CWNA-109 CWNP Certified Wireless Network Administrator Free Practice Exam Questions (2025 Updated)

An advantage of using WPA3-Personal instead of WPA2-Personal as a security solution for 802.11 networks is that WPA3-Personal, also called WPA3-SAE, uses a stronger authentication exchange to better secure the network. WPA3-Personal uses Simultaneous Authentication of Equals (SAE) as the key exchange protocol, which provides stronger protection against offline dictionary attacks and password guessing than WPA2-Personal. SAE uses a Diffie-Hellman key exchange with elliptic curve cryptography (ECC) to establish a pairwise master key (PMK) between the AP and the client without revealing it to any eavesdropper. SAE also provides forward secrecy, which means that if one PMK is compromised, it does not affect the security of other PMKs. WPA2-Personal uses Pre-Shared Key (PSK) as the key exchange protocol, which is vulnerable to offline brute-force attacks if the passphrase is weak or leaked. Both WPA3-Personal and WPA2-Personal use AES for encryption, so there is no difference in that aspect. WPA3-Personal does not use a different encryption algorithm than WPA2-Personal, but rather a different key exchange protocol. References: [CWNP Certified Wireless Network Administrator Official Study Guide: Exam CWNA-109], page 307; [CWNA: Certified Wireless Network Administrator Official Study Guide: Exam CWNA-109], page 297.

An IBSS is used instead of a BSS is a network configuration that would result in multiple stations broadcasting Beacon frames with the same BSSID but with different source addresses. An IBSS (Independent Basic Service Set) is a type of WLAN that does not use an AP but rather allows stations to communicate directly with each other in a peer-to-peer manner. An IBSS is also known as an ad-hoc network or a peer-to-peer network. In an IBSS, each station generates its own Beacon frames to announce its presence and capabilities to other stations within range. The Beacon frames have the same BSSID, which is randomly generated by one of the stations when creating the IBSS, but they have different source addresses, which are the MAC addresses of each station’s radio interface. The BSSID is used to identify the IBSS and prevent stations from joining other IBSSs with different BSSIDs. References: , Chapter 1, page 25; , Section 1.1

DHCP (Dynamic Host Configuration Protocol) is the network service where option 43 must be configured to allow access points to locate controllers. DHCP is a protocol that allows a device to obtain an IP address and other network configuration parameters from a server. In a wireless controller scenario, the access points can use DHCP to request an IP address from a DHCP server, which can also provide the IP address or hostname of the wireless controller as an option in the DHCP response. Option 43 is a vendor-specific option that can be used to encode custom information for different types of devices. For example, Cisco access points can use option 43 to receive the IP address of the wireless controller from the DHCP server, while Aruba access points can use option 43 to receive the hostname of the wireless controller from the DHCP server. This way, the access points can discover the wireless controller and establish a connection with it. References: 1, Chapter 8, page 309; 2, Section 5.2

A high-density deployment is a wireless network that is designed to support a large number of users and devices in a relatively small area. This type of deployment is often used in enterprise environments, such as offices, schools, and hospitals.

The use of semi-directional antennas in the deployment described in the question is a good indication that it is a high-density deployment. Semi-directional antennas can be used to focus the signal from an access point in a specific direction. This can help to reduce interference and improve performance in high-density environments.

The other answer choices are less likely to be correct for the following reasons:

SOHO (small office/home office) deployments are typically smaller and less complex than high-density deployments.

Residential deployments are typically even smaller and less complex than SOHO deployments.

Standard office deployments may be high-density, but they may also be lower-density.

It is important to note that the type of deployment is not determined solely by the output power of the access points. However, the use of 10 mW of output power on the 2.4 GHz radios and 20 mW of output power on the 5GHz radios is also consistent with a high-density deployment.

Here are some additional tips for deploying a high-density wireless network:

Use a site survey to determine the optimal placement of access points.

Configure the access points to use non-overlapping channels.

Use semi-directional or directional antennas to focus the signal and reduce interference.

Implement a wireless intrusion prevention system (WIPS) to detect and mitigate rogue access points and other security threats.

SAE (Simultaneous Authentication of Equals) is required when operating 802.11ax APs in the 6 GHz band using passphrase-based authentication. SAE is a secure and robust authentication method that is defined in the IEEE 802.11s amendment and is also known as WPA3-Personal or WPA3-SAE. SAE is based on a cryptographic technique called Dragonfly Key Exchange, which allows two parties to establish a shared secret key using a passphrase, without revealing the passphrase or the key to an eavesdropper or an attacker. SAE also provides forward secrecy, which means that if the passphrase or the key is compromised in the future, it does not affect the security of past communications.

SAE is required when operating 802.11ax APs in the 6 GHz band using passphrase-based authentication because of the new regulations and standards that apply to this band. The 6 GHz band is a new frequency band that was opened for unlicensed use by the FCC and other regulatory bodies in 2020. The 6 GHz band offers more spectrum and less interference than the existing 2.4 GHz and 5 GHz bands, which can enable higher performance and efficiency for Wi-Fi devices. However, the 6 GHz band also has some restrictions and requirements that are different from the other bands, such as:

The 6 GHz band is divided into two sub-bands: U-NII-5 (5925-6425 MHz) and U-NII-7 (6525-6875 MHz). The U-NII-5 sub-band is subject to DFS (Dynamic Frequency Selection) rules, which require Wi-Fi devices to monitor and avoid using channels that are occupied by radar systems or other primary users. The U-NII-7 sub-band is not subject to DFS rules, but it has a lower maximum transmit power limit than the U-NII-5 sub-band.

