PW0-270_formatted. Number: Passing Score: 800 Time Limit: 120 min File Version: 1.

Transcription

1 PW0-270_formatted Number: Passing Score: 800 Time Limit: 120 min File Version: CWNA PW0-270 Certified Wireless Analysis Professional (CWAP) Version: 5.0 CWNA PW0-270 Exam

2 Exam A QUESTION 1 What HT PPDU format is shown in the exhibit? A. HT-mixed format B. HT-greenfield format C. Non-HT format D. Non-HT duplicate format E. Dual Training Field format F. ERP-OFDM format Correct Answer: A /Reference: QUESTION 2 What is the purpose of a PHY preamble? A. It provides the receiver(s) with an opportunity for RF channel synchronization prior to the start of the PLCP header. B. It communicates important information about the PSDU's length, rate, and upper layer protocol- related parameters. C. It provides a cyclic redundancy check (CRC) for the receiving station to validate that the PLCP header was received correctly. D. It indicates to the PHY the modulation that shall be used for transmission (and reception) of the PSDU. Correct Answer: A /Reference: QUESTION 3 When a 5 GHz HT station in a 40 MHz BSS desires to protect a 40 MHz transmission from an OFDM station using an RTS/CTS or CTS-to-Self exchange, what frame format is used for the RTS and/or CTS frames? A. HT-mixed format B. HT-greenfield format C. Dual-CTS D. Non-HT Duplicate

3 E. Phased Coexistence PPDU Correct Answer: D /Reference: QUESTION 4 What IEEE technology is illustrated by the exhibit? A. Fragmentation B. TCP Fragment Bursting C. A-MSDU D. A-MPDU E. U-APSD F. Jumbo frames Correct Answer: C /Reference: QUESTION 5 Which statements are true regarding Beacons from an AP in an HT infrastructure BSS that is configured with multiple WLAN profiles? (Choose 3)

4 A. Beacons can be disabled for security purposes. B. The BSSID and Source Address are always the same. C. The Destination Address is always FF:FF:FF:FF:FF:FF. D. The Receiver address and the BSSID are always the same. E. When the SSID is "hidden," the ESS subfield of the Capability Information field distinguishes one BSS from another. F. All Beacons generated by APs contain a TIM information element. G. The Beacon interval must be the same for all WLANs (SSIDs) supported by a single AP Correct Answer: BCF /Reference: QUESTION 6 Using the exhibit as a reference, answer the following.

5 STA1 sent a data frame to Mesh AP2 destined for a local file server on the same subnet with MAC address 00:11:22:33:44:55. Mesh AP2's mesh forwarding algorithm determined that the frame should be forwarded through Mesh AP1. In the frame sent from Mesh AP2 to Mesh AP1, what is true of the contents of the MAC header? (Choose 3) A. SA = Mesh AP2's MAC Address B. RA = Mesh AP1's MAC Address C. TA = STA1's MAC Address D. DA = 00:11:22:33:44:55 E. To DS = 0 F. From DS = 1 Correct Answer: BDF /Reference: QUESTION 7 According to , in what frame type(s) might you find the PMK Count and PMKID List fields? A. All frames that include the RSN IE B. Only (Re)Association Request frames C. Beacon and Probe Response frames D. EAPoL 4-Way Handshake frames E. Authentication and Association Request and Response frames Correct Answer: B /Reference: QUESTION 8 Which statement is true regarding the Association Identifier (AID) used in IEEE WLANs? A. The AID has a maximum value of 2048, and is used to uniquely identify a wireless client station associated with an access point. B. The AID has a maximum value of 2007, and resides in the duration/id field of a PS-Poll frame. C. The client station is assigned an AID value in the authentication response frame. D. The AID field is present only in Beacons frames. E. The AID is used by the access point in EDCA mode to reduce duplicate transmissions when sending multicasts. Correct Answer: B /Reference: QUESTION 9 In which frames is the SSID present, provided the SSID is not removed through proprietary software configuration by an administrator? (Choose 3)

6 A. Association Request B. Reassociation Request C. Probe Response D. Disassociation E. Authentication F. Association Response Correct Answer: ABC /Reference: QUESTION 10 In the frame decode shown, there are two sets of supported data rates. 1, 2, 5.5, and 11 Mbps are all shown as "basic" data rates, and 6, 9, 12, 18, 24, 36, 48, and 54 Mbps are shown simply as supported data rates.

