I85PREP
⌘ K
CWSP study materials
CWSP study resources

CWSP (ABWM) practice questions

One question at a time. Build your CWSP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1WLAN Discovery Techniques and Intrusion/Attack Techniques

How does a wireless station perform passive scanning to discover nearby access points?

  1. It transmits probe requests on every channel and waits for probe responses.
  2. It requests a scan report from the distribution system.
  3. It listens on each channel for beacon frames without transmitting frames. Correct answer.
  4. It authenticates to each access point it hears before selecting one.

Explanation

Passive scanning tunes the radio to each channel and listens for beacon and probe response frames. The station sends nothing during the scan, which conserves battery and avoids disclosing its presence, but discovery is slower because it must wait for the next beacon interval.

Question 2WLAN Discovery Techniques and Intrusion/Attack Techniques

Which frame does a client typically send first during an active scan for any available network?

  1. An association request naming a specific BSSID.
  2. A beacon frame advertising its supported rates.
  3. An authentication frame with an open-system algorithm.
  4. A probe request with a wildcard (zero-length) SSID element. Correct answer.

Explanation

Active scanning begins with probe requests; a zero-length SSID element is a wildcard that asks every AP in range to answer with a probe response. Authentication and association only occur after the client has chosen a network from those responses.

Question 3WLAN Discovery Techniques and Intrusion/Attack Techniques

What is the primary purpose of an 802.11 beacon frame?

  1. To obtain an IP address from the DHCP server.
  2. To relay client credentials to the authentication server.
  3. To carry user payload between the client and the access point.
  4. To advertise the BSS and its capabilities at a regular interval. Correct answer.

Explanation

Beacons are management frames transmitted periodically by the AP to announce the BSSID, SSID, supported rates, security parameters, and other capabilities. Clients rely on them for passive discovery and for staying synchronized with the BSS.

Question 4WLAN Discovery Techniques and Intrusion/Attack Techniques

SSID broadcast has been disabled on an access point, and an authorized client that already knows the network name associates to it. What does that client's over-the-air traffic reveal?

  1. The SSID in cleartext probe and association frames. Correct answer.
  2. Only the BSSID, since beacons carry no SSID element.
  3. Nothing, because the SSID is never sent in cleartext.
  4. The SSID only after the four-way handshake completes.

Explanation

Hiding the SSID only removes the name from beacon frames; the client still places the SSID in probe requests and association requests, and the AP echoes it in probe responses. Anyone in monitor mode can therefore recover a hidden SSID from normal client behavior.

Question 5WLAN Discovery Techniques and Intrusion/Attack Techniques

An attacker on channel 6 transmits deauthentication frames to a client with the legitimate AP's MAC address as the source. What is the practical result?

  1. The access point's radio is disabled until it reboots.
  2. The client is dropped and reassociates, exposing the handshake. Correct answer.
  3. The client's traffic is silently redirected through the attacker.
  4. The client's WPA2 session key is disclosed to the attacker.

Explanation

Deauthentication frames are unauthenticated management frames, so a spoofed source address is accepted and the client tears down its association. The client then reassociates, giving the attacker an opportunity to capture the four-way handshake for offline analysis.

Question 6WLAN Discovery Techniques and Intrusion/Attack Techniques

Which protection does 802.11w (management frame protection) provide on a WLAN?

  1. It encrypts beacon frames so that SSIDs cannot be discovered.
  2. It authenticates clients via 802.1X before association.
  3. It protects unicast management frames like deauth with a MIC. Correct answer.
  4. It replaces the four-way handshake with SAE.

Explanation

802.11w adds integrity protection, using a message integrity code, to unicast robust management frames including deauthentication, disassociation, and action frames. This prevents an outsider from forging those frames, which blunts classic spoofed deauth attacks.

Question 7WLAN Discovery Techniques and Intrusion/Attack Techniques

Which term describes a rogue access point that copies a legitimate SSID to lure clients into connecting through it?

