New CWSP-208 Test Materials & Valid CWSP-208 Test Engine
CWSP-208 Updated Exam Dumps [2025] Practice Valid Exam Dumps Question
CWNP CWSP-208 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 60
Given: Your network implements an 802.1X/EAP-based wireless security solution. A WLAN controller is installed and manages seven APs. FreeRADIUS is used for the RADIUS server and is installed on a dedicated server named SRV21. One example client is a MacBook Pro with 8 GB RAM.
What device functions as the 802.1X/EAP Authenticator?
- A. MacBook Pro
- B. RADIUS server
- C. SRV21
- D. WLAN Controller/AP
Answer: D
Explanation:
Comprehensive Detailed Explanation:
In the 802.1X/EAP framework:
The Authenticator is the device that controls access to the network - typically the AP or WLAN controller.
The Authenticator passes EAP messages between the Supplicant (client) and the Authentication Server (RADIUS).
Incorrect:
A). SRV21 is the RADIUS server (Authentication Server), not the Authenticator.
C). The MacBook Pro is the Supplicant.
D). RADIUS server handles Authentication, not Authenticator functionality.
References:
CWSP-208 Study Guide, Chapter 4 (802.1X Architecture Roles)
CWNP AAA and Authentication Design
NEW QUESTION # 61
Select the answer option that arranges the numbered events in the correct time sequence (first to last) for a client associating to a BSS using EAP-PEAPv0/MSCHAPv2.
1. Installation of PTK
2. Initiation of 4-way handshake
3. Open system authentication
4. 802.11 association
5. 802.1X controlled port is opened for data traffic
6. Client validates server certificate
7. AS validates client credentials
- A. 4-3-2-7-6-1-5
- B. 5-3-4-2-6-7-1
- C. 3-4-7-6-5-2-1
- D. 3-4-6-7-2-1-5
- E. 6-1-3-4-2-7-5
- F. 4-3-5-2-7-6-1
Answer: F
Explanation:
When compliance reporting and forensic analysis are required and the WLAN vendor's centralized management system does not provide it, deploying a dedicated overlay WIPS is the most effective solution.
Overlay WIPS uses dedicated sensors independent of the WLAN's operational radios, offering detailed threat detection, compliance logging, and reporting capabilities that often surpass native WLAN features.
References:
CWSP-208 Study Guide, Chapter 7 - Overlay vs Integrated WIPS
CWNP CWSP-208 Objectives: "Compliance Monitoring and Forensics"
NEW QUESTION # 62
ABC Company uses the wireless network for highly sensitive network traffic. For that reason, they intend to protect their network in all possible ways. They are continually researching new network threats and new preventative measures. They are interested in the security benefits of 802.11w, but would like to know its limitations.
What types of wireless attacks are protected by 802.11w? (Choose 2)
- A. Layer 2 Disassociation attacks
- B. Social engineering attacks
- C. Robust management frame replay attacks
- D. RF DoS attacks
Answer: A,C
Explanation:
802.11w, also known as Protected Management Frames (PMF), is designed to protect specific types of 802.11 management frames such as disassociation and deauthentication frames. These frames were previously sent unencrypted and could be spoofed by attackers to disconnect clients (DoS attacks). With 802.11w, these frames are cryptographically protected, mitigating such attacks.
PMF also includes replay protection for these management frames, preventing attackers from capturing and replaying them to disrupt network connectivity.
References:
CWSP-208 Study Guide, Chapter 6 (Wireless LAN Security Solutions)
IEEE 802.11w-2009 amendment
CWNP Whitepapers on PMF and Management Frame Protection
NEW QUESTION # 63
As a part of a large organization's security policy, how should a wireless security professional address the problem of rogue access points?
- A. Hide the SSID of all legitimate APs on the network so that intruders cannot copy this parameter on rogue APs.
- B. Enable port security on Ethernet switch ports with a maximum of only 3 MAC addresses on each port.
- C. Conduct thorough manual facility scans with spectrum analyzers to detect rogue AP RF signatures.
- D. Use a WPA2-Enterprise compliant security solution with strong mutual authentication and encryption for network access of corporate devices.
- E. A trained employee should install and configure a WIPS for rogue detection and response measures.
Answer: E
Explanation:
Rogue APs pose a significant risk and should be detected and mitigated automatically.
