Pass the CWNP CWNA CWNA-109 Questions and answers with Dumpstech

The fact that is true regarding controllers and APs in a Split MAC architecture is that an IP tunnel is established between the AP and controller for AP management and control functions. A Split MAC architecture is a WLAN architecture where some of the MAC layer functions are performed by the APs (such as encryption, decryption, and frame acknowledgement) and some are performed by the controllers (such as authentication, association, roaming, and QoS). To communicate with each other, the APs and controllers establish an IP tunnel that carries the management and control frames between them. The IP tunnel can use protocols such as Lightweight Access Point Protocol (LWAPP) or Control And Provisioning of Wireless Access Points (CAPWAP). References: [CWNP Certified Wireless Network Administrator Official Study Guide: Exam CWNA-109], page 372; [CWNA: Certified Wireless Network Administrator Official Study Guide: Exam CWNA-109], page 362.

 VSWR stands for Voltage Standing Wave Ratio, which is a measure of how well the impedance of the RF cable and connectors matches the impedance of the transmitter and the antenna. Impedance is the opposition to the flow of alternating current in an RF circuit, and it depends on the frequency, resistance, capacitance, and inductance of the components. A perfect impedance match would have a VSWR of 1:1, meaning that all the power is transferred from the transmitter to the antenna, and none is reflected back. However, in reality, there is always some degree of mismatch, which causes some power to be reflected back to the transmitter, creating standing waves along the cable. This reduces the efficiency and performance of the wireless system, and can also damage the transmitter. Excessive VSWR can be caused by using poor quality or damaged cables and connectors, or by using components that have different impedance ratings123. References: CWNA-109 Study Guide, Chapter 2: Radio Frequency Fundamentals, page 90; CWNA-109 Study Guide, Chapter 2: Radio Frequency Fundamentals, page 86; CWNP website, CWNA Certification.

SAE (Simultaneous Authentication of Equals) is required when operating 802.11ax APs in the 6 GHz band using passphrase-based authentication. SAE is a secure and robust authentication method that is defined in the IEEE 802.11s amendment and is also known as WPA3-Personal or WPA3-SAE. SAE is based on a cryptographic technique called Dragonfly Key Exchange, which allows two parties to establish a shared secret key using a passphrase, without revealing the passphrase or the key to an eavesdropper or an attacker. SAE also provides forward secrecy, which means that if the passphrase or the key is compromised in the future, it does not affect the security of past communications.

SAE is required when operating 802.11ax APs in the 6 GHz band using passphrase-based authentication because of the new regulations and standards that apply to this band. The 6 GHz band is a new frequency band that was opened for unlicensed use by the FCC and other regulatory bodies in 2020. The 6 GHz band offers more spectrum and less interference than the existing 2.4 GHz and 5 GHz bands, which can enable higher performance and efficiency for Wi-Fi devices. However, the 6 GHz band also has some restrictions and requirements that are different from the other bands, such as:

The 6 GHz band is divided into two sub-bands: U-NII-5 (5925-6425 MHz) and U-NII-7 (6525-6875 MHz). The U-NII-5 sub-band is subject to DFS (Dynamic Frequency Selection) rules, which require Wi-Fi devices to monitor and avoid using channels that are occupied by radar systems or other primary users. The U-NII-7 sub-band is not subject to DFS rules, but it has a lower maximum transmit power limit than the U-NII-5 sub-band.

The Wi-Fi devices that operate in the 6 GHz band are called 6E devices, which stands for Extended Spectrum. 6E devices must support 802.11ax technology, which is also known as Wi-Fi 6 or High Efficiency (HE). 802.11ax is a new standard that improves the performance and efficiency of Wi-Fi networks by using features such as OFDMA (Orthogonal Frequency Division Multiple Access), MU-MIMO (Multi-User Multiple Input Multiple Output), BSS Coloring, TWT (Target Wake Time), and HE PHY and MAC enhancements.

The 6E devices that operate in the 6 GHz band must also support WPA3 security, which is a new security protocol that replaces WPA2 and provides stronger encryption and authentication for Wi-Fi networks. WPA3 has two modes: WPA3-Personal and WPA3-Enterprise. WPA3-Personal uses SAE as its authentication method, which requires a passphrase to establish a secure connection between two devices. WPA3-Enterprise uses EAP (Extensible Authentication Protocol) as its authentication method, which requires a certificate or a credential to authenticate with a server.

