[Nov-2025] CWSP-208 PDF Dumps Extremely Quick Way Of Preparation [Q26-Q42]

NO.26 In the IEEE 802.11-2012 standard, what is the purpose of the 802.1X Uncontrolled Port?

To allow only authentication frames to flow between the Supplicant and Authentication Server

To block authentication traffic until the 4-Way Handshake completes

To pass general data traffic after the completion of 802.11 authentication and key management

To block unencrypted user traffic after a 4-Way Handshake completes

NO.27 Given: You must implement 7 APs for a branch office location in your organization. All APs will be autonomous and provide the same two SSIDs (CORP1879 and Guest).
Because each AP is managed directly through a web-based interface, what must be changed on every AP before enabling the WLANs to ensure proper staging procedures are followed?

Fragmentation threshold

Administrative password

Output power

Cell radius

NO.28 Given: Mary has just finished troubleshooting an 802.11g network performance problem using a laptop-based WLAN protocol analyzer. The wireless network implements 802.1X/PEAP and the client devices are authenticating properly. When Mary disables the WLAN protocol analyzer, configures her laptop for PEAP authentication, and then tries to connect to the wireless network, she is unsuccessful. Before using the WLAN protocol analyzer, Mary’s laptop connected to the network without any problems.
What statement indicates why Mary cannot access the network from her laptop computer?

The nearby WIPS sensor categorized Mary’s protocol analyzer adapter as a threat and is performing a deauthentication flood against her computer.

The PEAP client’s certificate was voided when the protocol analysis software assumed control of the wireless adapter.

The protocol analyzer’s network interface card (NIC) drivers are still loaded and do not support the version of PEAP being used.

Mary’s supplicant software is using PEAPv0/EAP-MSCHAPv2, and the access point is using PEAPv1
/EAP-GTC.

NO.29 Given: ABC Company is implementing a secure 802.11 WLAN at their headquarters (HQ) building in New York and at each of the 10 small, remote branch offices around the United States. 802.1X/EAP is ABC’s preferred security solution, where possible. All access points (at the HQ building and all branch offices) connect to a single WLAN controller located at HQ. Each branch office has only a single AP and minimal IT resources.
What security best practices should be followed in this deployment scenario?

An encrypted VPN should connect the WLAN controller and each remote controller-based AP, or each remote site should provide an encrypted VPN tunnel to HQ.

APs at HQ and at each branch office should not broadcast the same SSID; instead each branch should have a unique ID for user accounting purposes.

RADIUS services should be provided at branch offices so that authentication server and supplicant credentials are not sent over the Internet.

Remote management of the WLAN controller via Telnet, SSH, HTTP, and HTTPS should be prohibited across the WAN link.

NO.30 Which of the following security attacks cannot be detected by a WIPS solution of any kind? (Choose 2)

Rogue APs

DoS

Eavesdropping

Social engineering

NO.31 Given: You are installing 6 APs on the outside of your facility. They will be mounted at a height of 6 feet.
What must you do to implement these APs in a secure manner beyond the normal indoor AP implementations? (Choose the single best answer.)

User external antennas.

Use internal antennas.

Power the APs using PoE.

Ensure proper physical and environmental security using outdoor ruggedized APs or enclosures.

NO.32 What drawbacks initially prevented the widespread acceptance and use of Opportunistic Key Caching (OKC)?

Sharing cached keys between controllers during inter-controller roaming created vulnerabilities that exposed the keys to attackers.

Because OKC is not defined by any standards or certification body, client support was delayed and sporadic early on.

Key exchanges during fast roams required processor-intensive cryptography, which was prohibitive for legacy devices supporting only TKIP.

The Wi-Fi Alliance continually delayed the creation of a client certification for OKC, even though it was defined by IEEE 802.11r.

