CWNP CWAP-405: Certified Wireless Analysis Professional (CWAP)

Last checked November 10, 2026 against the official CWNP exam page.

1. Question 1802.11 Frame Exchanges

   During a client's join to an AP, the capture shows an Authentication exchange followed by an Association Request. Which frame from the AP completes the association and assigns the client its association identifier?

   1. AProbe Response, which lists the supported rates and the channel the AP is using
   2. BReassociation Response, which moves the client's state from a previous AP to this one
   3. CAssociation Response, which carries the status code and the association identifier
   4. DBeacon, which announces the BSS parameters and the traffic indication map to all stations
   Show answer and explanationHide answer

   Correct answer: C

   The AP answers an Association Request with an Association Response that carries a status code and the AID for the client. A Probe Response answers active scanning, a Reassociation Response is used when a client moves from another AP, and a Beacon is a periodic broadcast that does not complete a join.

2. Question 2MAC Sublayer and Functions

   An analyst sees one QoS data frame whose body contains several subframes, each with its own length, and only one MAC header and one FCS covering the whole payload. Which aggregation method does this describe?

   1. ABlock Ack, which acknowledges a burst of frames with a single bitmap response
   2. BA-MPDU, which places several complete MPDUs with their own headers into one PPDU
   3. CFragmentation, which splits one MSDU into several MPDUs for a noisy channel
   4. DA-MSDU, which packs several MSDUs under one MAC header and one FCS
   Show answer and explanationHide answer

   Correct answer: D

   A-MSDU packs multiple MSDUs into one MPDU that has a single MAC header and FCS. A-MPDU carries multiple complete MPDUs that each have their own header and FCS, Block Ack is an acknowledgment method, and fragmentation splits one MSDU rather than combining several.

3. Question 3Protocol Analysis

   A network engineer must find out why a client's WPA2-Personal authentication keeps failing at one access point. The engineer plans to use a laptop with a Wi-Fi adapter for the capture. Which adapter mode and setup is required to see the management and EAPOL frames exchanged between the client and that access point?

   1. AManaged mode associated to the same SSID, since the adapter only receives frames addressed to its own MAC address and broadcasts
   2. BCapture on the controller's wired uplink only, since all wireless management frames are forwarded there
   3. CPromiscuous mode on the wired interface that connects to the access point's uplink switch port
   4. DMonitor mode on the adapter tuned to the channel used by the access point, so frames between other stations are received
   Show answer and explanationHide answer

   Correct answer: D

   Monitor mode on a radio tuned to the BSS channel receives 802.11 management and data frames exchanged between other stations and the AP. Managed mode passes only frames for the adapter's own address, and wired captures never carry 802.11 management frames or EAPOL exchanges, which stop at the AP.

4. Question 4Spectrum Analysis

   A 2.4 GHz network loses throughput every few minutes. A spectrum view shows a broad, bursty signal that appears only while the kitchen microwave runs and fades when it stops. Which conclusion is best supported?

   1. AA Bluetooth headset is hopping across the band and causing frame errors on the WLAN
   2. BA neighboring access point is transmitting on the same channel and causing co-channel contention
   3. CA rogue client is sending deauthentication frames to the access point at fixed intervals
   4. DA microwave oven is leaking broadband energy into the 2.4 GHz band and degrading nearby channels
   Show answer and explanationHide answer

   Correct answer: D

   Microwave ovens emit broadband interference in the 2.4 GHz band that is tied to the appliance's on-time, which matches the spectrum pattern. A neighboring AP would appear as decodable 802.11 frames, Bluetooth hops are not tied to a kitchen appliance, and deauthentication frames are protocol traffic that a spectrum view cannot show.

5. Question 5PHY Layers and Technologies

   A capture shows a legacy preamble at the start of an 802.11n PPDU. A non-HT 802.11a/g station is nearby and needs to know how long the PPDU lasts so it can defer. Which field gives that information?

   1. AThe L-SIG field, which carries the rate and length in a form legacy stations can decode
   2. BThe VHT-SIG-A field, which carries the bandwidth and group identifiers for 802.11ac
   3. CThe HT-SIG field, which carries the modulation and coding details for HT stations only
   4. DThe short training field, which sets automatic gain control and timing for the receiver
   Show answer and explanationHide answer

   Correct answer: A

   L-SIG sits in the legacy preamble and is sent in a format that non-HT stations can decode, so they can compute the PPDU duration and defer. HT-SIG and VHT-SIG-A are read only by newer stations, and the training fields serve receiver timing rather than telling a legacy station how long to defer.