  1. An AP configured on the same channel as a neighbor.
  2. An AP that broadcasts more SSIDs than its license allows.
  3. An AP that forwards traffic without any encryption.
  4. A rogue AP that clones a legitimate SSID to lure clients. Correct answer.

Explanation

An evil twin impersonates a legitimate network by using the same SSID, often with a stronger signal, so that clients roam to it automatically. Once clients associate, the attacker can harvest credentials through a fake portal or relay traffic as a man in the middle.

Question 8WLAN Discovery Techniques and Intrusion/Attack Techniques

A WLAN administrator wants to locate unauthorized access points plugged into the corporate switched network. Which technique is most direct?

  1. Compare beacon intervals of all APs on each channel.
  2. Correlate heard BSSIDs with MAC addresses learned on switch ports. Correct answer.
  3. Inspect the DHCP lease times offered to wireless clients.
  4. Count probe requests per channel with a passive scanner.

Explanation

Comparing the BSSIDs found over the air against the MAC addresses visible in switch forwarding tables reveals APs that are physically attached to the wired infrastructure. This wired-side correlation is more conclusive than purely over-the-air detection.

Question 9WLAN Discovery Techniques and Intrusion/Attack Techniques

An access point enforces a MAC address whitelist for association. Why is this control easily bypassed?

  1. MAC addresses are encrypted inside the four-way handshake.
  2. Clients cannot transmit frames without a MAC address.
  3. MAC addresses travel in cleartext and can be spoofed. Correct answer.
  4. The access point broadcasts its whitelist in each beacon.

Explanation

Address fields in 802.11 headers are sent unencrypted, so an attacker in monitor mode can observe an authorized station's address. Changing the local NIC configuration to match that address satisfies the whitelist without any further effort.

Question 10WLAN Discovery Techniques and Intrusion/Attack Techniques

The KRACK family of attacks against WPA2 exploits which part of the protocol?

  1. the WPS PIN exchange used to recover the PSK
  2. the TKIP Michael countermeasures to inject frames
  3. the RSN information element used to downgrade ciphers
  4. the key reinstallation step of the four-way handshake Correct answer.

Explanation

KRACK forces a client to reinstall an already-in-use pairwise key by replaying handshake message 3, which resets the nonce and packet number counters. The resulting nonce reuse allows frames to be decrypted, replayed, or in some cases injected.

Question 11WLAN Discovery Techniques and Intrusion/Attack Techniques

A tool recovers a crackable value from a single EAPOL message sent by the access point, with no client handshake captured. What was obtained?

  1. A four-way handshake message 4 carrying the encrypted GTK.
  2. A probe response carrying the pre-shared key.
  3. A beacon frame carrying the pairwise master key in an IE.
  4. The PMKID from the RSN IE of the first EAPOL message. Correct answer.

Explanation

The PMKID is computed from the PMK, the string "PMK Name", and the AP and station MAC addresses, and it appears in the RSN information element of message 1. An attacker who can associate to the AP can request that message and crack the PMKID offline without waiting for a client handshake.

Question 12WLAN Discovery Techniques and Intrusion/Attack Techniques

Why do WPS PIN attacks reduce the effective brute-force effort so dramatically?

  1. The PIN is identical on every device from a vendor.
  2. The PIN is derived directly from the SSID of the AP.
  3. The PIN is sent in cleartext during the four-way handshake.
  4. The PIN is checked in two halves, shrinking the search space. Correct answer.

Explanation

The WPS registrar validates the first four digits and the last four digits of the PIN separately, and the final digit is a checksum. That design reduces the practical search from 10^8 to roughly 11,000 attempts.

Question 13WLAN Discovery Techniques and Intrusion/Attack Techniques

The FMS attack against WEP recovers the key by exploiting which property?

  1. Brute-forcing the full 104-bit key space directly.
  2. Capturing the WPA four-way handshake from a client.
  3. Exploiting weak IVs that leak key bytes through RC4. Correct answer.
  4. Forcing the AP to reveal the key in a disassociation.

