CWNP Updated CWSP-208 Exam Questions and Answers by bjorn

EAP-MD5:

Only authenticates the client.

Does not provide mutual authentication, making it vulnerable to man-in-the-middle attacks.

It also does not protect the user’s identity or credentials in a secure tunnel.

Incorrect:

A. The outer identity concept is not relevant to EAP-MD5 since it doesn’t support tunneling.

B. EAP-MD5 is a valid EAP type, just insecure.

D. It can be used with a RADIUS server, but security is insufficient.

A. 802.11w (now part of 802.11-2012) introduces protection for management frames, especially disassociation and deauthentication frames, helping prevent spoofing-based DoS attacks. However, it cannot prevent all types of Layer 2 DoS (e.g., RF jamming).

D. Specifically, 802.11w protects disassociation and deauthentication frames by signing them with cryptographic keys.

Incorrect:

B. The MAC header and PHY preamble are not encrypted under any standard.

C. Authentication and association frames are not protected by 802.11w; only certain management frames are.

Most integrated Wi-Fi adapters in Windows laptops are not capable of entering “monitor mode” or capturing 802.11ac frames properly. Compatibility with protocol analyzers like Wireshark or Omnipeek requires special drivers or specific USB adapters. Therefore, it is recommended to use a USB adapter known to support monitor mode and frame capture on 802.11ac for accurate and complete data capture.

Incorrect:

A. Not all adapters support protocol analyzer features.

C. MU-MIMO support is irrelevant for frame capture.

D. Other analyzers besides Wireshark can decode 802.11ac (e.g., Omnipeek).

E. Remote capture is not the only method—local USB adapters are effective too.

The frame sequence described shows:

802.11 Open System authentication and association

DHCP communication (for IP configuration)

ISAKMP packets, which are part of IPSec (used for key exchange and tunnel negotiation)

This indicates that link-layer authentication is not used, but instead, higher-layer encryption (IPSec VPN) secures communications.

Incorrect:

A and C. Would show EAP negotiation and 802.1X authentication frames.

D. WPA2-Personal would include a 4-Way Handshake before DHCP.

E. EAP-MD5 does not involve ISAKMP and is used within 802.1X authentication.