CWAP-404 Practice Questions

The IEEE 802.11 Physical (PHY) layer is responsible for the transmission and reception of data over the wireless medium. During the transmission process, the PHY layer receives the PHY Service Data Unit (PSDU) from the MAC sublayer. It then prepends a PHY-specific preamble and header to this PSDU to construct the PHY Protocol Data Unit (PPDU), which is the final format transmitted over the air. Conversely, during reception, the PHY layer detects and decodes the incoming PPDU from the wireless medium, strips off the preamble and header, and passes the resulting PSDU up to the MAC sublayer for further processing.

A: This option incorrectly reverses the data flow for transmissions; the PHY layer creates PPDUs from PSDUs, not the other way around.

B: The PHY layer does not directly process the MAC Service Data Unit (MSDU); the MSDU is handled by the MAC sublayer above the PHY.

C: This option is incorrect as it reverses the transmission process and confuses the data units involved at the PHY and MAC layers.

1. IEEE Std 802.11™-2020 (Revision of IEEE Std 802.11-2016), IEEE Standard for Information Technology—Telecommunications and Information Exchange between Systems—Local and Metropolitan Area Networks—Specific Requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications.

Section 17.2.1, "PHY functional description," Paragraph 1: "The PHY receives the PHY service data unit (PSDU) from the MAC sublayer and appends a PHY-specific preamble and header to create the PHY protocol data unit (PPDU)."

Figure 4-4, "MAC and PHY data units": This diagram visually depicts the relationship, showing the MAC passing a PSDU to the PHY, which then forms a PPDU.

2. Perahia, E., & Stacey, R. (2013). Next Generation Wireless LANs: 802.11n and 802.11ac (2nd ed.). Cambridge University Press.

Chapter 2, Section 2.2, "The 802.11 Architecture," Page 15: "The MAC passes a frame, called the physical layer service data unit (PSDU), to the PHY. The PHY adds its own header and preamble to create the physical layer protocol data unit (PPDU)."

3. Stanford University, CS244: Advanced Topics in Networking, Winter 2013. Lecture Slides: "The 802.11 MAC and PHY Layers" by Nick McKeown.

Slide 11, "Frame Encapsulation": The diagram clearly illustrates the data flow from an IP Packet (MSDU) to an 802.11 Frame (MPDU/PSDU) at the MAC layer, which is then encapsulated into a PPDU at the PHY layer for transmission.

A capture visualization tool, also known as a protocol analyzer, is specifically designed to open packet capture files (e.g., .pcap, .pcapng) and interpret the 802.11 protocol data within them. For a user with limited protocol knowledge, these tools are invaluable as they translate raw frame data into human-readable formats and provide high-level statistical analysis, graphs, and expert systems. Features like airtime utilization charts, retry rate graphs, and conversation analysis allow for an effective evaluation of network health and performance without requiring the user to manually decode every frame.

A. Spectrum analyzer: This tool analyzes Layer 1 RF energy in the frequency domain. It does not open or interpret Layer 2 packet capture files.

B. Python: While Python can be used with libraries to parse capture files, it is a programming language, not a ready-to-use analysis tool. It requires significant expertise to write scripts for meaningful analysis.

D. WLAN scanner: This tool is used for discovering live wireless networks and their basic parameters (e.g., SSID, RSSI). It does not analyze the contents of a pre-existing packet capture file.

1. Coleman, D. D., & Westcott, D. A. (2021). CWAP Certified Wireless Analysis Professional Study Guide: Exam CWAP-404 (4th ed.). Wiley.

Chapter 2, "The Protocol Analyzer," explicitly details the function of protocol analyzers (a primary type of capture visualization tool) like Wireshark and OmniPeek. It states, "A protocol analyzer is a tool used to capture and analyze signals and data traffic over a communication channel... The analyzer translates the raw data into a human-readable format" (p. 31). This directly supports the use of such a tool for the user's goal.

2. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Chapter 6, "The Wireless and Mobile Network," in the section on 802.11, often includes labs or discussions on using Wireshark to analyze 802.11 frame captures. The text explains how these tools display frame fields, sequence numbers, and other protocol elements, which are the basis for performance analysis. For example, the Wireshark labs associated with the text demonstrate how to filter and visualize captured traffic to understand network behavior.