D). A properly configured Wireless Intrusion Prevention System (WIPS) can detect unauthorized APs and prevent client associations to them in real time.
Incorrect:
A). While WPA2-Enterprise adds client-level protection, it does not detect rogue APs.
B). Hiding SSIDs is ineffective-SSIDs are still discoverable in management frames.
C). Manual scans are labor-intensive and impractical for ongoing monitoring.
E). Port security controls wired threats but cannot detect rogue APs using wireless signals.
References:
CWSP-208 Study Guide, Chapter 6 (Wireless Intrusion Prevention Systems) CWNP Rogue Detection Strategies
NEW QUESTION # 64
While performing a manual scan of your environment using a spectrum analyzer on a laptop computer, you notice a signal in the real time FFT view. The signal is characterized by having peak power centered on channel 11 with an approximate width of 20 MHz at its peak. The signal widens to approximately 40 MHz after it has weakened by about 30 dB.
What kind of signal is displayed in the spectrum analyzer?
- A. A frequency hopping device is being used as a signal jammer in 5 GHz
- B. A low-power wideband RF attack is in progress in 2.4 GHz, causing significant 802.11 interference
- C. An 802.11a AP operating normally in 5 GHz
- D. An 802.11g AP operating normally in 2.4 GHz
Answer: D
Explanation:
An 802.11g AP uses a 20 MHz-wide channel centered around a specific frequency (e.g., channel 11 at 2.462 GHz). On a spectrum analyzer:
The signal will peak at the center frequency with high power.
The width of approximately 20 MHz at peak and extending to 40 MHz as it drops 30 dB is typical for OFDM- based transmissions (802.11g uses OFDM).
Incorrect:
A). Frequency hopping is characteristic of Bluetooth and looks different on the spectrum (bursty, narrow signals that shift rapidly).
B). A wideband attack would appear more constant and not centered like a normal AP.
D). 802.11a operates in the 5 GHz band, not channel 11 (which is 2.4 GHz).
References:
CWSP-208 Study Guide, Chapter 6 (RF Analysis and Interference)
CWNP RF Spectrum Interpretation Guide
NEW QUESTION # 65
What is a primary criteria for a network to qualify as a Robust Security Network (RSN)?
- A. Dynamic WEP-104 encryption must be enabled.
- B. WLAN controllers and APs must not support SSHv1.
- C. WEP may not be used for encryption.
- D. Token cards must be used for authentication.
- E. WPA-Personal must be supported for authentication and encryption.
Answer: C
Explanation:
A Robust Security Network (RSN) is defined by the IEEE 802.11i standard and is designed to provide a framework for secure wireless LAN communications. One of the primary criteria for a network to qualify as an RSN is that WEP (Wired Equivalent Privacy) must not be used for encryption, as WEP has well-known vulnerabilities and is considered insecure. RSN-compliant networks must use either CCMP (AES) or GCMP for encryption and 802.1X/EAP or WPA2-Personal for authentication.
Incorrect:
A). Token cards are not part of RSN criteria.
B). Dynamic WEP is still WEP and disqualifies RSN status.
D). WPA-Personal may be supported, but alone does not define an RSN.
E). SSHv1 concerns device management security, not RSN qualification.
References:
CWSP-208 Study Guide, Chapter 3 (Robust Security Networks)
IEEE 802.11i Standard
CWNP Exam Objectives: Security Standards and Protocols
NEW QUESTION # 66
You have been recently hired as the wireless network administrator for an organization spread across seven locations. They have deployed more than 100 APs, but they have not been managed in either an automated or manual process for more than 18 months. Given this length of time, what is one of the first things you should evaluate from a security perspective?
- A. The channels in use
- B. The VLANs in use
- C. The firmware revision
- D. The channel widths configured
Answer: C
Explanation:
In a security context, outdated firmware is one of the most critical vulnerabilities. Firmware updates typically patch known security issues, fix bugs, and provide new features or improved encryption support. If the APs have not been updated or checked in over 18 months, they could be running firmware with known exploits or lacking critical security patches, making firmware review a top priority.