7 What is true of "basic" data rates in this context? A. The AP requires all client stations to support Basic rates in order to associate to its BSS. B. The highest data rate set to Basic is automatically used to send broadcast traffic such as Beacon frames. C. Basic rates are optional data rates for the BSS, often used for assuring connectivity for legacy stations. D. Basic rates are only used for multicast traffic, and do not affect unicast traffic. E. Basic rates are defined in an AP's service set to specify mandatory data rates for all retry frames. Correct Answer: A /Reference: QUESTION 11

8 Given the frame capture and the decode shown, after which Beacons in the list shown (as indicated by the frame number in the leftmost column) would multicast traffic have been sent in this infrastructure BSS if multicast traffic had been queued for transmission at the access point? (Choose 2) A. Framenumber 49 B. frame number 50 C. frame number 51 D. frame number 53 E. frame number 54 F. frame number 55 G. frame number 57 Correct Answer: CF

9 /Reference: QUESTION 12 The Retry subfield is found in which IEEE frame field? A. Sequence Control field B. Protocol Order field C. Data Control field D. Frame Control field E. MAC Service Data Unit field F. QoS Control field Correct Answer: D /Reference: QUESTION 13 Which information elements (IE) are contained in an IEEE Probe Request frame? (Choose 2) A. RSN IE B. SSID C. Status code D. Association ID E. Supported rates Correct Answer: BE /Reference: QUESTION 14 According to the IEEE standard, what is one structural difference between a MAC Protocol Data Unit (MPDU) and a MAC Management Protocol Data Unit (MMPDU)? A. The MPDU frame's FCS field is 4 bytes, while the MMPDU frame's FCS field is 8 bytes. B. The MMPDU frame body is limited to 300 bytes, whereas the MPDU frame body can carry up to 2304 bytes. C. The MPDU header always places the BSSID in the first address field, but in the MMPDU the BSSID can be found in any of the address fields. D. An MMPDU header may only contain three address fields, but an MPDU may have four address fields. E. Both the MPDU and MMPDU have a QoS Control (QC) field, but all bits of the MMPDU's QC field are always 0. Correct Answer: D /Reference: QUESTION 15

10 Which parameters accurately describe the Beacon Interval field in the Beacon frame? (Choose 2) A. Value can range from 0 to 2007 B. 4-octet length C. Indicates the exact time interval between Beacon transmissions D. Indicates the desired time interval between TBTTs E. Measured in time units of 1024 µs Correct Answer: DE /Reference: QUESTION 16 The IEEE Dynamic Frequency Selection (DFS) service is capable of performing what functions? (Choose 2) A. Establishing an interference baseline on all 2.4 GHz channels B. Using modulation switching techniques to avoid interfering with radar systems C. Testing channels for radar before using a channel and while operating in a channel D. Suspending operations on a channel with high IEEE co-channel interference E. Requesting and reporting of measurements in the current and other channels Correct Answer: CE /Reference: QUESTION 17 Which statements regarding an IEEE Channel Switch Announcement frame are true? (Choose 2) A. Channel Switch Announcement frames use the Action frame body format. B. Channel Switch Announcement frames are the only place where the Channel Switch Announcement element is found. C. Channel Switch Announcement frames are transmitted and retransmitted on a channel until all associated STAs successfully move to the new channel. D. Channel Switch Announcement elements may be carried in Beacon management frames. E. In an infrastructure BSS, Channel Switch Announcement frames may be transmitted by either the AP or an associated STA. Correct Answer: AD /Reference: QUESTION 18 An HT STA does not receive an ACK for a first-attempt data frame that it transmitted. Assuming this STA is not using BlockAcks in this case, what happens to the HT STA's EDCA contention window? A. The slot time within the contention window decreases by 50%. B. It varies because the backoff algorithm is random. C. The contention window approximately doubles in size. D. The contention window is not affected by failed Data frame delivery.

