CWNA Research & Evidence-Based Practice 4 — Questions and Answers
Question 1: A wireless engineer uses a protocol analyzer to capture 802.11 management frames. Which frame type provides evidence that a client is actively scanning for networks?
- Beacon frames
- Probe Request frames (Correct answer)
- Association Response frames
- Deauthentication frames
Correct answer: Probe Request frames
Probe Request frames are transmitted by clients actively scanning for available networks, making them the direct evidence of client scanning behavior.
Question 2: A wireless team finds conflicting SNR thresholds recommended by two different vendors for VoWiFi deployments. What is the most evidence-based way to resolve this conflict?
- Use the threshold from the more expensive vendor
- Test both thresholds in a representative environment and measure call quality metrics (MOS, jitter, packet loss) (Correct answer)
- Average the two thresholds
- Use whichever threshold requires fewer APs
Correct answer: Test both thresholds in a representative environment and measure call quality metrics (MOS, jitter, packet loss)
Empirically testing both thresholds against objective voice quality metrics (MOS, jitter) in the actual environment resolves vendor conflicts with direct evidence.
Question 3: Which 802.11 standard amendment introduced BSS Coloring as a mechanism to reduce co-channel interference, and what evidence supports its effectiveness?
- 802.11ac; effectiveness is inferred from MIMO gains
- 802.11ax (Wi-Fi 6); reduced OBSS/SR collisions measurable via protocol analysis and throughput testing (Correct answer)
- 802.11n; effectiveness shown by beamforming gains
- 802.11g; effectiveness based on OFDM adoption
Correct answer: 802.11ax (Wi-Fi 6); reduced OBSS/SR collisions measurable via protocol analysis and throughput testing
BSS Coloring was introduced in 802.11ax to allow nodes to identify overlapping BSS frames and reduce unnecessary deferrals, with effectiveness verifiable through protocol capture and throughput measurement.
Question 4: A network analyst wants to determine whether 802.11r Fast BSS Transition is functioning correctly after deployment. Which evidence confirms successful operation?
- AP event logs showing the feature is enabled
- Protocol analyzer showing FT Action frames and sub-50ms reassociation times during roam events (Correct answer)
- Vendor confirmation the feature is supported
- Client device showing connected status after roaming
Correct answer: Protocol analyzer showing FT Action frames and sub-50ms reassociation times during roam events
FT Action frames captured in a protocol analyzer, combined with measured reassociation timing, provide direct evidence that 802.11r is operating correctly.
Question 5: A hospital wireless team is designing a policy for clinical device roaming. Which approach best represents evidence-based practice for determining minimum RSSI thresholds?
- Apply the vendor default threshold without modification
- Test clinical devices in representative RF conditions and record the RSSI at which application performance degrades (Correct answer)
- Use the strictest possible threshold to be safe
- Ask clinical staff what signal strength feels right
Correct answer: Test clinical devices in representative RF conditions and record the RSSI at which application performance degrades
Testing actual clinical devices under real RF conditions and correlating RSSI with application performance degradation provides device-specific, empirically grounded thresholds.
Question 6: When evaluating a new wireless security solution, which evidence type most rigorously supports a claim that KRACK vulnerabilities have been mitigated?
- Vendor press release announcing the patch
- Verified firmware version with CVE-2017-13077 patches applied, confirmed by protocol-level testing (Correct answer)
- IT manager's memo stating the fix was applied
- End-user acknowledgement that security is improved
Correct answer: Verified firmware version with CVE-2017-13077 patches applied, confirmed by protocol-level testing
Confirming the specific CVE-patched firmware version and validating the fix through protocol-level testing is the most rigorous evidence of KRACK mitigation.
Question 7: A wireless deployment team uses heatmaps generated from a post-deployment survey to validate their design. Which comparison makes the heatmap analysis most meaningful?
- Comparing the heatmap to a photograph of the building
- Overlaying post-deployment measurements against the pre-deployment predictive model to identify gaps (Correct answer)
- Sharing the heatmap with end users for feedback
- Confirming all APs appear on the heatmap
Correct answer: Overlaying post-deployment measurements against the pre-deployment predictive model to identify gaps
Comparing post-deployment measured coverage against the predictive model reveals discrepancies that identify coverage gaps requiring design correction.
CWNA Research & Evidence-Based Practice 4
A wireless engineer uses a protocol analyzer to capture 802.11 management frames.
Which frame type provides evidence that a client is actively scanning for networks?