CWSP-208 CWNP Certified Wireless Security Professional (CWSP) Free Practice Exam Questions (2025 Updated)

In environments where PSK-based authentication (like WPA2-Personal) is still in use due to legacy device constraints:

C. Regularly changing static passwords helps limit exposure from credential leaks or previous employees retaining access.

Incorrect:

A. MSCHAPv2 is vulnerable to offline attacks; recommending strong passwords is good, but that alone isn’t sufficient.

B. WEP is insecure regardless of password strength due to IV reuse.

D. Certificates are stronger, but not always feasible for legacy systems.

E. EAP-TLS is ideal but not always compatible with all devices; policies should be flexible to device capabilities.

EAP-TLS requires both server and client-side digital certificates, which adds complexity in client certificate management.

EAP-TTLS uses a server certificate to establish a secure TLS tunnel, after which user credentials (e.g., username/password) are sent inside the encrypted tunnel. No client certificate is needed.

Incorrect:

A. EAP-TLS also encrypts credentials using TLS.

B. EAP-TLS supports client certificates (it’s the core requirement).

C. Both EAP methods require an authentication server.

A strong WLAN security policy should encompass both technical controls and user education.

C. Educating users about secure password creation and acceptable use policies helps reduce risks due to weak authentication and misuse.

E. Social engineering is a common attack vector, and educating users to recognize and report such attempts is critical.

Incorrect:

A. MAC addresses are always transmitted in the clear, even with encryption.

B. Policies should be shared with users to promote compliance and awareness.

D. Passwords for administrative systems should not be disclosed in public documentation or policy documents.

Secure configuration of network devices requires encrypted management protocols:

HTTPS: Provides secure web-based GUI access using TLS encryption.

SSHv2: Provides secure CLI access using encrypted channels.

Incorrect:

A. SNMPv1 is not secure — lacks encryption and authentication.

C. Telnet sends credentials and commands in clear text.

D. TFTP is used for file transfer without encryption or authentication.

E. FTP is also insecure—transmits credentials in plain text.

The GTK (Group Temporal Key) is used to encrypt multicast/broadcast traffic.

Each SSID has a unique GTK.

Only clients on the same SSID (ABCData) will receive and be able to decrypt multicast traffic encrypted with ABCData’s GTK.

Incorrect:

A. Application-layer authentication does not affect GTK distribution.

C. Clients on other SSIDs (e.g., Guest, ABCVoice) have different GTKs and cannot decrypt ABCData’s multicast traffic.

D. Each SSID uses a unique GTK; GTKs are not shared across SSIDs.

In public hotspots like coffee shops, the best way to reduce legal risk is to require users to acknowledge an Acceptable Use Policy (AUP) via a captive portal before granting network access. This approach:

Provides a legally binding acknowledgment that users agree not to misuse or engage in criminal activity

Maintains an open venue while limiting liability

Other options, like using WPA2-Enterprise or blocking ports, are either impractical for public use or ineffective at reducing underlying legal exposure.