11 E. The contention window is immediately closed, and the frame is retransmitted. Correct Answer: C /Reference: QUESTION 19 What two IEEE entities may be used to separate successful transmissions within an EDCA TXOP? (Choose 2) A. SIFS B. AIFS C. ACK D. CAP E. PIFS F. EIFS G. RIFS Correct Answer: AG /Reference: QUESTION 20 How long, in microseconds, is the required Slot Time that is announced by an AP in an HT BSS when HR/ DSSS, ERP-OFDM, and HT-OFDM client stations are associated to the AP? A. 2 µs B. 4 µs C. 9 µs D. 10 µs E. 20 µs Correct Answer: E /Reference: QUESTION 21 Which statements accurately describe IEEE EDCA collision handling in a WMM-compliant infrastructure WLAN? (Choose 2) A. When frames collide within a QoS STA, data frames from lower priority ACs behave (as it relates to contention) as if there were an external collision on the wireless medium. B. Collisions between contending EDCAFs within a QoS STA are resolved within the QoS STA C. When a frame transmission on the wireless medium fails, the transmitter may not transmit another frame from any AC or to any destination until the frame experiencing a failure is successfully transmitted or the max retry count for that frame is reached. D. The WMM specification requires use of RTS/CTS as part of the EDCAF within each QoS STA to avoid internal collisions between ACs. E. After frames collide within a QoS STA and the lower priority AC subsequently gains a TXOP, the retry bit in the MAC header must be set to 1 to indicate a retry.

12 Correct Answer: AB /Reference: QUESTION 22 What must occur before an HT STA operating in an EDCA BSS can transmit a data frame over the wireless medium? (Choose 3) A. Its NAV must be equal to one. B. The STA must receive a BlockAck, resetting the NAV to zero. C. The appropriate interframe space must expire. D. The backoff timer for the AC must equal zero. E. Its CCA must report that the medium is idle. F. The AP must issue the STA a TXOP. Correct Answer: CDE /Reference: QUESTION 23 In the analyzer trace shown, the TBTT is nominally milliseconds. Why does the Beacon transmission interval vary? A. The access point must arbitrate to gain access to the RF medium in order to transmit a Beacon. B. The DCF Interframe space (DIFS) is nominally 50 µs, but typically varies by as much as 10 µs, which causes delays in Beacons. C. This trace shows an HT network where HR/DSSS nodes are active on the network. The access point is

13 changing slot times from short to long as needed. D. Beacon frames vary in size, and therefore some take slightly longer to send than others. Correct Answer: A /Reference: QUESTION 24 Which statements are true regarding wireless network discovery and scanning processes for an HT network? (Choose 2) A. Client stations may continually send Probe Request frames on all HT channels in the 2.4 GHz ISM band in a consecutive manner, regardless of their association state. B. Access points send Beacon frames on all HT channels in the 2.4 GHz ISM band in a consecutive manner including the channel for which the access point is configured. C. Client stations send Probe Request frames on all HT channels in the 2.4 GHz ISM band in a consecutive manner until they associate with an access point. After associating to an access point, they no longer transmit Probe Request frames. D. Access points send Beacon frames only on the HT channel in the 2.4 GHz ISM band for which the access point is configured, and only after scanning that channel to discover existing BSSs. E. Client stations send Probe Request frames on all HT channels in the 2.4 GHz ISM band in a consecutive manner until they receive at least 3 Probe Response frames. Correct Answer: AD /Reference: QUESTION 25 Which statements are true regarding frame acknowledgement in an IEEE WLAN? (Choose 3) A. Following non-qos Data frames with the More Fragments bit set to 1, the Duration/ID field of the ACK frame is set to a value equal to two SIFS plus the next Data fragment and its ACK. B. A client station's Reassociation Request frames are only acknowledged with a Reassociation Response from the access point and not with an ACK frame. C. Probe request acknowledgement (sending of a Probe Response frame) is configurable in the access point and is always linked to SSID broadcast configuration in Beacons. D. In an EDCA BSS, encrypted Data frames are only acknowledged by client stations, never by access points. E. Data frame fragments are acknowledged individually (with an ACK frame). F. The RA field of ACK frames is always obtained from the Address 2 field in the corresponding frame being acknowledged. Correct Answer: AEF /Reference: QUESTION 26 When an originator QoS STA initiates a BlockAck agreement with a recipient QoS STA, what is the first frame sent by the originator?