3. Stanford University. (n.d.). CS244 - Advanced Topics in Networking.

Course materials and projects frequently involve the use of packet capture and analysis tools to diagnose network performance issues. Lecture notes on "Network Measurement and Troubleshooting" typically differentiate between active probing tools, passive measurement (packet capture), and the software (like Wireshark, tcpdump) used to visualize and analyze the captured data, emphasizing their role in performance evaluation.

The primary function of 802.11 Management frames is to establish, maintain, and terminate sessions within a Basic Service Set (BSS). These frames are not used for carrying user data but are essential for the lifecycle of a wireless connection. Key examples include Beacon frames for announcing a network's presence, Probe Request/Response frames for discovering networks, Authentication and Association frames for joining a network, and Disassociation/Deauthentication frames for leaving a network. Collectively, these functions constitute the management of the BSS.

A. Prioritize network administration traffic: Traffic prioritization is a Quality of Service (QoS) function, which is primarily handled by fields within 802.11 Data frames, not by Management frames.

B. Communicate configuration changes between WLAN controller and APs: This communication typically occurs over the wired distribution system using a specific protocol like CAPWAP, not through standard 802.11 Management frames over the air.

D. Manage the flow of data: Managing the flow of data on the wireless medium, including access contention and acknowledgments, is the role of 802.11 Control frames (e.g., RTS, CTS, ACK).

1. IEEE Std 802.11™-2020. (2020). IEEE Standard for Information Technology—Telecommunications and Information Exchange between Systems Local and Metropolitan Area Networks—Specific Requirements Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications. In Section 9.2.4, "Management frames," it states, "Management frames are used for the management of the MAC sublayer." The subsequent subsections (9.2.4.1 through 9.2.4.19) detail frames like Beacons, Probes, and Association, all of which manage the BSS.

2. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 7, Section 7.3.2, "The IEEE 802.11 MAC Protocol," the text distinguishes the three frame types, explaining that Management frames are used for "associating and disassociating with an AP."

3. Stanford University. (2019). CS144: Introduction to Computer Networking, Lecture 15: Wireless. Retrieved from https://web.stanford.edu/class/cs144/lectures/15-wireless.pdf. On slide 21, the lecture notes explicitly state that Management frames are used to "join and leave networks, and to move associations from one AP to another," which are core functions of managing a BSS.

According to the IEEE 802.11 standard, an Information Element (IE) consists of an Element ID, a Length field, and a variable-length data field. The SSID IE (Element ID 0) is used to convey the network name. When a Basic Service Set (BSS) is configured to not broadcast its SSID, a practice commonly referred to as "hiding the SSID" or creating a "closed network," the Access Point (AP) transmits Beacon frames where the SSID IE is present, but its Length field is set to 0. This indicates a null SSID, effectively preventing passive scanners from discovering the network name from Beacons. This is a valid and standard configuration, not an error or an attack.

A. The frame is not corrupted; a zero-length SSID is a valid configuration defined by the IEEE 802.11 standard for non-broadcasting SSIDs.

B. SSID elements have a length of 1 to 32 octets when the SSID is being broadcast; a length of 0 is specific to hidden SSIDs.

C. This describes a type of cyberattack on databases, which is entirely unrelated to the 802.11 frame structure or SSID management at the MAC sublayer.

1. IEEE Std 802.11™-2020 (Revision of IEEE Std 802.11-2016), IEEE Standard for Information Technology—Telecommunications and Information Exchange between Systems—Local and Metropolitan Area Networks—Specific Requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications.

Section 9.4.2.2, "SSID element": This section defines the format of the SSID element, specifying that the Length field can be a value from 0 to 32.

Section 11.1.3.2.1, "Beacon frame generation": This section explicitly states, "If the network is a 'closed network,' the SSID field in the SSID element is set to 0 octets in length and the AP does not respond to a Probe Request frame that contains a broadcast SSID."

2. Van der Merwe, J., & Pienaar, J. (2013). Practical 802.11ac and 802.11n security analysis. School of Computing, University of South Africa.