References:
CWSP-208 Study Guide, Chapter 8 - WLAN Security Lifecycle and Maintenance CWNP CWSP-208 Objectives: "Firmware and Security Patch Management"
NEW QUESTION # 67
Given: John Smith uses a coffee shop's Internet hot-spot (no authentication or encryption) to transfer funds between his checking and savings accounts at his bank's website. The bank's website uses the HTTPS protocol to protect sensitive account information. While John was using the hot-spot, a hacker was able to obtain John's bank account user ID and password and exploit this information.
What likely scenario could have allowed the hacker to obtain John's bank account user ID and password?
- A. John uses the same username and password for banking that he does for email. John used a POP3 email client at the wireless hot-spot to check his email, and the user ID and password were not encrypted.
- B. John accessed his corporate network with his IPSec VPN software at the wireless hot-spot. An IPSec VPN only encrypts data, so the user ID and password were sent in clear text. John uses the same username and password for banking that he does for his IPSec VPN software.
- C. John's bank is using an expired X.509 certificate on their web server. The certificate is on John's Certificate Revocation List (CRL), causing the user ID and password to be sent unencrypted.
- D. The bank's web server is using an X.509 certificate that is not signed by a root CA, causing the user ID and password to be sent unencrypted.
- E. Before connecting to the bank's website, John's association to the AP was hijacked. The attacker intercepted the HTTPS public encryption key from the bank's web server and has decrypted John's login credentials in near real-time.
Answer: A
Explanation:
In this scenario, although the bank's website uses HTTPS (which encrypts communications between John's browser and the bank's server), the compromise did not occur during the banking session itself. Instead, the attacker exploited a common security mistake: credential reuse.
John reused his email credentials for his bank login, and he accessed his email using a POP3 client without encryption at a public hotspot. This means his username and password were sent in cleartext, which is trivially easy to sniff on an open wireless network. Once an attacker obtained those credentials, they could use them to log into his bank account if the same credentials were used there.
Here's how this aligns with CWSP knowledge domains:
* CWSP Security Threats & Attacks: This is a classic example of credential harvesting via cleartext protocols (POP3), and password reuse, both of which are significant risks in WLAN environments.
* CWSP Secure Network Design: Recommends use of encrypted protocols (e.g., POP3S or IMAPS) and user education against password reuse.
* CWSP WLAN Security Fundamentals: Emphasizes that open Wi-Fi networks offer no encryption by default, leaving unprotected protocols vulnerable to sniffing and interception.
Other answer options and why they are incorrect:
* A & D are invalid because an expired or unsigned certificate may cause browser warnings but won't result in sending credentials unencrypted unless the user bypasses HTTPS (which wasn't stated).
* C is incorrect: IPSec VPNs encrypt all data between the client and VPN endpoint-including credentials.
* E is technically incorrect and misleading: intercepting the public key of an HTTPS session doesn't allow decryption of the credentials due to asymmetric encryption and session key security. Real-time decryption of HTTPS traffic without endpoint compromise is not feasible.
References:
CWSP-208 Study Guide, Chapters 3 (Security Policy) and 5 (Threats and Attacks) CWNP CWSP-208 Official Study Guide CWNP Exam Objectives - WLAN Authentication, Encryption, and VPNs CWNP Whitepapers on WLAN Security Practices
NEW QUESTION # 68
ABC Company has deployed a Single Channel Architecture (SCA) solution to help overcome some of the common problems with client roaming. In such a network, all APs are configured with the same channel and BSSID. PEAPv0/EAP-MSCHAPv2 is the only supported authentication mechanism.
As the Voice over Wi-Fi (STA-1) client moves throughout this network, what events are occurring?
- A. STA-1 initiates open authentication and 802.11 association with each AP prior to roaming.
- B. STA-1 controls when and where to roam by using signal and performance metrics in accordance with the chipset drivers and 802.11k.
- C. The WLAN controller is querying the RADIUS server for authentication before the association of STA-
1 is moved from one AP to the next. - D. The WLAN controller controls the AP to which STA-1 is associated and transparently moves this association in accordance with the physical location of STA-1.
Answer: C
Explanation:
An 802.11a/g-based WIPS cannot detect rogue activity that occurs in 802.11n/ac-specific modes, including Greenfield (HT-only) operation and use of 40 MHz channels, which are not part of the 802.11a/g specification. Greenfield mode disables legacy support, so a WIPS limited to 802.11a/g radios won't even
"see" these frames. This leaves a significant blind spot for detecting certain types of rogue devices or attacks using newer PHYs.