14 A. BlockAckSetupReq B. BlockAckReq C. ADDBA Request D. BlockAckPolicyReq E. ActionBAReq Correct Answer: C /Reference: QUESTION 27 In an HT WLAN in which a delayed Block Ack policy is set up, what should result when an ACK frame is not received by the originator in response to a Basic BlockAckReq? A. All frames within that block must be retransmitted by the originator. B. The last frame within that block must be retransmitted by the originator. C. The BlockAckReq must be retransmitted by the originator. D. Nothing. No ACK is expected in response to a Basic BlockAckReq. Correct Answer: C /Reference: QUESTION 28 According to the n-2009 amendment, what security requirement is specified for HT BSSs? A. In an RSN, HT stations may not communicate with one another using TKIP. B. TKIP cannot be supported in an HT BSS. C. All unicast traffic transmitted by an HT station and destined to an HT station must use AES- CCMP. D. HT BSSs are prevented from supporting WEP. E. HT BSSs must mandatorily support r FT. Correct Answer: A /Reference: QUESTION 29 The r-2008 amendment to the specification introduces what new Information Elements (IEs) to facilitate fast BSS transitions? (Choose 2) A. RSN IE (Robust Security Network) B. FSR IE (Fast Secure Roaming) C. HT IE (High Throughput) D. MD IE (Mobility Domain) E. FT IE (Fast Transition) F. DS IE (Distribution System) Correct Answer: DE

15 /Reference: QUESTION 30 To effect Preauthentication, a STA's supplicant sends an IEEE 802.1X/EAPoL Start message. How is the EAPoL Start message addressed? A. DA = MAC of default gateway; RA = BSSID of the AP to which the STA is associated B. DA = BSSID of targeted AP; RA = BSSID of the AP to which the STA is associated C. DA = MAC of the default gateway; RA = Ethernet MAC of the targeted AP D. DA = BSSID of the targeted AP; RA = Ethernet MAC of the targeted AP Correct Answer: B /Reference: QUESTION 31 Which statement accurately describes IEEE Power Save operation in a Basic Service Set that does not support the QoS facility? A. Following a period of time in a low power state, client stations wake themselves and automatically poll the access point for traffic using a PS-Poll frame. B. When the access point's buffer is full, the access point wakes all client stations using a PS-Poll frame so that they can receive the data. C. Upon receiving traffic for a dozing station, the access point wakes the client station using a PS- Poll frame so that the client station can receive the data. D. After waking from a low power state, client stations listen for the next Beacon to determine if sending a PS-Poll frame to the access point is necessary. E. After waking at a scheduled TBTT, client stations send Null Function frames to the access point with the Power Management bit set back to zero. Correct Answer: D /Reference: QUESTION 32 Given: Your network consists of HT and ERP access points, and you are implementing VoWiFi with support for U-APSD. When an ERP handset operating in WMM Power Save mode with a ReceiveDTIMs parameter of TRUE receives a Beacon containing a DTIM indicating queued broadcast traffic, what task is the handset required to perform? A. The handset must send a PS-Poll frame to the access point for every broadcast frame it receives with the More Data bit set to one. B. The handset must arbitrate for the medium and immediately issue an RTS directed to the access point with the NAV set to a value of 32,768. C. The handset must broadcast a CTS-to-Self frame indicating the station's need to control the medium long enough to receive all of the broadcast frames. D. The handset is to remain awake to receive the broadcast frame(s) following the Beacon that contains the DTIM.

