CWNP CWSP-208: Certified Wireless Security Professional (CWSP)

Last checked November 10, 2026 against the official CWNP exam page.

1. Question 1WLAN Security Design and Architecture

   Which statement correctly distinguishes WPA2-Personal from WPA2-Enterprise?

   1. APersonal authenticates each client with an 802.1X supplicant and a shared group certificate, while Enterprise uses one passphrase
   2. BPersonal uses one shared passphrase, while Enterprise authenticates each user or device through 802.1X and EAP
   3. CPersonal encrypts with TKIP only, while Enterprise uses GCMP-256 in every deployment
   4. DPersonal supports mutual certificate authentication, while Enterprise supports only passphrase login
   Show answer and explanationHide answer

   Correct answer: B

   WPA2-Personal relies on one pre-shared passphrase that all clients share, while WPA2-Enterprise uses 802.1X with an EAP method and an authentication server to authenticate each user or device. The other statements reverse the two modes or invent cipher and certificate rules that do not apply.

2. Question 2Vulnerabilities, Threats, and Attacks

   An engineer reviews a legacy warehouse network that still runs WEP and finds that an attacker who collects enough frames can recover the key. Which design flaw explains this?

   1. AIt stores the shared key in the access point's flash memory, so the key can be read after a reboot
   2. BIt depends on 802.1X server certificates that clients seldom validate, so attackers can impersonate the network
   3. CIt uses RC4 with a short initialization vector that is reused, plus a weak integrity check
   4. DIt uses AES in counter mode, which breaks when clients roam between access points
   Show answer and explanationHide answer

   Correct answer: C

   WEP combines RC4 with a 24-bit initialization vector that is often reused and a CRC-based integrity check that can be forged, which lets collected traffic reveal the key. WEP has no 802.1X component and does not use AES, so the other options describe features that do not apply.

3. Question 3Security Policy

   A new wireless security policy says that all access to corporate data over Wi-Fi must be authenticated, but it does not name any protocol or product. Which policy element does this sentence represent?

   1. AA policy statement that expresses management intent
   2. BA standard that sets mandatory technical settings for each device type
   3. CA procedure listing the steps to onboard a device
   4. DA guideline offering optional recommendations
   Show answer and explanationHide answer

   Correct answer: A

   A policy statement records management's intent in general terms, here that corporate data must be reached only through authenticated access. A standard would name mandatory technical settings, a procedure would list steps, and a guideline would offer optional advice.

4. Question 4Security Lifecycle Management

   An administrator plans to change WPA3 settings on production wireless controllers. Which step should come first under good change management?

   1. ASubmit a documented change request with a rollback plan, and test the change in a lab or staging environment first
   2. BMake the change now and record it in the audit log during the next quarterly review
   3. CApply the change to one production access point at a time, without telling the help desk
   4. DAsk the vendor's sales representative to approve the configuration before any testing is done
   Show answer and explanationHide answer

   Correct answer: A

   Good change management requires a documented request, approval, testing in a non-production environment and a rollback plan before a change reaches production. Applying changes without notice, recording them only after the fact or relying on a vendor's sales contact skips these controls.

5. Question 5WLAN Security Design and Architecture

   A switch port blocks all traffic from a laptop until the laptop proves its identity. In this 802.1X exchange, which role does the switch play?

   1. AThe supplicant, which is the device requesting network access
   2. BThe authenticator, which relays EAP messages and enforces the port state
   3. CThe authentication server, which checks the credentials against a user database
   4. DThe credential issuer, which signs the device's certificate for the network
   Show answer and explanationHide answer

   Correct answer: B

   The switch port (or access point) is the authenticator: it relays EAP messages between the supplicant and the authentication server and keeps the controlled port blocked until authorization succeeds. The laptop is the supplicant and the RADIUS server is the authentication server, and 802.1X defines no separate credential issuer role.