References:
CWSP-208 Study Guide, Chapter 7 - WIPS Capabilities and Limitations
CWNP CWSP-208 Objectives: "Protocol Compatibility and Threat Detection"
NEW QUESTION # 69
Given: WLAN attacks are typically conducted by hackers to exploit a specific vulnerability within a network.
What statement correctly pairs the type of WLAN attack with the exploited vulnerability? (Choose 3)
- A. Zero-day attacks are always authentication or encryption cracking attacks.
- B. Hijacking attacks interrupt a user's legitimate connection and introduce a new connection with an evil twin AP.
- C. Association flood attacks are Layer 3 DoS attacks performed against authenticated client stations
- D. Social engineering attacks are performed to collect sensitive information from unsuspecting users
- E. RF DoS attacks prevent successful wireless communication on a specific frequency or frequency range.
- F. Management interface exploit attacks are attacks that use social engineering to gain credentials from managers.
Answer: B,D,E
Explanation:
C). RF DoS attacks use signal jamming or interference to prevent communication.
D). Hijacking uses deauthentication and re-association to force users onto rogue APs.
E). Social engineering uses manipulation to acquire credentials or sensitive information.
Incorrect:
A). Management interface exploit attacks typically involve web or CLI interface vulnerabilities, not social engineering.
B). Zero-day attacks are based on unknown vulnerabilities, not just limited to authentication or encryption.
F). Association flood attacks occur at Layer 2, not Layer 3.
References:
CWSP-208 Study Guide, Chapter 5 (Types of Wireless Attacks)
CWNP Security Essentials - WLAN Threat Matrix
CWNP Whitepapers on Rogue APs and Social Engineering
NEW QUESTION # 70
What policy would help mitigate the impact of peer-to-peer attacks against wireless-enabled corporate laptop computers when the laptops are also used on public access networks such as wireless hot-spots?
- A. Require Port Address Translation (PAT) on each laptop.
- B. Require WPA2-Enterprise as the minimal WLAN security solution.
- C. Require secure applications such as POP, HTTP, and SSH.
- D. Require VPN software for connectivity to the corporate network.
Answer: D
Explanation:
EAP-TLS requires both server and client-side digital certificates, which adds complexity in client certificate management.
EAP-TTLS uses a server certificate to establish a secure TLS tunnel, after which user credentials (e.g., username/password) are sent inside the encrypted tunnel. No client certificate is needed.
Incorrect:
A). EAP-TLS also encrypts credentials using TLS.
B). EAP-TLS supports client certificates (it's the core requirement).
C). Both EAP methods require an authentication server.
References:
CWSP-208 Study Guide, Chapter 4 (EAP Methods Comparison)
CWNP EAP-TTLS Deployment Guide
NEW QUESTION # 71
Given: XYZ Company has recently installed a controller-based WLAN and is using a RADIUS server to query authentication requests to an LDAP server. XYZ maintains user-based access policies and would like to use the RADIUS server to facilitate network authorization.
What RADIUS features could be used by XYZ to assign the proper network permissions to users during authentication? (Choose 2)
- A. RADIUS attributes can be used to assign permission levels, such as read-only permission, to users of a particular network resource.
- B. The RADIUS server can support vendor-specific attributes in the ACCESS-ACCEPT response, which can be used for user policy assignment.
- C. RADIUS can reassign a client's 802.11 association to a new SSID by referencing a username-to-SSID mapping table in the LDAP user database.
- D. RADIUS can send a DO-NOT-AUTHORIZE demand to the authenticator to prevent the STA from gaining access to specific files, but may only employ this in relation to Linux servers.
- E. The RADIUS server can communicate with the DHCP server to issue the appropriate IP address and VLAN assignment to users.
Answer: A,B
Explanation:
Comprehensive Detailed Explanation:
B). Vendor-Specific Attributes (VSAs) allow integration with WLAN vendors' controllers to assign roles, VLANs, QoS levels, etc., during user authentication.
E). Standard or vendor-specific RADIUS attributes can dynamically assign permission levels based on group membership, department, or role.
Incorrect:
A). RADIUS does not directly manage DHCP functions.