16 Correct Answer: D /Reference: QUESTION 33 WMM-PS trigger frames can be what type of IEEE frames? (Choose 2) A. QoS Null B. Reassociation C. QoS Data D. CTS E. QoS Action F. PS-Poll Correct Answer: AC /Reference: QUESTION 34 IEEE specifies two ERP protection mechanisms: RTS/CTS and CTS-to-Self. Which statement is true regarding these two protection mechanisms? (Choose 2) A. RTS and CTS frames use Short Interframe Spaces (SIFS), and CTS-to-Self frames use PCF Interframe Spaces (PIFS). B. Use of RTS/CTS requires more overhead than CTS-to-Self due to a higher number of frames transmitted onto the wireless medium. C. RTS and CTS frames are relayed through the access point, whereas the CTS-to-Self frames are not. D. A CTS-to-Self frame sent by a client station may reach fewer nodes than the RTS/CTS frame exchange. E. By definition, all associated client stations in a BSS can hear RTS, CTS, and CTS-to-Self frames, so RTS/CTS and CTS-to-Self mechanisms have equal effectiveness. F. Aside from the Subtype subfield of the Frame Control field, the generic MAC header format of RTS and CTS frames are identical. Correct Answer: BD /Reference: QUESTION 35 As it pertains to HT L-SIG TXOP Protection, what statement is true? A. Support for L-SIG TXOP Protection is indicated by HT stations in the L-SIG field of the PLCP header of HT-mixed format frames. B. Support for L-SIG TXOP Protection is indicated in the HT Capabilities Info field of (re)association request frames sent by ERP, OFDM, and HT-OFDM stations. C. An L-SIG TXOP protected frame exchange sequence always begins with an RTS/CTS or a CTS-to-Self. D. L-SIG TXOP Protection is specified for the purpose of protecting OFDM (802.11a/g) and HT- OFDM (802.11n) transmissions from HR/DSSS stations. Correct Answer: C

17 /Reference: QUESTION 36 When a client station operating under EDCA sends an RTS frame and NAV protection is desired for only the first or sole frame in the TXOP, the duration field will contain an amount of time, measured in microseconds, equal to which of the following? A. 1 RTS, 2 ACK, 1 DATA, 4 SIFS B. 1 CTS, 1 ACK, 1 DATA, 3 SIFS C. 1 RTS, 1 ACK, 1 DATA, 2 SIFS, 1 DIFS D. 1 RTS, 1 CTS, 2 ACK, 1 DATA, 4 SIFS E. 1 CTS, 2 ACK, 1 DATA, 2 SIFS F. The entire duration of the TXOP Correct Answer: B /Reference: QUESTION 37 Many access points support IEEE 802.1Q VLAN tagging. When analyzing a WLAN system using IEEE 802.1Q tags, where can the VLAN tag number be seen? A. In the Sequence Control field of the MSDU B. In the PLCP header's Service field C. In the Frame Control field of the MPDU header D. In the Ethernet header on the wired port of the access point E. In the Beacon Management frame's Capabilities fixed field Correct Answer: D /Reference: QUESTION 38 With what access category's parameters are WLAN multicast video frames transmitted when the EDCAF is in use by the transmitting station? A. AC_VI B. AC_VO C. AC_BE D. AC_BK Correct Answer: C /Reference: QUESTION 39 What is indicated to a QoS AP when a QoS STA sets U-APSD Flag bits to 1 in (Re) Association frames?

18 A. Which access categories are both trigger-enabled and delivery-enabled B. Which user priorities require use of a TSPEC C. Which access categories require admission control D. Which user priorities are mapped to access categories E. Which access categories are scheduled Correct Answer: A /Reference: QUESTION 40 Your wireless network troubleshooting kit includes an antenna with the following specifications: Gain: 5 dbi Azimuth Beamwidth: 55 degrees Elevation Beamwidth: 50 degrees Frequency Range: GHz and GHz Polarization: Linear Impedance: 50 Ohms For what aspect of network troubleshooting would this antenna be most useful? A. Capturing BSS-wide CRC error and retry statistics in most indoor WLAN environments B. Identifying problems with Fresnel zone clearance in long range (10+ miles / 16+ km) point-to- point links C. Finding the physical location of an interfering transmitter to identify and remove the source D. Increasing resolution bandwidth (RBW) on a spectrum analyzer to improve signature identification features E. Matching transmit and receive capabilities for most client stations to reproduce client reception issues Correct Answer: C /Reference: QUESTION 41 Given: The exhibit shows a small network environment with dual-band APs.