Explanation

Certain initialization vectors make the RC4 key schedule leak information about individual key bytes. By collecting enough packets that use those weak IVs, an attacker can recover the key byte by byte rather than searching the entire key space.

Question 14WLAN Discovery Techniques and Intrusion/Attack Techniques

What must an attacker capture before running an offline dictionary attack against a WPA2-PSK network?

  1. The AP's WPS PIN and a valid server certificate.
  2. The client's DHCP lease and ARP cache entries.
  3. The four-way handshake or PMKID for a client of that SSID. Correct answer.
  4. The beacon and probe response frames from the AP.

Explanation

Offline guessing tests a candidate passphrase by deriving the PMK and checking it against handshake material or the PMKID. Without one of those values there is nothing to verify guesses against, so the attacker must first capture or solicit them.

Question 15WLAN Discovery Techniques and Intrusion/Attack Techniques

What does a beacon flood attack accomplish against nearby wireless clients?

  1. Creates fake BSSIDs so scanners list bogus networks. Correct answer.
  2. Forces clients to deauthenticate from the real AP.
  3. Fills the AP's association table with half-open sessions.
  4. Saturates the wired uplink with broadcast beacons.

Explanation

A beacon flood injects large numbers of beacon frames with fabricated SSIDs and BSSIDs, so client scan lists fill with nonexistent networks. This confuses users and scanners and can destabilize some wireless drivers.

Question 16WLAN Discovery Techniques and Intrusion/Attack Techniques

An authentication flood is intended to exhaust which resource?

  1. The RADIUS server's stored certificates and keys.
  2. The AP's station table via many authentication states. Correct answer.
  3. The upstream router's DHCP address pool and leases.
  4. The client supplicant's cached pairwise session keys.

Explanation

Authentication flood tools send huge numbers of authentication frames with random source addresses, causing the AP to allocate and track many station entries. When the table or memory is exhausted, legitimate clients may be unable to authenticate.

Question 17WLAN Discovery Techniques and Intrusion/Attack Techniques

Which tool is designed primarily for passive wireless discovery and wireless intrusion detection?

  1. Reaver
  2. Hashcat
  3. Aircrack-ng
  4. Kismet Correct answer.

Explanation

Kismet operates with a card in monitor mode, passively logging beacon, probe, and data frames to map BSSIDs and clients, and it includes IDS features. It does not need to transmit probe requests, so it stays quiet while surveying.

Question 18WLAN Discovery Techniques and Intrusion/Attack Techniques

A rogue AP presents a fake login screen asking for corporate credentials before granting Internet access. Which attack is this?

  1. Captive portal phishing on a rogue AP Correct answer.
  2. A fragmentation attack against the AP.
  3. A beacon flood against the channel.
  4. A deauthentication storm against clients.

Explanation

The attacker stands up an open network that imitates a guest or corporate portal so that users voluntarily type credentials or other sensitive data that the attacker then collects. It is a social-engineering attack enabled by an evil twin style rogue AP.

Question 19WLAN Discovery Techniques and Intrusion/Attack Techniques

On an open WLAN, an attacker poisons the ARP caches of a client and the default gateway. What has the attacker achieved?

  1. The attacker disables 802.11w on the access point.
  2. The attacker sits as a man in the middle for IP traffic. Correct answer.
  3. The attacker recovers the WPA2 pre-shared key.
  4. The attacker forces a WPA3 SAE downgrade to WPA2-PSK.

Explanation

By mapping the gateway's IP address to the attacker's own MAC on the client, and vice versa, all IP traffic is routed through the attacker's machine. This permits eavesdropping, modification, and session hijacking on the open network.

Question 20WLAN Discovery Techniques and Intrusion/Attack Techniques

What is the immediate objective of a DHCP starvation attack on a wireless network?

  1. Recover WEP key bytes from weak IVs.
  2. Capture the WPA2 four-way handshake from a client.
  3. Flood the AP with authentication frames.
  4. Exhaust the DHCP pool so legitimate clients get no lease. Correct answer.