C). SSID is selected by the user's device, not by the RADIUS server.
D). RADIUS uses ACCESS-REJECT, not "DO-NOT-AUTHORIZE," and it is not OS-specific.
References:
CWSP-208 Study Guide, Chapter 4 (RADIUS and Policy Assignment)
CWNP RADIUS Deployment Best Practices
NEW QUESTION # 72
After completing the installation of a new overlay WIPS for the purpose of rogue detection and security monitoring at your corporate headquarters, what baseline function MUST be performed in order to identify security threats?
- A. Upstream and downstream throughput thresholds must be specified to ensure that service-level agreements are being met.
- B. WLAN devices that are discovered must be classified (rogue, authorized, neighbor, etc.) and a WLAN policy must define how to classify new devices.
- C. Authorized PEAP usernames must be added to the WIPS server's user database.
- D. Separate security profiles must be defined for network operation in different regulatory domains
Answer: B
Explanation:
After deploying a WIPS, an essential baseline activity is to classify all detected devices in the RF environment. These classifications allow the system to enforce security policies and detect policy violations.
Classifications include:
Authorized (managed devices)
Rogue (unauthorized, possibly dangerous)
Neighbor (not part of your network but legitimate)
External or Ad hoc devices
Without this initial classification, WIPS cannot properly assess threats or trigger alarms.
References:
CWSP-208 Study Guide, Chapter 7 - WIPS Classification and Threat Management CWNP CWSP-208 Objectives: "Device Classification and Policy Enforcement"
NEW QUESTION # 73
Given: WLAN protocol analyzers can read and record many wireless frame parameters.
What parameter is needed to physically locate rogue APs with a protocol analyzer?
- A. BSSID
- B. RSN IE
- C. Noise floor
- D. IP Address
- E. Signal strength
- F. SSID
Answer: E
Explanation:
While BSSID and SSID help identify and classify rogue APs, physically locating them requires using signal strength (often displayed as RSSI or dBm). By measuring signal strength from different locations, administrators can use a method called "triangulation" or "directional analysis" to approximate the physical location of the rogue device.
References:
CWSP-208 Study Guide, Chapter 6 - WLAN Protocol Analysis and Troubleshooting CWNP CWSP-208 Objectives: "Rogue Device Location and Tracking"
NEW QUESTION # 74
You are implementing a wireless LAN that will be used by point-of-sale (PoS) systems in a retail environment. Thirteen PoS computers will be installed. To what industry requirement should you ensure you adhere?
- A. ISA99
- B. Directive 8500.01
- C. HIPAA
- D. PCI-DSS
Answer: D
Explanation:
PCI-DSS (Payment Card Industry Data Security Standard) applies to all entities that process, store, or transmit credit card data. Since Point-of-Sale (PoS) systems handle such transactions in retail environments, the wireless network supporting them must comply with PCI-DSS. This includes encrypting wireless transmissions, segmenting network traffic, and implementing WIPS for rogue detection and logging.
References:
CWSP-208 Study Guide, Chapter 3 - WLAN Policy & Regulatory Compliance
CWNP CWSP-208 Objectives: "Industry Standards & Compliance (e.g., PCI-DSS, HIPAA)"
NEW QUESTION # 75
Given: A WLAN consultant has just finished installing a WLAN controller with 15 controller-based APs.
Two SSIDs with separate VLANs are configured for this network, and both VLANs are configured to use the same RADIUS server. The SSIDs are configured as follows:
SSID Blue - VLAN 10 - Lightweight EAP (LEAP) authentication - CCMP cipher suite SSID Red - VLAN 20 - PEAPv0/EAP-TLS authentication - TKIP cipher suite The consultant's computer can successfully authenticate and browse the Internet when using the Blue SSID.
The same computer cannot authenticate when using the Red SSID.
What is a possible cause of the problem?
- A. The client does not have a proper certificate installed for the tunneled authentication within the established TLS tunnel.
- B. The consultant does not have a valid Kerberos ID on the Blue VLAN.
- C. The TKIP cipher suite is not a valid option for PEAPv0 authentication.
- D. The Red VLAN does not use server certificate, but the client requires one.
Answer: A
Explanation:
PEAPv0/EAP-TLS is a tunneled EAP method that requires:
The server to present a certificate for TLS tunnel establishment.