19 What is true of the network shown in this spectrum analyzer trace? A. There are at least three APs operating in this environment. They are operating on channels 149, 153, and 161. B. There are two 40 MHz BSSs in this environment. One AP has some 40 MHz traffic while the other AP has no client traffic. C. Only one AP in this network is configured to use the upper UNII band (UNII-3). All other APs are in lower 5 GHz channels. D. Two a APs are near the spectrum analyzer and are heavily utilized on channels 149 and 153. Correct Answer: B /Reference: QUESTION 42 Given: ABC Company recorded the 2.4 GHz band with a spectrum analyzer prior to installing their ERP WLAN. Image-A is how the band appeared prior to the WLAN installation. Image-B is how the band

20 appears now, and all channels on their WLAN have ceased to function. What is the best explanation as to why their WLAN is no longer functioning properly? A. A wideband RF power source is corrupting all IEEE transmissions. B. A new microwave oven was installed in the cafeteria. C. A malfunctioning IEEE OFDM radio card is transmitting continuously. D. A manual site survey tool is actively testing the throughput of their WLAN. E. A Terminal Doppler Weather Radar (TDWR) is causing a DFS response across the entire band. Correct Answer: A /Reference: QUESTION 43 What types of wireless systems are illustrated?

21 A. An ERP IEEE system using channel 6 and Bluetooth v1.2 discovery B. A Bluetooth v2.0 file transfer and a 40 MHz HT AP on channels 11, 7 (primary, secondary) C. A 2.4 GHz cordless phone on channel 14 and a wireless RFID reader D. An HR/DSSS system using channel 2 and a digital FHSS phone Correct Answer: A /Reference: QUESTION 44 Given: The graphic is taken from a spectrum analyzer.

22 What types of RF transmitters are illustrated? A. An IEEE HR/DSSS security camera on channel 6 and an RFID tag B. A Bluetooth headset and a narrowband RF jamming device C. A 2.4 GHz cordless phone and an OpenAir FHSS system D. A 20 MHz HT IEEE system using channel 1 and a microwave oven Correct Answer: D /Reference: QUESTION 45 Given: Before installing a Wi-Fi network, ABC Company performed a spectrum analysis looking for problems. The 2.4 GHz RF spectrum looked like Image-A. After installing an ERP WLAN, ABC Company performed another spectrum analysis during business hours. The 2.4 GHz RF spectrum then looked like

23 Image-B close to an AP on channel 1. Now the 2.4 GHz RF spectrum looks like Image-C and access points and clients can no longer communicate on channel 1. What is happening on channel 1? A. The access point's antenna connectors have been tampered with, causing "spike and shear" RF transmissions that are not compatible with the OFDM PHY format. For that reason, client devices cannot receive the AP's transmissions without error. B. A high-power, narrowband RF interference source on channel 1 is causing the CCA energydetects(ed) function on devices to indicate a busy medium because the signal source is above the ED threshold. C. Stronger transmissions from licensed 2.4 GHz users, such as HAM operators, are compressing the transmissions from the channel 1 access points into the lower portion of the band. D. The shape of the signals in images B and C indicates that a licensed user in this frequency range has enabled the "guard bands" in an effort to restrict local interference with other systems. E. Detection of a DFS radar event has discontinued operation on channel 1, but the access point's Channel Switch Announcement frame cannot be sent due to the presence of radar. Correct Answer: B /Reference: QUESTION 46 As it relates to a spectrum analyzer, complete the following sentence. The plot always displays the percentage of time (shown on the Y axis) that the overall RF power is a certain specified threshold (of amplitude) above the noise floor for a given frequency range (shown on the X axis). A. Real-Time FFT B. Swept Spectrogram C. FFT Duty Cycle D. Interferer Count E. SNR Correct Answer: C /Reference:

24 QUESTION 47 Using the exhibit as a reference, which spectrum plots display, in real time, the value of RF amplitude as a function of radio frequency? A. 1 and 2 B. 1 and 3 C. All of the plots D. 1, 3, and 4 E. 3 and 4 Correct Answer: B /Reference:

