Question 1

What is the function of the PHY layer?

Accepted Answer

D

Explanation: The IEEE 802.11 Physical (PHY) layer is responsible for the transmission and reception of data over the wireless medium. During the transmission process, the PHY layer receives the PHY Service Data Unit (PSDU) from the MAC sublayer. It then prepends a PHY-specific preamble and header to this PSDU to construct the PHY Protocol Data Unit (PPDU), which is the final format transmitted over the air. Conversely, during reception, the PHY layer detects and decodes the incoming PPDU from the wireless medium, strips off the preamble and header, and passes the resulting PSDU up to the MAC sublayer for further processing.

Question 2

The network administrator at ABC Engineering has taken a large packet capture from one of their APs
running in monitor mode. She has very little knowledge of 802.11 protocols but would like to use the
capture file to evaluate the overall health and performance of their wireless network. When she asks
your advice, which tool do you recommend she opens the packet capture file with?

Accepted Answer

C

Explanation: A capture visualization tool, also known as a protocol analyzer, is specifically designed to open packet capture files (e.g., .pcap, .pcapng) and interpret the 802.11 protocol data within them. For a user with limited protocol knowledge, these tools are invaluable as they translate raw frame data into human-readable formats and provide high-level statistical analysis, graphs, and expert systems. Features like airtime utilization charts, retry rate graphs, and conversation analysis allow for an effective evaluation of network health and performance without requiring the user to manually decode every frame.

Question 3

What is the function of 802.11 Management frames?

Accepted Answer

C

Explanation: The primary function of 802.11 Management frames is to establish, maintain, and terminate sessions within a Basic Service Set (BSS). These frames are not used for carrying user data but are essential for the lifecycle of a wireless connection. Key examples include Beacon frames for announcing a network's presence, Probe Request/Response frames for discovering networks, Authentication and Association frames for joining a network, and Disassociation/Deauthentication frames for leaving a network. Collectively, these functions constitute the management of the BSS.

Question 4

After examining a Beacon frame decode you see the SSID Element has a length of 0. What do you conclude about this frame?

Accepted Answer

D

Explanation: According to the IEEE 802.11 standard, an Information Element (IE) consists of an Element ID, a Length field, and a variable-length data field. The SSID IE (Element ID 0) is used to convey the network name. When a Basic Service Set (BSS) is configured to not broadcast its SSID, a practice commonly referred to as "hiding the SSID" or creating a "closed network," the Access Point (AP) transmits Beacon frames where the SSID IE is present, but its Length field is set to 0. This indicates a null SSID, effectively preventing passive scanners from discovering the network name from Beacons. This is a valid and standard configuration, not an error or an attack.

Question 5

What does the value of the Listen Interval field in an Association Request frame indicate?

Accepted Answer

C

Explanation: The Listen Interval field is a value set by a client station (STA) in its Association Request frame. It informs the Access Point (AP) of the maximum number of Beacon intervals the STA will sleep before waking to listen for a Beacon frame. The AP uses this value to determine its buffer management strategy for that specific STA. If the AP has buffered unicast frames for a sleeping STA, it indicates this in the Traffic Indication Map (TIM) of its Beacon frames. The STA wakes periodically, as defined by its Listen Interval, to check the TIM and retrieve its data.

Question 6

What is the difference between a Data frame and a QoS-Data frame?

Accepted Answer

D

Explanation: The fundamental difference between a legacy Data frame and a QoS-Data frame, as defined by the IEEE 802.11e amendment, is the inclusion of a 2-byte (16-bit) QoS Control field in the MAC header. This field is present only in frames with the QoS subtype. It contains several subfields, most notably the Traffic Identifier (TID), which maps the frame to one of eight User Priorities (UPs). These UPs are then mapped to specific Access Categories (ACs) for prioritized channel access using EDCA (Enhanced Distributed Channel Access). The presence of this field is the defining characteristic that enables MAC-layer Quality of Service.

Question 7

How is the length of an AIFS calculated?

Accepted Answer

D

Explanation: The Arbitration Inter-Frame Space (AIFS) is a fundamental component of the Enhanced Distributed Channel Access (EDCA) mechanism, defined in IEEE 802.11e to provide Quality of Service (QoS). Its duration is calculated on a per-Access Category (AC) basis. The formula begins with the base Short Inter-Frame Space (SIFS) duration, to which a variable period is added. This variable period is the product of the AIFS Number (AIFSN), a small integer assigned to each AC, and the standard Slot Time (aSlotTime) for the specific Physical Layer (PHY). A lower AIFSN value results in a shorter AIFS, thus granting higher priority access to the wireless medium.

Question 8

During a VHT Transmit Beamforming sounding exchange, the beamformee transmits a Compressed Beamforming frame to the beamformer. What is communicated within this Compressed Beamforming frame?

Accepted Answer

C

Explanation: In the 802.11ac (VHT) explicit transmit beamforming (TxBF) sounding procedure, the beamformer sends a Null Data Packet (NDP) to the beamformee. The beamformee uses this NDP to measure the characteristics of the MIMO channel. Based on this measurement, it calculates the channel state information (CSI). This CSI is then encapsulated within a VHT Compressed Beamforming frame and transmitted back to the beamformer. The specific name for this CSI data structure, as defined by the IEEE 802.11 standard, is the Feedback Matrix. The beamformer then uses this matrix to compute its own steering matrix for subsequent directed transmissions.