The client to present a valid client certificate within the tunnel (in the case of EAP-TLS).
If the client does not have a valid X.509 certificate installed, authentication will fail.
Incorrect:
A). The server certificate is required for the TLS tunnel, and it is typically present; the issue here lies with the client cert.
B). TKIP is technically compatible with PEAPv0, although AES-CCMP is preferred.
D). Kerberos is unrelated to EAP authentication and VLAN use.
References:
CWSP-208 Study Guide, Chapter 4 (PEAP and EAP-TLS Authentication)
IEEE 802.1X and TLS Frameworks
NEW QUESTION # 76
What TKIP feature was introduced to counter the weak integrity check algorithm used in WEP?
- A. Block cipher support
- B. 32-bit ICV (CRC-32)
- C. Michael
- D. Sequence counters
- E. RC5 stream cipher
Answer: C
Explanation:
TKIP (used with WPA) introduced "Michael" as a message integrity check (MIC) algorithm to replace the insecure CRC-32 used in WEP. Michael:
Adds tamper protection to each packet.
Helps detect packet forgery.
Incorrect:
A). CRC-32 was used in WEP and proven weak.
B). Sequence counters help prevent replay attacks, not integrity checking.
C). RC5 is not used in WLAN security.
E). TKIP does not support block ciphers-it uses RC4, a stream cipher.
References:
CWSP-208 Study Guide, Chapter 3 (TKIP Security Features)
NEW QUESTION # 77
You are configuring seven APs to prevent common security attacks. The APs are to be installed in a small business and to reduce costs, the company decided to install all consumer-grade wireless routers. The wireless routers will connect to a switch, which connects directly to the Internet connection providing 50 Mbps of Internet bandwidth that will be shared among 53 wireless clients and 17 wired clients.
To ensure the wireless network is as secure as possible from common attacks, what security measure can you implement given only the hardware referenced?
- A. WPA2-Personal
- B. WPA-Enterprise
- C. 802.1X/EAP-PEAP
- D. WPA2-Enterprise
Answer: A
Explanation:
Given that only consumer-grade routers are used and no RADIUS server or enterprise infrastructure is mentioned, WPA2-Personal is the most secure option available. It uses a pre-shared key (PSK) for authentication and AES-CCMP for encryption, offering strong protection for small businesses lacking enterprise equipment.
Enterprise methods such as WPA2-Enterprise, 802.1X, and EAP-PEAP require a RADIUS server or authentication backend, which isn't supported in typical consumer-grade routers.
References:
CWSP-208 Study Guide, Chapter 3 (WLAN Security Technologies)
CWNP Wi-Fi Security Deployment Guide for Small Businesses
CWNP E-Learning Modules: WPA2-PSK vs WPA2-Enterprise
NEW QUESTION # 78
In what deployment scenarios would it be desirable to enable peer-to-peer traffic blocking?
- A. At public hot-spots in which many clients use diverse applications
- B. In corporate Voice over Wi-Fi networks with push-to-talk multicast capabilities
- C. In home networks in which file and printer sharing is enabled
- D. In university environments using multicast video training sourced from professor's laptops
Answer: A
Explanation:
Peer-to-peer blocking (also called client isolation) is useful in open or public WLANs to prevent devices from communicating directly with each other.
B). In public hot-spots, isolating users helps protect against malware spread, snooping, and attacks from nearby devices.
Incorrect:
A). In home networks, peer-to-peer communication is often desired for file sharing.
C). Voice over Wi-Fi may rely on peer communication (e.g., multicast).
D). In university setups using multicast, peer-to-peer restrictions could hinder functionality.
References:
CWSP-208 Study Guide, Chapter 3 (Access Control and WLAN Policies)
CWNP WLAN Best Practices for Public Networks
NEW QUESTION # 79
Given: The ABC Corporation currently utilizes an enterprise Public Key Infrastructure (PKI) to allow employees to securely access network resources with smart cards. The new wireless network will use WPA2- Enterprise as its primary authentication solution. You have been asked to recommend a Wi-Fi Alliance-tested EAP method.
What solutions will require the least change in how users are currently authenticated and still integrate with their existing PKI?
