Pass the CWNP CWSP CWSP-208 Questions and answers with ExamsMirror

Without proper staging, change management, and installation procedures, significant vulnerabilities may arise:

(B) WIPS relies on a known database of authorized APs and clients. If devices are deployed without proper registration and staging, WIPS cannot accurately classify devices as authorized, rogue, or neighbor.

(D) If APs are installed without changing default credentials, attackers can exploit them through common web or SNMP-based management interfaces.

This undermines both operational visibility and network security posture.

While BSSID and SSID help identify and classify rogue APs, physically locating them requires using signal strength (often displayed as RSSI or dBm). By measuring signal strength from different locations, administrators can use a method called "triangulation" or "directional analysis" to approximate the physical location of the rogue device.

For troubleshooting fast roaming (e.g. 802.11r) across channels, a portable protocol analyzer with dual- or multi-band 802.11n adapters enables:

Simultaneous packet capture on different channels

Capturing handoff-related frames and timing analysis in roaming scenarios

This setup allows detailed capture of reassociation, authentication, and 4-Way Handshake processes, essential for diagnosing roaming delays.

Other options (WIPS, spectrum analyzer, autonomous AP) do not support detailed 802.11 frame capture across multiple channels during roaming events.

WIPS systems provide proactive security by continuously scanning for threats and ensuring WLAN policy compliance. Their capabilities include:

B. Wireless vulnerability assessment: Scanning for misconfigured APs, weak encryption, and unauthorized devices.

E. Policy enforcement and compliance: Ensuring security settings adhere to enterprise or regulatory requirements and alerting on deviations.

Other options like application-layer inspection and AP CPU monitoring are outside the WIPS function scope.

An 802.11a/g-based WIPS cannot detect rogue activity that occurs in 802.11n/ac-specific modes, including Greenfield (HT-only) operation and use of 40 MHz channels, which are not part of the 802.11a/g specification. Greenfield mode disables legacy support, so a WIPS limited to 802.11a/g radios won’t even “see” these frames. This leaves a significant blind spot for detecting certain types of rogue devices or attacks using newer PHYs.

A WIPS (Wireless Intrusion Prevention System) is designed to monitor WLAN activity and provide visualization and reporting related to:

Security threats (e.g., DoS attacks, rogue devices)

Policy compliance (e.g., allowed SSIDs, encryption types)

Rogue threat classification (e.g., rogue, neighbor, ad hoc)

The dashboard displaying this type of security-centric overview is characteristic of a WIPS platform.

The AKM (Authentication and Key Management) Suite List field within the RSN Information Element defines which authentication methods are supported by the AP. This field distinguishes between PSK (Pre-Shared Key) and Enterprise (802.1X) modes:

AKM Suite OUI 00-0F-AC:1 = WPA2-Personal (PSK)

AKM Suite OUI 00-0F-AC:2 = WPA2-Enterprise (802.1X)

By examining this field in Beacon or Probe Response frames, a protocol analyzer can determine the authentication method enforced by the BSS.

WIPS systems often enforce policies based on MAC addresses and associated hardware fingerprints. If Joe uses a different wireless adapter than the one authorized, it may trigger a rogue device or unauthorized client alarm—even if it’s the same laptop. This behavior is common in environments with strict WIPS enforcement policies.

When compliance reporting and forensic analysis are required and the WLAN vendor’s centralized management system does not provide it, deploying a dedicated overlay WIPS is the most effective solution. Overlay WIPS uses dedicated sensors independent of the WLAN’s operational radios, offering detailed threat detection, compliance logging, and reporting capabilities that often surpass native WLAN features.

EAP-TLS requires both server and client-side digital certificates, which adds complexity in client certificate management.

EAP-TTLS uses a server certificate to establish a secure TLS tunnel, after which user credentials (e.g., username/password) are sent inside the encrypted tunnel. No client certificate is needed.

Incorrect:

A. EAP-TLS also encrypts credentials using TLS.

B. EAP-TLS supports client certificates (it’s the core requirement).

C. Both EAP methods require an authentication server.