The Wi-Fi devices that operate in the 6 GHz band are called 6E devices, which stands for Extended Spectrum. 6E devices must support 802.11ax technology, which is also known as Wi-Fi 6 or High Efficiency (HE). 802.11ax is a new standard that improves the performance and efficiency of Wi-Fi networks by using features such as OFDMA (Orthogonal Frequency Division Multiple Access), MU-MIMO (Multi-User Multiple Input Multiple Output), BSS Coloring, TWT (Target Wake Time), and HE PHY and MAC enhancements.

The 6E devices that operate in the 6 GHz band must also support WPA3 security, which is a new security protocol that replaces WPA2 and provides stronger encryption and authentication for Wi-Fi networks. WPA3 has two modes: WPA3-Personal and WPA3-Enterprise. WPA3-Personal uses SAE as its authentication method, which requires a passphrase to establish a secure connection between two devices. WPA3-Enterprise uses EAP (Extensible Authentication Protocol) as its authentication method, which requires a certificate or a credential to authenticate with a server.

Therefore, SAE is required when operating 802.11ax APs in the 6 GHz band using passphrase-based authentication because it is part of WPA3-Personal security, which is mandatory for 6E devices in this band. References: , Chapter 3, page 120; , Section 3.2

9of30

Channel 144 is a new channel that was added to the 5 GHz band by the 802.11ac amendment, which defines the VHT (Very High Throughput) PHY for WLANs. Channel 144 has a center frequency of 5720 MHz and a bandwidth of 20 MHz. It can also be combined with adjacent channels to form wider channels of 40 MHz, 80 MHz, or 160 MHz. Channel 144 is available in some regions, such as North America and Europe, but not in others, such as Japan and China . References: [CWNA-109 Study Guide], Chapter 3: Antennas and Accessories, page 121; [CWNA-109 Study Guide], Chapter 3: Antennas and Accessories, page 115; [Wikipedia], List of WLAN channels.

Fade Margin is an additional pad of signal strength designed into the RF system to compensate for unpredictable signal fading. It is the difference between the receiver’s sensitivity and the actual received signal level. A higher Fade Margin indicates a more robust link that can withstand interference, attenuation, or other factors that may reduce the signal strength. A lower Fade Margin means that the link is more susceptible to failure or performance degradation. Fade Margin is usually expressed in decibels (dB) and can be calculated by subtracting the receiver sensitivity from the received signal level. References: 1, Chapter 2, page 51; 2, Section 2.1

VHT stands for Very High Throughput, which is a physical layer (PHY) specification that supports the 5 GHz frequency band and supports 80 MHz channels. VHT is used by the IEEE 802.11ac standard, which is also known as Wi-Fi 5. VHT allows for higher data rates and more spatial streams than the previous HT (High Throughput) PHY, which is used by the IEEE 802.11n standard, also known as Wi-Fi 4. HT supports the 2.4 GHz and 5 GHz bands, but only supports up to 40 MHz channels12

The other options are not correct because:

ERP (option C) stands for Extended Rate PHY, which is a physical layer specification that supports the 2.4 GHz frequency band and supports up to 20 MHz channels. ERP is used by the IEEE 802.11g standard, which is also known as Wi-Fi 3. ERP allows for higher data rates than the previous DSSS (Direct Sequence Spread Spectrum) PHY, which is used by the IEEE 802.11b standard, also known as Wi-Fi 234

OFDM (option D) stands for Orthogonal Frequency Division Multiplexing, which is a modulation technique that divides a signal into multiple subcarriers that are spaced orthogonally to each other. OFDM is not a physical layer specification, but a common feature of many PHY specifications, including ERP, HT, and VHT. OFDM allows for higher spectral efficiency and robustness against multipath interference than the previous CCK (Complementary Code Keying) modulation technique used by DSSS34

The feature of 802.11ax (HE) that provides this functionality is OFDMA. OFDMA stands for Orthogonal Frequency Division Multiple Access and is a technology that allows multiple devices to communicate simultaneously on the same channel in the same BSS. OFDMA works by dividing a channel into smaller subchannels called Resource Units (RUs), which are composed of groups of subcarriers or tones. Each RU can be assigned to a different device based on its bandwidth requirement and signal quality. This way, OFDMA can increase the efficiency and capacity of the channel by reducing overhead, contention, and latency. OFDMA can also support both uplink and downlink multi-user transmissions using trigger frames and buffer status reports. 6 GHz support, TWT, and Wi-Fi-LTE are not features of 802.11ax that provide this functionality. References: [CWNP Certified Wireless Network Administrator Official Study Guide: Exam CWNA-109], page 226; [CWNA: Certified Wireless Network Administrator Official Study Guide: Exam CWNA-109], page 216.