Explanation

The attacker requests leases using many fabricated MAC addresses until the DHCP scope is depleted. This is often a precursor to standing up a rogue DHCP server that hands out the attacker's address as the gateway.

Question 21WLAN Discovery Techniques and Intrusion/Attack Techniques

Which management frame subtype ends an existing association between a client and an access point?

  1. Authentication
  2. Beacon
  3. Disassociation Correct answer.
  4. Probe response

Explanation

A disassociation frame terminates an existing association, while a deauthentication frame terminates the authenticated state. Both are sent as unprotected management frames in networks without management frame protection.

Question 22WLAN Discovery Techniques and Intrusion/Attack Techniques

An attacker sends a directed probe request naming a hidden SSID. How does a typical AP configured to hide that SSID respond?

  1. Nothing, because hidden APs ignore all probe requests.
  2. An authentication frame with an encrypted SSID.
  3. A probe response that carries the SSID in cleartext. Correct answer.
  4. A beacon with a zero-length SSID element.

Explanation

When a probe request includes the exact SSID configured on the AP, the AP normally replies with a probe response that includes the network name. Hiding the SSID therefore protects against casual discovery rather than against a targeted request.

Question 23WLAN Discovery Techniques and Intrusion/Attack Techniques

A Karma-style attack succeeds because of which client behavior?

  1. WPA2 encrypts only data frames, not management frames.
  2. Clients probe for old SSIDs and the AP answers all. Correct answer.
  3. Clients transmit beacons to discover nearby access points.
  4. Access points broadcast their SSID in every beacon frame.

Explanation

Many client devices periodically send directed probe requests listing previously used network names. A Karma AP replies to every probe request it hears with a matching probe response, so the device associates to the attacker regardless of which network it was seeking.

Question 24WLAN Discovery Techniques and Intrusion/Attack Techniques

Why is passive scanning often preferred for battery-powered wireless devices?

  1. It never needs to change channels.
  2. It authenticates faster than active scanning.
  3. It only receives, so no probes reveal the device. Correct answer.
  4. It locates hidden access points immediately.

Explanation

Because passive scanning transmits nothing, the radio spends no energy on probe frames and the device does not announce its presence or the SSIDs it remembers. The trade-off is slower discovery while waiting for beacon intervals.

Question 25WLAN Discovery Techniques and Intrusion/Attack Techniques

Under WEP shared-key authentication, what does an attacker gain by capturing the authentication exchange?

  1. The client's 802.1X identity and certificate.
  2. The access point's WPS PIN.
  3. The WPA2 PMKID for the access point.
  4. The challenge and its encrypted reply, yielding keystream. Correct answer.

Explanation

Shared-key authentication sends a cleartext challenge and receives the same value encrypted with the WEP keystream, so XORing the two recovers that keystream. Combined with captured data traffic, this accelerates key recovery and enables traffic injection.

Question 26WLAN Discovery Techniques and Intrusion/Attack Techniques

A wireless security analyst wants to capture every 802.11 management frame traveling on channel 6, including probe requests and association frames exchanged between other stations and other access points. Which adapter configuration is required to accomplish this?

  1. Place the adapter in monitor mode and tune it to channel 6 Correct answer.
  2. Place the adapter in ad-hoc (IBSS) mode and set the channel to 6
  3. Place the adapter in promiscuous mode while it remains associated to a production SSID
  4. Enable WDS bridging on the adapter and lock the data rate to 6 Mbps

Explanation

802.11 frames carry a receiver address, and a card operating in normal managed or promiscuous mode only passes frames that the driver considers destined for the local station. Monitor mode hands raw 802.11 frames up to the capture tool without filtering, so frames between other devices become visible. The card must also be tuned to the channel being observed, because a single radio can only receive traffic on the channel it is listening to.

Question 27802.11 Protocol Analysis

Which 802.11 frame type carries beacon, probe, and association frames?