25 QUESTION 48 As shown in the exhibit, a spectrum analyzer has measured both and non RF transmissions in the 2.4 GHz band. The exhibit shows a continuous video transmitter near channel 5. Based upon the exhibit, what impact does the video transmitter have on WLAN operations throughout the band? A. The video transmitter is preventing WLAN operation on channel 6, and has only a minor impact on channels 1 and 11. B. The video transmitter has made no impact on WLAN operation in the band. C. The video transmitter is preventing all WLAN transmissions in the band. D. The video transmitter is preventing all WLAN transmissions on channel 6, and its impact on channels 1 and 11 is severe. Correct Answer: A

26 /Reference: QUESTION 49 What MAC layer information will a dual-band n protocol analyzer capture if it is capturing data frames encrypted with WPA2-Enterprise? (Choose 2) A. Source IP Address B. Null Data frames C. TCP SYN datagram D. Short Interframe Spaces E. Sequence Control fields F. Legacy Signal field Correct Answer: BE /Reference: QUESTION 50 ABC Company is having VoWiFi latency problems on their g WLAN. A wireless administrator has noticed in the phone's client utilities software that the MAC CRC Error count is higher on stations with problems than on those client stations without problems. A high MAC CRC Error count is attributable to which of the following? (Choose 3) A. High collision rates due to dense population of voice stations and no admission control B. Two access points with overlapping coverage on a single channel C. High multipath conditions due to an RF environment with highly reflective materials D. 2.4 GHz ISM band interference from sources such as wireless video cameras and analog phones E. Co-located DCF and EDCA access points that are using non-overlapping 2.4 GHz channels F. Dynamic Rate Switching algorithms that decrease data rates for latency-sensitive applications Correct Answer: ACD /Reference: QUESTION 51 While at a government-operated facility, you are attempting to troubleshoot a WLAN performance problem using a wireless protocol analyzer. When you start capturing frames, you see a proprietary layer 2 protocol running over the ERP network as shown in this screenshot. The facility's WLAN administrator confirms that this protocol is proprietary and used for both data encryption and compression.

27 How will this information affect the steps you take to troubleshoot performance problems on this WLAN? A. The proprietary encryption protocol will have no effect on your troubleshooting steps because the wireless protocol analyzer can still decode the PLCP and MAC headers of Data frames. This situation is essentially no different than troubleshooting a WLAN that uses WPA2-Personal. B. Troubleshooting will be somewhat limited because only part of the information needed for performance measurements by the analyzer is encrypted. Each Data frame's MAC header will be encrypted, but the PLCP header can still be decoded successfully. C. As long as you load the proprietary software codec onto your analyzer computer, you will be able to see all of the Data frame information fully decoded. Loading the proprietary software codec will allow you to troubleshoot the WLAN as though no encryption were in use. D. In order to troubleshoot performance problems on a network using proprietary encryption protocols like this one, you must use a wireless protocol analyzer that has integrated support for the protocol in use. Correct Answer: A /Reference: QUESTION 52 Given: Shown are frames captured from an IEEE 802.1X/LEAP authentication. This WLAN is a Robust Security Network (RSN) using the CCMP cipher suite.

28 Using the information given in the screenshot, calculate how long it takes for only the frames that are part of the 4-Way handshake to complete. A ms B ms C ms D ms E ms Correct Answer: B /Reference: QUESTION 53 ABC Company's WLAN administrator is getting complaints from one user that his WLAN throughput is sluggish compared to other users in his area. The administrator takes his diagnostics laptop, which has a wireless protocol analyzer installed, to the area where the complaining user works. The administrator uses the PING utility to test connectivity from the complaining user's wireless client station to another wireless client station across the closest access point, while capturing the wireless frames. The administrator sees what is displayed in this screenshot.

29 From this screenshot, which statements can you conclude to be TRUE that are related to the complaining user's throughput problem? (Choose 2) A. The complaining user's WLAN client utilities are configured with a small fragmentation threshold. B. The complaining user's station is retransmitting fragments many times likely due to nearby RF interference. C. The access point and other stations are using ERP-OFDM modulation, and the complaining user's wireless client station is using HR/DSSS modulation. D. The complaining user's wireless client station should be using RTS/CTS as a protection mechanism, but it is not. E. The access point is not signaling for protection (Protection = no) in the Beacons, but it should be. Correct Answer: AC /Reference: QUESTION 54 Given: There are many differences between analyzing wireless and wired networks. In a wireless network, there is no guarantee that one station can hear another station's transmissions. If no corrective actions are taken nor corrective mechanisms implemented when a "hidden node" problem exists, which measurable statistics parameter will likely increase in a wireless protocol analyzer? A. Duration value B. Retransmission Count C. Contention Window