OFDM is a modulation method that divides the channel bandwidth into multiple subcarriers, each carrying a single data symbol. This allows for higher data rates and more robust transmissions in multipath environments. OFDM was first introduced in the 802.11a standard, which operates in the 5 GHz band and supports data rates up to 54 Mbps. Later, the 802.11g standard adopted OFDM for the 2.4 GHz band, and the 802.11n and 802.11ac standards enhanced OFDM with features such as MIMO (Multiple Input Multiple Output), channel bonding, and higher-order modulation schemes to achieve data rates up to 600 Mbps and 6.9 Gbps, respectively. These standards are collectively known as the ERP (Extended Rate PHY), HT (High Throughput), and VHT (Very High Throughput) PHYs . References: [CWNA-109 Study Guide], Chapter 4: Radio Frequency Signal and Antenna Concepts, page 163; [CWNA-109 Study Guide], Chapter 4: Radio Frequency Signal and Antenna Concepts, page 157.

Authenticated and Unassociated. According to one of the web search results1, a STA can be authenticated to multiple APs, but it can only be associated to one AP at a time. Association is the process of establishing a logical link between the STA and the AP, which allows the STA to send and receive data frames through the AP2. Therefore, when a STA has authenticated to an AP-1, but still maintains a connection with another AP-2, it means that the STA is authenticated to both APs, but only associated to AP-2. The state of the STA on AP-1 is authenticated and unassociated, which means that the STA can switch to AP-1 without repeating the authentication process, but it cannot send or receive data frames through AP-1 until it becomes associated.

 The data rate of a signal is the speed that the data bits in individual 802.11 data frames are sent, but it does not account for the actual amount of data that can be transmitted over time. The throughput of a connection is the flow of information over time, which is affected by various factors such as data encoding, modulation, encryption, airtime utilization, noise levels, interference, etc. Therefore, the throughput is always lower than the data rate. According to one of the web search results1, the actual throughput is normally 60-70 percent of the supported data rates. So, for a connection with a data rate of 150 Mbps, the expected throughput would be around 90-105 Mbps.

The authentication method that is referenced in the 802.11-2016 and 802.11-2020 specifications and is recommended for robust WLAN client security is 802.1X/EAP. 802.1X/EAP stands for IEEE 802.1X Port-Based Network Access Control with Extensible Authentication Protocol and is a framework that provides strong authentication and dynamic encryption key generation for WLAN clients. 802.1X/EAP involves three parties: the supplicant (the client), the authenticator (the AP or the controller), and the authentication server (usually a RADIUS server). The supplicant sends its credentials (such as username and password, certificate, or token) to the authenticator, which forwards them to the authentication server. The authentication server verifies the credentials and sends a response to the authenticator, which grants or denies access to the supplicant. The authentication server also generates a master key that is used to derive encryption keys for the data frames between the supplicant and the authenticator. 802.1X/EAP supports various EAP methods that offer different levels of security and flexibility, such as EAP-TLS, EAP-PEAP, EAP-TTLS, EAP-FAST, and EAP-SIM. SSL, IPSec, and WEP are not authentication methods, but rather encryption or security protocols that are not specific to WLANs or referenced in the 802.11 specifications. References: [CWNP Certified Wireless Network Administrator Official Study Guide: Exam CWNA-109], page 299; [CWNA: Certified Wireless Network Administrator Official Study Guide: Exam CWNA-109], page 289.

In the 2.4 GHz frequency band used for 802.11 wireless networks, the channel bandwidth is typically 20 MHz, but the actual frequency spread of each channel is about 22 MHz due to the modulation techniques used. This spread causes overlap between adjacent channels, which can lead to interference and degrade network performance. To avoid this, it's essential to use non-overlapping channels.

The three non-overlapping channels in the 2.4 GHz band are 1, 6, and 11. Each of these channels is spaced sufficiently apart to avoid interference with each other:

Channel 1: Centered at 2.412 GHz.

Channel 6: Centered at 2.437 GHz.

Channel 11: Centered at 2.462 GHz.

Given the options provided, option C (1 and 5) is the closest to a pair of non-overlapping channels, although in practice, channel 5 would still cause some interference with channel 1 due to the 22 MHz spread. The ideal choice for non-overlapping channels would be any two channels among 1, 6, and 11, but this is not an option provided. Therefore, within the given options, 1 and 5 are the best choice, understanding that in a real-world scenario, 1 and 6 or 6 and 11 would be preferred to avoid overlap.

An ACK (Acknowledgement) frame is a short control frame that is sent by the receiver of a data or management frame to confirm that the frame was received correctly. The ACK frame is sent after a SIFS (Short Interframe Space) interval, which is the shortest time gap between frames in 802.11. If the transmitter does not receive an ACK frame within a specified time, it assumes that the frame was not delivered and must be retransmitted. This is part of the 802.11 reliability mechanism that ensures reliable data delivery over an unreliable wireless medium . References: [CWNA-109 Study Guide], Chapter 5: IEEE 802.11 Medium Access, page 209; [CWNA-109 Study Guide], Chapter 5: IEEE 802.11 Medium Access, page 203.