  1. Control
  2. Data
  3. Extension
  4. Management Correct answer.

Explanation

802.11 defines frame type 0 as management, type 1 as control, and type 2 as data. Management frames create and maintain the BSS, so beacons, probes, authentication, and association all use this type.

Question 28802.11 Protocol Analysis

A data frame is captured with the To DS bit set to 1 and the From DS bit set to 0. What does this indicate?

  1. The frame is travelling from the distribution system to a wireless station
  2. The frame is a control frame rather than a data frame
  3. The frame is an intra-BSS frame between two associated stations
  4. The frame was sent by a non-AP station toward the DS Correct answer.

Explanation

In a data frame the To DS and From DS bits describe direction relative to the distribution system. To DS=1 with From DS=0 means an uplink frame from a non-AP station to its AP, with Address 1 as BSSID, Address 2 as SA, and Address 3 as DA.

Question 29802.11 Protocol Analysis

Which control frame does a station send to reserve the medium before a data exchange?

  1. RTS Correct answer.
  2. PS-Poll
  3. ACK
  4. CTS

Explanation

A station that wants to transmit sends an RTS, and the addressed receiver answers with a CTS. The duration values in both frames update the NAV of other stations, protecting the following data exchange.

Question 30802.11 Protocol Analysis

What is the primary purpose of the Duration/ID field in an 802.11 MAC header?

  1. It reports the transmit power used for the frame
  2. It holds the sequence number used to detect duplicates
  3. It carries the traffic identifier for QoS data frames
  4. It lets other stations set their NAV Correct answer.

Explanation

The Duration/ID field carries a time value in microseconds that other stations use to update their Network Allocation Vector, a virtual carrier-sense timer. In PS-Poll frames the same field instead carries an association ID.

Question 31802.11 Protocol Analysis

Which management frame do APs typically transmit every beacon interval to advertise the BSS?

  1. Beacon Correct answer.
  2. Probe request
  3. Authentication
  4. Association response

Explanation

Beacons are broadcast at the target beacon transmission time and carry the SSID, supported rates, capabilities, and other BSS parameters. Stations use them both for discovery and for timing synchronization.

Question 32802.11 Protocol Analysis

Which MAC header field allows a receiver to detect and discard a retransmitted duplicate frame?

  1. Sequence Control Correct answer.
  2. Duration/ID
  3. FCS
  4. Frame Control

Explanation

The Sequence Control field contains a 12-bit sequence number and a 4-bit fragment number. Receivers use those values to discard duplicates and to reassemble fragmented MSDUs.

Question 33802.11 Protocol Analysis

How many bytes does the CCMP header add to an MPDU?

  1. 16 bytes
  2. 8 bytes Correct answer.
  3. 4 bytes
  4. 20 bytes

Explanation

CCMP inserts an 8-byte header containing the packet number, reserved bits, and key identifier, plus a separate 8-byte MIC. The packet number serves both as the nonce and as the replay counter.

Question 34802.11 Protocol Analysis

Which message of the 802.11i 4-way handshake carries the ANonce?

  1. The fourth EAPOL-Key frame from the supplicant
  2. The third EAPOL-Key frame from the authenticator
  3. The second EAPOL-Key frame from the supplicant
  4. The first EAPOL-Key frame from the authenticator Correct answer.

Explanation

The authenticator opens the handshake with message 1, which carries the ANonce. The supplicant answers in message 2 with its SNonce and a MIC, after which both sides derive the PTK; message 3 delivers the GTK and message 4 confirms installation.

Question 35802.11 Protocol Analysis

A client performs an active scan. To which destination address does it send its probe request?

  1. The BSSID of its previously associated AP
  2. The unicast address of the AP with the strongest signal
  3. The broadcast address ff:ff:ff:ff:ff:ff Correct answer.
  4. The multicast address 01:00:5e:00:00:01

Explanation

Active scanning sends a probe request to the broadcast address so that every AP in range answers with a probe response. Passive scanning, by contrast, simply listens for beacons.