Therefore, SAE is required when operating 802.11ax APs in the 6 GHz band using passphrase-based authentication because it is part of WPA3-Personal security, which is mandatory for 6E devices in this band. References: , Chapter 3, page 120; , Section 3.2

9of30

WPA2 (Wi-Fi Protected Access 2) is a security certification program developed by the Wi-Fi Alliance to secure wireless computer networks. It is important to understand the following:

WPA2 and the 802.11 Standard: While WPA2 is based on elements of the 802.11i amendment to the 802.11 standard, it is not itself a standard but rather a certification to ensure devices comply with certain security criteria, including the correct implementation of CCMP (Counter Mode Cipher Block Chaining Message Authentication Code Protocol) and AES (Advanced Encryption Standard).

CCMP/AES Implementation: WPA2 enhances the security of wireless networks by using CCMP for encryption, which is based on AES, a robust encryption algorithm. This represents a significant security improvement over WEP (Wired Equivalent Privacy) and WPA (Wi-Fi Protected Access) that used TKIP (Temporal Key Integrity Protocol).

WPA vs. WPA2: WPA was the interim security enhancement over WEP, utilizing TKIP for encryption. WPA2, however, moved to the more secure AES-based encryption method. Contrary to option C, WPA2 does not enhance security by using TKIP; it uses CCMP/AES.

Therefore, option B correctly describes WPA2 as a certification program ensuring devices properly implement the more secure CCMP/AES encryption methods.

Granting access to specific network services or resources according to a user profile describes the authorization component of a AAA implementation. AAA stands for Authentication, Authorization, and Accounting, which are three functions that are used to control and monitor access to network resources and services. Authentication is the process of verifying that a user is who he says he is, by using credentials such as username, password, certificate, token, or biometric data. Authorization is the process of granting access to specific network services or resources according to a user profile, which defines the user’s role, privileges, and permissions. Accounting is the process of recording and reporting the usage of network services or resources by a user, such as the duration, volume, type, and location of the access. AAA can be implemented by using different protocols and servers, such as RADIUS, TACACS+, LDAP, Kerberos, or Active Directory. References: 1, Chapter 11, page 449; 2, Section 7.1

Refraction is the bending of an RF signal as it passes through a medium with a different density than free space. This can cause the signal to change its direction and speed, which can affect the accuracy and reliability of wireless communication. Refraction is influenced by factors such as temperature, humidity, and atmospheric pressure12. References: CWNA-109 Study Guide, Chapter 2: Radio Frequency Fundamentals, page 72; CWNA-109 Study Guide, Chapter 2: Radio Frequency Fundamentals, page 67.

The inverse square law states that the signal strength of an RF wave is inversely proportional to the square of the distance from the source. This means that as the distance from the transmitter increases, the signal strength decreases rapidly.

Cellular/LTE/5G is the best method for implementing a network backhaul for communications across the Internet in a remote area that is affected by a natural disaster. This is because cellular/LTE/5G networks are wireless and do not depend on physical infrastructure that may be damaged or unavailable in such scenarios. Cellular/LTE/5G networks also offer high-speed data transmission and wide coverage area, which are essential for emergency response operations. 802.11 bridging to the response team headquarters is not feasible because it requires line-of-sight and has limited range. Turning up the output power of the WLAN at the response team headquarters is not effective because it may cause interference and does not guarantee reliable connectivity. Temporary wired DSL is not practical because it requires installing cables and equipment that may not be available or accessible in a remote area. References: CWNA-109 Study Guide, Chapter 7: Wireless LAN Topologies, page 2031

In the 802.11 wireless networking protocols, when a client station sends a broadcast probe request frame with a wildcard SSID (Service Set Identifier), it is essentially asking for any nearby access points (APs) to identify themselves. The way APs respond to such a probe request is governed by standard 802.11 behavior, which includes:

Probe Request Handling: Upon receiving a broadcast probe request, each AP that can serve the client prepares a probe response. The response includes information about the AP, such as its SSID, supported data rates, and other capabilities.

Contention-Based Mechanism: Wireless networks use a contention-based mechanism (CSMA/CA - Carrier Sense Multiple Access with Collision Avoidance) for medium access. Each AP must wait for a clear channel and win the contention process before it can send its probe response.

Independent Responses: Each AP operates independently in responding to the probe request. There is no coordination between APs to decide which one responds first or at all, leading to multiple APs sending probe responses, each after winning the contention for the medium.

Option A accurately reflects this process, indicating that each AP prepares and sends a probe response in turn, contingent upon winning the medium contention. The other options suggest mechanisms (such as coordination with a DHCP server or simultaneous responses after a Short Interframe Space (SIFS)) that do not align with standard 802.11 procedures for handling broadcast probe requests.