Section 3.1.1, "Beacon Frames": The paper notes, "If the SSID is hidden, the SSID information element length field is set to zero." This is discussed in the context of network discovery and security analysis. (Available via university repository and academic databases).

3. University of Virginia, Department of Computer Science. CS4450/CS5450: Computer Networks, Lecture 10: Wireless LANs.

In typical courseware covering 802.11 frame analysis, lecture slides explain that a zero-length SSID in a Beacon frame is the mechanism for implementing a "hidden" or "closed" network, requiring clients to know the SSID to initiate a connection.

The Listen Interval field is a value set by a client station (STA) in its Association Request frame. It informs the Access Point (AP) of the maximum number of Beacon intervals the STA will sleep before waking to listen for a Beacon frame. The AP uses this value to determine its buffer management strategy for that specific STA. If the AP has buffered unicast frames for a sleeping STA, it indicates this in the Traffic Indication Map (TIM) of its Beacon frames. The STA wakes periodically, as defined by its Listen Interval, to check the TIM and retrieve its data.

A: The duration a STA listens for Probe Responses during active scanning is determined by the MinChannelTime and MaxChannelTime parameters, not the Listen Interval.

B: Off-channel scanning for discovering other Basic Service Sets (BSSs) is a function related to roaming or network discovery, not the power-save mechanism defined by the Listen Interval.

D: The time a STA waits for an Acknowledgment (Ack) frame is a much shorter duration, defined by MAC layer timings like SIFS and slot times, and is unrelated to power-save sleep cycles.

1. IEEE Std 802.11™-2020. (2020). IEEE Standard for Information Technology--Telecommunications and Information Exchange between Systems Local and Metropolitan Area Networks--Specific Requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications. Section 9.4.1.5, "Listen Interval field," states: "The Listen Interval field is used to indicate to the AP how often a non-AP STA in power save mode wakes to listen to Beacon frames. The value of this field is an integer that specifies the interval, in units of Beacon Interval..."

2. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Section 6.3.3, the 802.11 power-management mechanism is detailed, explaining that a node can enter sleep mode and wake up periodically to check for messages, which the AP buffers. The Listen Interval is the parameter used to negotiate this wake-up frequency with the AP.

3. Geier, J. (2015). Designing and Deploying 802.11 Wireless Networks: A Practical Guide to Implementing 802.11n and 802.11ac Wireless Networks For Enterprise-Based Applications (2nd ed.). Cisco Press. Chapter 4, "802.11 Medium Access," describes Power Save Mode, noting that the "Listen Interval... indicates how often the station will wake up to check for buffered frames." This text is frequently used in university-level networking courses.

The fundamental difference between a legacy Data frame and a QoS-Data frame, as defined by the IEEE 802.11e amendment, is the inclusion of a 2-byte (16-bit) QoS Control field in the MAC header. This field is present only in frames with the QoS subtype. It contains several subfields, most notably the Traffic Identifier (TID), which maps the frame to one of eight User Priorities (UPs). These UPs are then mapped to specific Access Categories (ACs) for prioritized channel access using EDCA (Enhanced Distributed Channel Access). The presence of this field is the defining characteristic that enables MAC-layer Quality of Service.

A. Differentiated Services Code Point (DSCP) is a Layer 3 marking in the IP header, not a field within the 802.11 MAC frame header.

B. The QoS Information Element is used in Management frames (e.g., Beacons) to advertise QoS capabilities, not within individual Data frames.

C. An 802.1Q VLAN tag is a Layer 2 mechanism for wired Ethernet and is not a native component of the 802.11 MAC header.

1. IEEE Std 802.11™-2020 (Revision of IEEE Std 802.11-2016). Section 9.3.2.1, "Data frame format," states: "The QoS Control field is present when the QoS subfield of the Subtype field is 1." Figure 9-28, "MAC frame format for QoS Data frames," visually depicts the location of the QoS Control field within the MAC header.

2. Coleman, D. D., Westcott, D. A., & Harkins, B. A. (2021). Certified Wireless Analysis Professional (CWAP) Official Study Guide: Exam CWAP-404 (2nd ed.). Wiley. Chapter 4, "802.11 MAC Architecture," in the section "QoS Data Frames," explains that the key differentiator for these frames is the 16-bit QoS Control field, which carries the priority value for the frame.

