sufficiently apart so that they do not interfere with each other when they transmit frames. Assuming no other APs are in the vicinity, is CCI still a possibility in this network and why?

  A. Yes, because the client devices connected to one of the channel 1 APs will transmit frames that reach the other channel 1 AP as well as clients connected to the other channel 1 AP.

  B. No, because the APs are far enough apart that no CCI will occur.

  C. No, because CCI only occurs in the 5 GHz frequency band.

  D. Yes, because channel 11 loops around and causes CCI with channel 1.

  Correct Answer: A

  CCI is still a possibility in this network because the client devices connected to one of the channel 1 APs will transmit frames that reach the other channel 1 AP as well as clients connected to the other channel 1 AP. CCI stands for co-channel interference, which is a type of interference that occurs when two or more devices transmit on the same channel within range of each other. CCI reduces performance and capacity because it causes contention and collisions on the wireless medium, which leads to retransmissions and delays. CCI can be mitigated by increasing physical separation between devices using the same channel or byreducing transmit power levels to limit coverage area. In this scenario, three access points are used within a facility. One access point is on channel 11 and the other two are on channel 1. The two access points using channel 1 are on either side of the access point using channel 11 and sufficiently apart so that they do not interfere with each other when they transmit frames. However, this does not prevent CCI from occurring between their client devices that are connected on channel 1. For example, if a client device connected to one of the channel 1 APs sends a frame to another device on the wired network or on another wireless network (such as an Internet server or a VoIP phone), that frame will be heard by both channel 1 APs as well as any other client devices connected to either of them on channel 1. This will cause CCI because these devices will have to wait for the channel to be clear before they can transmit their own frames. The answer that CCI only occurs in the 5 GHz frequency band is incorrect; CCI can occur in any frequency band where devices use the same channel. The answer that channel 11 loops around and causes CCI with channel 1 is also incorrect; channel 11 does not loop around and it operates in a different frequency band than channel 1. References: CWNA- 109 Study Guide, Chapter 5: Radio Frequency Signal and Antenna Concepts, page 147

• Question 10:

  What is required when operating 802.11ax APS in the 6 GHz band using passphrase- based authentication?

  A. VHT PHY

  B. HT PHY

  C. SAE

  D. CCMP

  Correct Answer: C

  SAE (Simultaneous Authentication of Equals) is required when operating 802.11ax APs in the 6 GHz band using passphrase-based authentication. SAE is a secure and robust authentication method that is defined in the IEEE 802.11s amendment and is also known as WPA3-Personal or WPA3-SAE. SAE is based on a cryptographic technique called Dragonfly Key Exchange, which allows two parties to establish a shared secret key using a passphrase, without revealing the passphrase or the key to an eavesdropper or an attacker. SAE also provides forward secrecy, which means that if the passphrase or the key is compromised in the future, it does not affect the security of past communications. SAE is required when operating 802.11ax APs in the 6 GHz band using passphrase-based authentication because of the new regulations and standards that apply to this band. The 6 GHz band is a new frequency band that was opened for unlicensed use by the FCC and other regulatory bodies in 2020. The 6 GHz band offers more spectrum and less interference than the existing 2.4 GHz and 5 GHz bands, which can enable higher performance and efficiency for Wi-Fi devices. However, the 6 GHz band also has some restrictions and requirements that are different from the other bands, such as: The 6 GHz band is divided into two sub-bands: U-NII-5 (5925-6425 MHz) and U- NII-7 (6525-6875 MHz). The U-NII-5 sub-band is subject to DFS (Dynamic Frequency Selection) rules, which require Wi-Fi devices to monitor and avoid using channels that are occupied by radar systems or other primary users. The U- NII-7 sub-band is not subject to DFS rules, but it has a lower maximum transmit power limit than the U-NII-5 sub-band. The Wi-Fi devices that operate in the 6 GHz band are called 6E devices, which stands for Extended Spectrum. 6E devices must support 802.11ax technology, which is also known as Wi-Fi 6 or High Efficiency (HE). 802.11ax is a new standard that improves the performance and efficiency of Wi-Fi networks by using features such as OFDMA (Orthogonal Frequency Division Multiple Access), MU- MIMO (Multi-User Multiple Input Multiple Output), BSS Coloring, TWT (Target Wake Time), and HE PHY and MAC enhancements. The 6E devices that operate in the 6 GHz band must also support WPA3 security, which is a new security protocol that replaces WPA2 and provides stronger encryption and authentication for Wi-Fi networks. WPA3 has two modes: WPA3Personal and WPA3-Enterprise. WPA3-Personal uses SAE as its authentication method, which requires a passphrase to establish a secure connection between two devices. WPA3-Enterprise uses EAP (Extensible Authentication Protocol) as its authentication method, which requires a certificate or a credential to authenticate with a server. Therefore, SAE is required when operating 802.11ax APs in the 6 GHz band using passphrase-based authentication because it is part of WPA3-Personal security, which is mandatory for 6E devices in this band. References: , Chapter 3, page 120; , Section 3.2 9of30