Question 9

Protocol analyzers may present field values in either binary, decimal or hexadecimal. What preceeds a hexadecimal value to indicate it is hexadecimal?

Accepted Answer

A

Explanation: The prefix "0x" is the standard convention used to denote a hexadecimal (base-16) number in many programming languages, most notably C and its derivatives (C++, Java, C#). This convention has been widely adopted in computing and is used by most protocol analyzers, such as Wireshark, to represent hexadecimal values in packet decodes and display filters. This notation unambiguously distinguishes hexadecimal numbers from decimal or other numerical bases, preventing misinterpretation of data fields within a protocol frame.

Question 10

An RTS frame should be acknowledged by which frame?

Accepted Answer

A

Explanation: The Request to Send (RTS) and Clear to Send (CTS) frames are part of the 802.11 Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) mechanism, specifically the Distributed Coordination Function (DCF). When a station (STA) intends to send a data frame that exceeds the configured RTS Threshold, it first transmits an RTS frame to the intended recipient. The recipient STA, upon receiving the RTS, responds with a CTS frame after a Short Interframe Space (SIFS). This CTS frame serves as the positive acknowledgment to the RTS and reserves the radio frequency (RF) medium for the subsequent data frame transmission, helping to mitigate the hidden node problem.

Question 11

Which one of the following statements is not true concerning DTIMs?

Accepted Answer

D

Explanation: A Delivery Traffic Indication Message (DTIM) is a specific type of Traffic Indication Map (TIM) used to manage buffered broadcast and multicast traffic for stations in Power Save mode. The TIM information element, present in all beacons from an Access Point, contains a DTIM Count field. This field counts down from the DTIM Period value to zero. Only when the DTIM Count field is zero is the beacon frame considered a DTIM. Since the DTIM Period is typically a value greater than one, most beacons are not DTIMs; they are regular TIMs that simply decrement the counter. Therefore, the statement that every beacon frame must contain a DTIM is false.

Question 12

802.11k Neighbor Requests and Neighbor Reports are sent in what type of Management Frames?

Accepted Answer

B

Explanation: The 802.11k amendment, which specifies Radio Resource Measurement (RRM), utilizes Action frames to exchange information between a client station and an Access Point. The Neighbor Request and Neighbor Report messages are specific types of RRM communications. The 802.11 standard defines a "Radio Measurement" category (Category code 5) for Action frames, which encapsulates these requests and reports. This mechanism allows for on-demand information exchange without altering fundamental frame types like Beacons or Association frames.

Question 13

Why would a STA that supports 802.11k Radio Measurement send a Neighbor Request to an AP?

Accepted Answer

C

Explanation: The IEEE 802.11k amendment, "Radio Resource Measurement," is designed to improve traffic distribution within a wireless network. A key feature is the Neighbor Report mechanism. A client station (STA) sends a Neighbor Request frame to its currently associated Access Point (AP) to ask for information about nearby APs that are suitable candidates for roaming. The AP responds with a Neighbor Report frame containing a list of these APs and their characteristics (e.g., channel, BSSID). This process allows the STA to build a comprehensive view of potential roaming targets without having to perform disruptive and time-consuming off-channel scanning, leading to faster and more efficient roaming decisions.

Question 14

When performing protocol analysis, you capture an 802.1 lac data frame on channel 52, transmitted at MCS 8. At what data rate was the PHY Preamble transmitted?

Accepted Answer

C

Explanation: The 802.11ac (VHT) Physical Layer Convergence Procedure (PLCP) frame format is designed for backward compatibility with legacy 802.11a/n devices operating in the same 5 GHz band. To achieve this, every 802.11ac frame begins with a legacy preamble, which includes the L-STF, L-LTF, and L-SIG fields. The L-SIG (Legacy Signal) field, which contains rate and length information, is always transmitted at the most robust and basic OFDM rate of 6 Mbps (using BPSK modulation with a 1/2 coding rate). This ensures that all legacy devices can decode this initial part of the frame and correctly set their Network Allocation Vector (NAV). The specified MCS 8 data rate only applies to the VHT data portion of the frame, not the preamble.

Question 15

What is used to respond with an uplink transmission to an MU-RTS trigger frame in the 802.11ax PHY?

Accepted Answer

C

Explanation: In the IEEE 802.11ax standard, uplink multi-user (UL MU) transmissions are coordinated by the Access Point (AP) using a Trigger frame. The MU-RTS is a specific type of Trigger frame used to solicit Clear-to-Send (CTS) frames to reserve the medium. Following this, a basic Trigger frame allocates specific resource units (RUs) to multiple stations for simultaneous uplink transmission. The stations respond to this trigger by sending data encapsulated in a High Efficiency Trigger-Based PPDU (HE TB PPDU). This specific PPDU format is designed exclusively for triggered uplink transmissions in 802.11ax.

Free CWNP CWAP-404 Actual Exam Questions