NO.33 ABC Company has deployed a Single Channel Architecture (SCA) solution to help overcome some of the common problems with client roaming. In such a network, all APs are configured with the same channel and BSSID. PEAPv0/EAP-MSCHAPv2 is the only supported authentication mechanism.
As the Voice over Wi-Fi (STA-1) client moves throughout this network, what events are occurring?

STA-1 initiates open authentication and 802.11 association with each AP prior to roaming.

The WLAN controller is querying the RADIUS server for authentication before the association of STA-
1 is moved from one AP to the next.

STA-1 controls when and where to roam by using signal and performance metrics in accordance with the chipset drivers and 802.11k.

The WLAN controller controls the AP to which STA-1 is associated and transparently moves this association in accordance with the physical location of STA-1.

NO.34 Wireless Intrusion Prevention Systems (WIPS) are used for what purposes? (Choose 3)

Performance monitoring and troubleshooting

Enforcing wireless network security policy

Detecting and defending against eavesdropping attacks

Security monitoring and notification

Preventing physical carrier sense attacks

Classifying wired client devices

NO.35 The following numbered items show some of the contents of each of the four frames exchanged during the 4- way handshake:
1. Encrypted GTK sent
2. Confirmation of temporal key installation
3. Anonce sent from authenticator to supplicant
4. Snonce sent from supplicant to authenticator, MIC included
Arrange the frames in the correct sequence beginning with the start of the 4-way handshake.

2, 3, 4, 1

1, 2, 3, 4

4, 3, 1, 2

3, 4, 1, 2

NO.36 What is one advantage of using EAP-TTLS instead of EAP-TLS as an authentication mechanism in an 802.11 WLAN?

EAP-TTLS sends encrypted supplicant credentials to the authentication server, but EAP-TLS uses unencrypted user credentials.

EAP-TTLS supports client certificates, but EAP-TLS does not.

EAP-TTLS does not require an authentication server, but EAP-TLS does.

EAP-TTLS does not require the use of a certificate for each STA as authentication credentials, but EAP- TLS does.

NO.37 What is a primary criteria for a network to qualify as a Robust Security Network (RSN)?

Token cards must be used for authentication.

Dynamic WEP-104 encryption must be enabled.

WEP may not be used for encryption.

WPA-Personal must be supported for authentication and encryption.

WLAN controllers and APs must not support SSHv1.

NO.38 Wireless Intrusion Prevention Systems (WIPS) provide what network security services? (Choose 2)

Configuration distribution for autonomous APs

Wireless vulnerability assessment

Application-layer traffic inspection

Analysis and reporting of AP CPU utilization

Policy enforcement and compliance management

NO.39 Given: During 802.1X/LEAP authentication, the username is passed across the wireless medium in clear text.
From a security perspective, why is this significant?

The username is needed for Personal Access Credential (PAC) and X.509 certificate validation.

The username is an input to the LEAP challenge/response hash that is exploited, so the username must be known to conduct authentication cracking.

4-Way Handshake nonces are based on the username in WPA and WPA2 authentication.

The username can be looked up in a dictionary file that lists common username/password combinations.

NO.40 What policy would help mitigate the impact of peer-to-peer attacks against wireless-enabled corporate laptop computers when the laptops are also used on public access networks such as wireless hot-spots?

Require Port Address Translation (PAT) on each laptop.

Require secure applications such as POP, HTTP, and SSH.

Require VPN software for connectivity to the corporate network.

Require WPA2-Enterprise as the minimal WLAN security solution.

NO.41 A WLAN is implemented using WPA-Personal and MAC filtering.
To what common wireless network attacks is this network potentially vulnerable? (Choose 3)

Offline dictionary attacks

MAC Spoofing

ASLEAP

DoS

NO.42 An attack is under way on the network. The attack is preventing users from accessing resources required for business operations, but the attacker has not gained access to any files or data. What kind of attack is described?

Man-in-the-middle

Hijacking

ASLEAP

DoS

[Nov-2025] CWSP-208 PDF Dumps Extremely Quick Way Of Preparation [Q26-Q42]

Leave a Reply Cancel reply