3. Hiertz, G. R., Denteneer, D., Stibor, L., Zang, Y., Costa, X. P., & Walke, B. (2010). The IEEE 802.11s MAC layer management and the mesh deterministic access. IEEE Wireless Communications, 17(1), 54-62. https://doi.org/10.1109/MWC.2010.5416349. In Section II.A, "The 802.11e QoS Facility," the paper states, "The main enhancement of 802.11e is the introduction of a new data frame format, the QoS data frame, which contains a QoS control field in its MAC header."

The Arbitration Inter-Frame Space (AIFS) is a fundamental component of the Enhanced Distributed Channel Access (EDCA) mechanism, defined in IEEE 802.11e to provide Quality of Service (QoS). Its duration is calculated on a per-Access Category (AC) basis. The formula begins with the base Short Inter-Frame Space (SIFS) duration, to which a variable period is added. This variable period is the product of the AIFS Number (AIFSN), a small integer assigned to each AC, and the standard Slot Time (aSlotTime) for the specific Physical Layer (PHY). A lower AIFSN value results in a shorter AIFS, thus granting higher priority access to the wireless medium.

A. This formula incorrectly includes DIFS, which is the legacy non-QoS inter-frame space, and improperly adds a unitless number (AIFSN) to time values.

B. This formula is circular, as it attempts to define AIFS using AIFS itself, and uses the non-specific term "Time Unit" instead of "Slot Time".

C. This formula is dimensionally incorrect, as it multiplies two time durations (SIFS and Slot Time), which is not a valid calculation for an inter-frame space.

1. IEEE Std 802.11™-2020 (Revision of IEEE Std 802.11-2016), "Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications," Section 10.3.2.3.7, "Interframe space," page 1328. The standard explicitly defines the formula as: AIFS[AC] = AIFSN[AC] × aSlotTime + aSIFSTime. This directly corresponds to option D.

2. University of California, Santa Cruz, Baskin School of Engineering, Course CSE151/251, "Lecture 10: MAC Protocols for WLANs (QoS)," Slide 18. The lecture slide presents the formula for calculating AIFS within the context of 802.11e EDCA as: AIFS[AC] = SIFS + AIFSN[AC] aSlotTime. This confirms the structure and components of the correct answer.

3. Carnegie Mellon University, Course 18-759, "Wireless Networks," Lecture 10, "WLANs: MAC," Slide 31. The course material illustrates the EDCA mechanism and shows the AIFS calculation as AIFS[i] = SIFS + AIFSN[i] SlotTime, where i represents the specific Access Category.

In the 802.11ac (VHT) explicit transmit beamforming (TxBF) sounding procedure, the beamformer sends a Null Data Packet (NDP) to the beamformee. The beamformee uses this NDP to measure the characteristics of the MIMO channel. Based on this measurement, it calculates the channel state information (CSI). This CSI is then encapsulated within a VHT Compressed Beamforming frame and transmitted back to the beamformer. The specific name for this CSI data structure, as defined by the IEEE 802.11 standard, is the Feedback Matrix. The beamformer then uses this matrix to compute its own steering matrix for subsequent directed transmissions.

A. Steering Matrix: This is calculated and used by the beamformer after receiving the Feedback Matrix from the beamformee.

B. Beamforming Matrix: This is a generic term; "Feedback Matrix" is the specific, standardized name for the information sent by the beamformee.

D. Beamformee Matrix: This is not a standard term used within the IEEE 802.11 specifications for the beamforming process.

1. IEEE Std 802.11™-2020 (Revision of IEEE Std 802.11-2016), Section 9.35.2, "Explicit feedback beamforming," Paragraph 2: "The beamformer initiates a sounding feedback sequence by transmitting a sounding PPDU. The beamformee then sends a VHT Compressed Beamforming frame or an HE Compressed Beamforming frame containing a feedback matrix that describes the channel."