30 D. Authentication Failure E. BlockAck Reset F. ACK Timeout Correct Answer: B /Reference: QUESTION 55 When standard compliant AES-CCMP security is being used with IPSec/ESP for layered security, what will a WLAN protocol analyzer see as the security mechanism in use when a user browses to an HTTPS secured web page? A. AES-CCMP B. IPSec/ESP C. SSLv3 D. AES-CCMP and IPSec/ESP E. AES-CCMP, IPSec/ESP, AND SSLv3 Correct Answer: A /Reference: QUESTION 56 Given the IEEE Beacon frame decode shown,

31 determine which statement is definitively true. A. The access point is operating on channel 3. B. The access point has both 1 Mbps and 2 Mbps configured as basic rates. C. This Beacon frame came from an ERP or HT access point. D. The SSID value in this Beacon is null. E. ERP mobile stations must use the RTS/CTS protocol before Data transmissions. Correct Answer: C /Reference: QUESTION 57 Given the screenshot shown,

32 Choose the statement that accurately describes what is being seen by this protocol analyzer. A. Three access points are on the same channel in the same physical area. B. A Single Channel Architecture (SCA) WLAN solution has three WLAN profiles configured C. One access point is using the round robin Beacon feature. D. Three wireless stations are participating in an Ad Hoc WLAN. Correct Answer: D /Reference: QUESTION 58 Shown is a screenshot of a wireless protocol analyzer displaying the decode information for a single encrypted data + CF-Poll frame. The infrastructure BSS on which this information was captured is using WEP and this particular frame was sent from a client station (STA) to an access point (AP).

33 As a protocol analyst, how would you explain the existence of this frame on the wireless medium given the information in the decode? A. The IEEE network is using both version 1 and version 2 protocols simultaneously. This unexpected frame is from the version 2 protocol set. B. The frame was sent by a client station that does not comply with IEEE HR/DSSS standard to an access point that is Wi-Fi certified. C. The access point is operating as a repeater, and clients must poll repeater access points in order to transmit data frames through them. D. The frame was misinterpreted because of insufficient information received by the analyzer due to frame corruption. Correct Answer: D /Reference: QUESTION 59 As a WLAN consultant, you have been asked to troubleshoot a problem with a single wireless client station (Station-Z). Your customer informs you that other wireless client stations are not having problems with wireless connectivity, and that Station-Z is configured in the same manner as all other wireless client stations on the network. Station-Z is showing an unusually high retransmission count in its client utility statistics. Using a wireless protocol analyzer, where and how should you begin troubleshooting this problem? (Choose 2) A. Position the analyzer halfway between Station-Z and the access point. Measure the distance between

34 Station-Z and the access point. B. Position the analyzer near Station-Z. Analyze Station-Z's transmissions and acknowledgements. Look for RF and obstacle-induced interference. C. Position the analyzer near the access point. See if Station-Z's frames are reaching the access point and if so, analyze their signal strength. D. Position the analyzer near Station-Z. Analyze the frames Station-Z is receiving, looking for delayed ACK frames. E. Position the analyzer halfway between Station-Z and the access point. Analyze the data rate at which frames are sent and how long they take to be received. Correct Answer: BC /Reference: QUESTION 60 Why is a high CRC error rate in L2 protocol analysis software NOT always a valid indicator of network performance? (Choose 3) A. If protocol analysis software is not properly configured with frame decryption parameters, it can't accurately calculate a CRC, which includes the encrypted frame body contents. B. If the protocol analysis radio hardware is not located in the same area as intended client devices or APs, its data sampling may not be representative of actual traffic on the network. C. Radio and antenna hardware used for protocol analysis may not match the receive sensitivity, diversity, MIMO, or antenna gain capabilities of the network WLAN hardware. D. Layer 2 protocol analysis can only collect and interpret data that is received properly at the MAC layer, and cannot quantify some PHY-layer problems. Correct Answer: BCD /Reference: