Pass the CWNP CWNA CWNA-109 Questions and answers with Dumpstech

The security option for 802.11 networks that supports SAE and requires protected management frames is WPA3. WPA3 stands for Wi-Fi Protected Access version 3 and is the latest security standard for WLANs. WPA3 supports two modes: WPA3-Personal and WPA3-Enterprise. WPA3-Personal uses Simultaneous Authentication of Equals (SAE) as the key exchange protocol, which provides stronger protection against offline dictionary attacks and password guessing than WPA2-Personal. WPA3 also requires protected management frames, which are encrypted frames that prevent spoofing, replay, or denial-of-service attacks on management frames such as deauthentication or disassociation frames. WPA, WPA2, and OWE do not support SAE or require protected management frames. References: [CWNP Certified Wireless Network Administrator Official Study Guide: Exam CWNA-109], page 307; [CWNA: Certified Wireless Network Administrator Official Study Guide: Exam CWNA-109], page 297.

An IEEE 802.11 amendment is a proposed change or addition to the existing 802.11 standard, which defines the specifications and protocols for wireless LANs. An amendment goes through several stages of development, such as draft, sponsor ballot, and final approval, before it is ratified by the IEEE Standards Association and becomes part of the standard. Until then, it has no official impact on the standard, although some vendors may release products based on draft amendments to gain a competitive edge or to influence the final outcome of the amendment . References: [CWNA-109 Study Guide], Chapter 1: Overview of Wireless Standards, Organizations, and Fundamentals, page 25; [CWNA-109 Study Guide], Chapter 1: Overview of Wireless Standards, Organizations, and Fundamentals, page 23; [IEEE website], IEEE-SA Standards Development Process.

Channel 144 is a new channel that was added to the 5 GHz band by the 802.11ac amendment, which defines the VHT (Very High Throughput) PHY for WLANs. Channel 144 has a center frequency of 5720 MHz and a bandwidth of 20 MHz. It can also be combined with adjacent channels to form wider channels of 40 MHz, 80 MHz, or 160 MHz. Channel 144 is available in some regions, such as North America and Europe, but not in others, such as Japan and China . References: [CWNA-109 Study Guide], Chapter 3: Antennas and Accessories, page 121; [CWNA-109 Study Guide], Chapter 3: Antennas and Accessories, page 115; [Wikipedia], List of WLAN channels.

The WLAN feature that would allow the network administrator to control the network resources that can be accessed by each employee based on their department is Role-Based Access Control (RBAC). RBAC is a method of assigning different permissions and policies to users or groups based on their roles in the organization. RBAC can be implemented by using VLANs, ACLs, or firewalls to restrict access to certain network segments or resources. RBAC can also be integrated with 802.1X/EAP authentication to dynamically assign roles and VLANs to users based on their credentials. References: [CWNP Certified Wireless Network Administrator Official Study Guide: Exam CWNA-109], page 403; [Role-Based Access Control (RBAC) in Wireless Networks], page 1.

The two IEEE amendments that should be supported to provide the management frame protection and fast secure roaming security features are 802.11r and 802.11w12.

802.11r (Fast BSS Transition): This amendment to the IEEE 802.11 standard permits continuous connectivity aboard wireless devices in motion, with fast and secure client transitions from one Basic Service Set to another1.

802.11w (Management Frame Protection): This amendment increases the security of its management frames2.

An advantage of using WPA3-Personal instead of WPA2-Personal as a security solution for 802.11 networks is that WPA3-Personal, also called WPA3-SAE, uses a stronger authentication exchange to better secure the network. WPA3-Personal uses Simultaneous Authentication of Equals (SAE) as the key exchange protocol, which provides stronger protection against offline dictionary attacks and password guessing than WPA2-Personal. SAE uses a Diffie-Hellman key exchange with elliptic curve cryptography (ECC) to establish a pairwise master key (PMK) between the AP and the client without revealing it to any eavesdropper. SAE also provides forward secrecy, which means that if one PMK is compromised, it does not affect the security of other PMKs. WPA2-Personal uses Pre-Shared Key (PSK) as the key exchange protocol, which is vulnerable to offline brute-force attacks if the passphrase is weak or leaked. Both WPA3-Personal and WPA2-Personal use AES for encryption, so there is no difference in that aspect. WPA3-Personal does not use a different encryption algorithm than WPA2-Personal, but rather a different key exchange protocol. References: [CWNP Certified Wireless Network Administrator Official Study Guide: Exam CWNA-109], page 307; [CWNA: Certified Wireless Network Administrator Official Study Guide: Exam CWNA-109], page 297.

When a station scans for available wireless networks, it listens for beacon frames sent by APs. A beacon frame contains information about the BSS, such as SSID, supported rates, channel, security, etc. The station also measures the signal strength of the beacon frames, which indicates how well the station can communicate with the AP. The signal strength is usually expressed in dBm or RSSI units. The higher the signal strength, the better the connection quality and performance. Therefore, the station can use the signal strength of AP beacons as the primary metric to select the best AP for connectivity to the desired BSS12. References: CWNA-109 Study Guide, Chapter 6: Wireless LAN Devices and Topologies, page 249; CWNA-109 Study Guide, Chapter 6: Wireless LAN Devices and Topologies, page 243.