- A. PEAPv0/EAP-MSCHAPv2
- B. LEAP
- C. EAP-TLS
- D. PEAPv0/EAP-TLS
- E. EAP-FAST
- F. EAP-TTLS/MSCHAPv2
Answer: C
Explanation:
ABC Corporation already uses PKI and smart cards. EAP-TLS:
Is a certificate-based authentication protocol.
Integrates seamlessly with PKI infrastructure.
Is supported and certified by the Wi-Fi Alliance.
Incorrect:
A). EAP-FAST uses PACs, not certificates.
C). PEAPv0/EAP-MSCHAPv2 does not use certificates on the client side and is less secure.
D). LEAP is deprecated and insecure.
E). PEAPv0/EAP-TLS is not a standardized combination.
F). EAP-TTLS/MSCHAPv2 requires password-based authentication inside a tunnel, not certificate-based authentication.
References:
CWSP-208 Study Guide, Chapter 4 (EAP-TLS and PKI)
CWNP WPA2-Enterprise Integration Guidelines
NEW QUESTION # 80
What wireless authentication technologies may build a TLS tunnel between the supplicant and the authentication server before passing client authentication credentials to the authentication server? (Choose 3)
- A. EAP-TTLS
- B. EAP-MD5
- C. LEAP
- D. EAP-TLS
- E. PEAPv0/MSCHAPv2
Answer: A,D,E
Explanation:
All three EAP methods - EAP-TLS, PEAPv0, and EAP-TTLS - establish a secure TLS tunnel between the supplicant and the authentication server before client credentials are passed:
B). EAP-TLS uses mutual certificate authentication inside a TLS tunnel.
D). PEAPv0/MSCHAPv2 creates a TLS tunnel and then authenticates the user with MSCHAPv2 inside the tunnel.
E). EAP-TTLS creates a TLS tunnel and then supports legacy credentials (e.g., PAP, CHAP, MSCHAPv2) securely within it.
Incorrect:
A). EAP-MD5 does not use TLS at all.
C). LEAP is not TLS-based and is considered insecure.
References:
CWSP-208 Study Guide, Chapter 4 (TLS-Based EAP Methods)
CWNP EAP Protocol Comparison Matrix
NEW QUESTION # 81
When monitoring APs within a LAN using a Wireless Network Management System (WNMS), what secure protocol may be used by the WNMS to issue configuration changes to APs?
- A. TFTP
- B. SNMPv3
- C. IPSec/ESP
- D. 802.1X/EAP
- E. PPTP
Answer: B
Explanation:
A Wireless Network Management System (WNMS) often uses SNMP to manage APs. SNMPv3 is the secure version of SNMP because it supports authentication, encryption, and message integrity. Unlike SNMPv1 and SNMPv2c, which transmit data (including community strings) in plaintext, SNMPv3 provides secure management communications.
References:
CWSP-208 Study Guide, Chapter 8 - Secure WLAN Management
CWNP CWSP-208 Objectives: "WLAN Management Security Protocols"
NEW QUESTION # 82
A WLAN is implemented using WPA-Personal and MAC filtering.
To what common wireless network attacks is this network potentially vulnerable? (Choose 3)
- A. ASLEAP
- B. DoS
- C. MAC Spoofing
- D. Offline dictionary attacks
Answer: B,C,D
Explanation:
This network uses WPA-Personal (Pre-Shared Key) and MAC filtering. While it does offer some basic protections, it is still vulnerable to several well-known attack vectors:
A). Offline dictionary attacks: An attacker can capture the 4-way handshake and perform offline dictionary or brute-force attacks to guess the PSK.
B). MAC Spoofing: Since MAC filtering is based on easily observed MAC addresses, attackers can spoof an authorized MAC address.
D). DoS: Attacks such as deauthentication floods or RF jamming can deny users access without needing to break encryption.
Incorrect:
C). ASLEAP: This is specific to LEAP (a weak EAP type), which is not used in WPA-Personal.
References:
CWSP-208 Study Guide, Chapter 5 (Threats and Attacks)
CWNP Exam Objectives: WLAN Authentication and Encryption
CWNP Whitepaper on WPA/WPA2 vulnerabilities
NEW QUESTION # 83
......
CWSP-208 Sample with Accurate & Updated Questions: https://dumps4download.actualvce.com/CWNP/CWSP-208-valid-vce-dumps.html