Free CWNP CWDP-305 Practice Exam with Questions & Answers | Set: 6

A Wireless Intrusion Prevention System (WIPS) is a network security solution that monitors wireless LANs for unauthorized or malicious activity and provides real-time or automated responses. WIPS can perform a wide array of functions as outlined below:

A. Distributed protocol analysis:

WIPS sensors continuously scan wireless traffic and analyze frames to detect anomalies or policy violations in real time.

C. Performance monitoring and response:

WIPS can identify degradation in WLAN performance due to interference, misconfiguration, or rogue activity and alert administrators or take corrective action.

D. Data forensics and analysis:

WIPS platforms often include historical logging and reporting features that allow administrators to review past events and understand the timeline and impact of wireless threats.

E. Automated threat mitigation:

WIPS can automatically respond to threats by sending deauthentication frames, blocking MAC addresses, or disabling ports to mitigate rogue devices or attacks.

Note:

B. Client access to the distribution system is not a function of WIPS; it refers to client functionality in a WLAN, not a security service offered by WIPS.

“A WIPS performs functions such as rogue detection and mitigation, threat classification, forensic logging, and real-time protocol analysis. It can provide both historical analytics and proactive security enforcement.”

— CWDP-305 Study Guide, Chapter on Post-Design ValidationandTroubleshooting

Designing guest access with all guest users tunneled directly into the DMZ has two main advantages: it simplifies the network configuration and it enhances the security of the internal network. A DMZ is a demilitarized zone, which is a separate network segment that isolates the public-facing services from the private network. A DMZ provides a buffer zone between the Internet and the internal network, where potential attacks can be detected and prevented.

By tunneling all guest users directly into the DMZ, the network configuration is simplified because there is no need to segment and filter the guest traffic across the internal LAN. The guest traffic is encapsulated and routed to the DMZ controller, which acts as the anchor point for the guest WLAN. The guest traffic is then decrypted and forwarded to the Internet or the DMZ services. This way, the guest traffic does not mix with the internal traffic, and there is no need to apply VLANs, ACLs, or firewall rules to separate them.

Another advantage of tunneling all guest users directly into the DMZ is that it enhances the security of the internal network. By keeping the guest traffic in the DMZ, the internal network is protected from any potential threats or attacks that may originate from the guest users. The guest users have no visibility or access to the internal network resources, and they are subject to the security policies and controls of the DMZ. The border firewall configuration will not require any additional rules to pass guest traffic to the DMZ controller, because the guest traffic is already encapsulated and tunneled. This reduces the complexity and the risk of misconfiguration of the firewall rules. References: CWNP, CWDP Certified Wireless Design Professional Official Study Guide, Cisco Unified Wireless Guest Access Services, What Is a DMZ Network and Why Would You Use It?, Wireless Guest Access FAQ

The IEEE 802.11y amendment introduced support for operation in the 3.65–3.7 GHz frequency band, allowing for higher power transmissions up to 20 watts Equivalent Isotropically Radiated Power (EIRP).This enhancement was designed to improve wireless coverage and performance, especially in environments requiring extended range and penetration.

The increased power and frequency range provided by 802.11y facilitate better service in areas where traditional Wi-Fi bands may be congested or less effective.

Centralized data forwarding means all wireless traffic is tunneled back to a central controller, which handles tasks such as filtering, firewalling, and policy enforcement.

From CWDP-305:

“Centralized data forwarding enables consistent policy enforcement and traffic filtering by handling all traffic at the controller rather than at individual APs.”

This approach provides better control and visibility, especially in environments with strict security and traffic management requirements.

— Reference: CWDP-305 Official Study and Reference Guide, Chapter on Infrastructure Design

Comprehensive and Detailed Explanation:

Per-user Pre-Shared Keys (PSKs) offer several advantages over a single PSK used across an entire Extended Service Set (ESS):

User-Based Access Control:Assigning unique PSKs to individual users allows for better tracking and control over network access.

Simplified Key Management:If a user's PSK is compromised or they leave the organization, only their key needs to be changed, not the entire network's.

Option C:Per-user PSKs are not a standard defined or certified by the Wi-Fi Alliance; they are an implementation choice.

Option D:Mutual authentication is a feature of WPA/WPA2-Enterprise using 802.1X, not of PSK-based systems.

DHCP Option 43 is utilized to provide vendor-specific information to DHCP clients. In WLAN deployments, particularly with lightweight access points (APs), Option 43 is used to convey the IP address of the Wireless LAN Controller (WLC) that the AP should join. The AP includes a Vendor Class Identifier (Option 60) in its DHCP Discover message, and the DHCP server responds with Option 43 containing the WLC's IP address. This mechanism facilitates the automatic discovery and association of APs with their respective controllers, streamlining network deployment and management.Cisco

Comprehensive and Detailed Explanation:

After implementing a WLAN infrastructure, it's essential to provide the customer with comprehensive documentation.This includes digital or physical assets, user guides, floorplans indicating AP placements, and configuration documents detailing network settings.These deliverables ensure the customer can manage, maintain, and troubleshoot the WLAN effectively.Reddit

Interference primarily affects the receiver's ability to demodulate signals. In a point-to-point link, RF interference occurring at the middle of the link has little to no impact unless it reaches either endpoint. Therefore, the focus must be on minimizing interference at the receivers.

From CWDP-305:

“Interference at the receiver is the key concern in bridge links. The energy must be received cleanly to enable demodulation, so interference near the receiving AP is more critical than in the link’s midspan.”

— Reference: CWDP-305 Official Study and Reference Guide, Chapter on ProtocolandSpectrum Analysis

Channels 116-124 in the 5 GHz band fall under the Dynamic Frequency Selection (DFS) range, which requires devices to vacate the channel if radar signals are detected. Proximity to airports increases the likelihood of radar interference, leading to potential disruptions in Wi-Fi service.

The CWDP-305 Official Study and Reference Guide advises:

"In environments near radar installations, such as airports, it's recommended to avoid DFS channels (e.g., 116-124) to prevent service interruptions due to radar detection requirements."

802.11 admission control mechanisms are employed to manage and regulate the bandwidth resources available in a WLAN.By controlling the admission of traffic into the network, these mechanisms ensure that high-priority traffic, such as voice or video, receives the necessary resources for optimal performance.Admission control settings are configured separately for each Access Category (AC), allowing granular control over different types of traffic.