2. Perahia, E., & Stacey, R. (2013). Next Generation Wireless LANs: 802.11n and 802.11ac. Cambridge University Press. Chapter 10, Section 10.4.2, "Explicit Feedback," page 258: "The beamformee then computes the CSI and sends it back to the beamformer in a compressed beamforming frame... The beamformer uses the CSI feedback to compute the steering matrix V."

3. IEEE Std 802.11™-2020 (Revision of IEEE Std 802.11-2016), Section 21.4, "VHT MIMO Control field," Paragraph 1: "The VHT MIMO Control field is present in the VHT Compressed Beamforming frame... It contains feedback information for single user or multi-user beamforming." This section further details the components that make up the feedback matrix.

The prefix "0x" is the standard convention used to denote a hexadecimal (base-16) number in many programming languages, most notably C and its derivatives (C++, Java, C#). This convention has been widely adopted in computing and is used by most protocol analyzers, such as Wireshark, to represent hexadecimal values in packet decodes and display filters. This notation unambiguously distinguishes hexadecimal numbers from decimal or other numerical bases, preventing misinterpretation of data fields within a protocol frame.

B. 16x: This is not a standard or recognized prefix for hexadecimal notation in any common programming language or protocol analysis tool.

C. %: This prefix is sometimes used to denote binary (base-2) numbers in certain assembly languages or hardware description languages, not hexadecimal.

D. HEX: While "HEX" is an abbreviation for hexadecimal, it is typically used as a descriptive label or a suffix (e.g., 1AFh in some assemblers), not a prefix.

1. University Courseware: Massachusetts Institute of Technology (MIT) OpenCourseWare. (2017). 6.004 Computation Structures, Spring 2017. Lecture 1: The Digital Abstraction, Slide 20. Retrieved from MIT OCW, which states, "In C, we can be specific about the base of a number literal: 0b (binary), 0 (octal), 0x (hex)."

2. Official Vendor Documentation: Wireshark Foundation. (2024). Wireshark User's Guide. Chapter 6. Display Filter Expressions, Section 6.3.3. Numbers. The documentation specifies, "You can also use C-style hexadecimal integer literals (for example, 0xdeadbeef)."

3. University Courseware: University of California, Berkeley. CS 61C: Great Ideas in Computer Architecture (Machine Structures). Lecture 2: C Memory Management, Number Representation. The course materials explicitly state, "In C, 0x prefix denotes hexadecimal." This is relevant as many protocol analysis tools are written in or influenced by C.

The Request to Send (RTS) and Clear to Send (CTS) frames are part of the 802.11 Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) mechanism, specifically the Distributed Coordination Function (DCF). When a station (STA) intends to send a data frame that exceeds the configured RTS Threshold, it first transmits an RTS frame to the intended recipient. The recipient STA, upon receiving the RTS, responds with a CTS frame after a Short Interframe Space (SIFS). This CTS frame serves as the positive acknowledgment to the RTS and reserves the radio frequency (RF) medium for the subsequent data frame transmission, helping to mitigate the hidden node problem.

B. Ack: An Ack frame is used to acknowledge the successful reception of unicast data or management frames, not control frames like RTS.

C. RTS-Ack: This is not a defined frame type within the IEEE 802.11 standard; it is a fabricated option.

D. Block Ack: A Block Ack is a mechanism introduced in 802.11n to acknowledge a group of frames (an A-MPDU) at once, not a single RTS frame.

1. IEEE Computer Society. (2021). IEEE Standard for Information Technology--Telecommunications and Information Exchange between Systems Local and Metropolitan Area Networks--Specific Requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications. IEEE Std 802.11™-2020.

Section 10.3.2.7, "RTS/CTS procedure," states: "A STA may transmit an RTS frame when it desires to transmit a frame. Upon receiving an RTS frame, the destination STA shall respond with a CTS frame after a SIFS period if the NAV at the destination STA is clear." This directly specifies that a CTS is the response to an RTS.

2. Carnegie Mellon University. (2005). 18-759 Wireless Networks, Lecture 4: MAC Layer I: 802.11. School of Electrical and Computer Engineering.

Slide 23, "RTS/CTS Handshake," illustrates the exchange sequence: "Sender sends RTS (Request to Send). Receiver responds with CTS (Clear to Send)." This confirms the fundamental protocol interaction where CTS acknowledges the RTS.