Question 36802.11 Protocol Analysis

How many bits does the QoS Control field allocate to the Traffic Identifier?

  1. 8 bits
  2. 2 bits
  3. 3 bits
  4. 4 bits Correct answer.

Explanation

The 16-bit QoS Control field begins with a 4-bit TID, which maps the frame to one of up to sixteen traffic categories. The remaining bits carry the acknowledgment policy, the A-MSDU present flag, and queue size or TXOP information.

Question 37802.11 Protocol Analysis

Which frames establish an 802.11n block acknowledgement agreement?

  1. ADDBA Request and ADDBA Response action frames Correct answer.
  2. Beacon and probe response frames
  3. RTS and CTS control frames
  4. DELBA and BAR frames

Explanation

A block ack agreement is negotiated with ADDBA Request and ADDBA Response action frames, which specify the TID, the starting sequence number, and the buffer size. Frames can then be sent as an A-MPDU and acknowledged with a Block Ack.

Question 38802.11 Protocol Analysis

What is the purpose of the SA Query procedure defined in 802.11w?

  1. To check whether an association is still valid Correct answer.
  2. To synchronize packet number counters between AP and client
  3. To query an AP for its supported cipher suites
  4. To authenticate a client with a pre-shared key before association

Explanation

With management frame protection, a station that receives an unprotected deauthentication or disassociation frame may treat it as spoofed. It uses SA Query to ask the AP whether the association still exists before acting on the frame.

Question 39802.11 Protocol Analysis

Which field of a Reassociation Request identifies the AP the station is currently associated with?

  1. The BSSID in Address 1
  2. The RSNE
  3. The SSID element
  4. The Current AP Address field Correct answer.

Explanation

A Reassociation Request carries the Current AP Address field holding the BSSID of the AP being left, so the new AP can request the station's context from it. The frame also repeats elements such as the SSID and supported rates.

Question 40802.11 Protocol Analysis

A wireless client sends a data frame to a wired server with To DS=1 and From DS=0. Which address field holds the server's MAC address?

  1. Address 3 Correct answer.
  2. Address 1
  3. Address 2
  4. Address 4

Explanation

For uplink frames, Address 1 is the AP's BSSID, Address 2 is the client's source address, and Address 3 is the destination address behind the distribution system. Address 4 appears only in WDS frames where both DS bits are set.

Question 41802.11 Protocol Analysis

What does a set More Fragments bit in the Frame Control field indicate?

  1. The frame must be retransmitted
  2. The frame carries an aggregated MSDU
  3. This is the final fragment of the MSDU
  4. Another fragment of the same MSDU follows Correct answer.

Explanation

The More Fragments flag is set on every fragment except the last, so the receiver keeps its reassembly timer running. All fragments of one MSDU share a sequence number and differ only in the fragment number subfield.

Question 42802.11 Protocol Analysis

Which element advertises 802.11n MCS support and 40 MHz capability?

  1. VHT Capabilities element
  2. HT Capabilities element Correct answer.
  3. Supported Rates element
  4. ERP Information element

Explanation

The HT Capabilities element carries the MCS set, channel width support, and other 802.11n features, while the HT Operation element describes the BSS's actual channel configuration. Earlier amendments use different elements for their own capabilities.

Question 43802.11 Protocol Analysis

Which capability was introduced by 802.11ac?

  1. Block acknowledgement
  2. MU-MIMO downlink transmissions Correct answer.
  3. Short guard interval
  4. 40 MHz channels

Explanation

802.11ac added wider channels, 256-QAM, and downlink multi-user MIMO, all negotiated through VHT Capabilities and VHT Operation elements. Block ack, 40 MHz channels, and the short guard interval arrived with 802.11n.

Question 44802.11 Protocol Analysis

What does a DTIM count of zero in a beacon indicate?

  1. The station must re-authenticate
  2. The AP has no buffered unicast traffic
  3. The AP is about to switch channels
  4. Buffered group-addressed traffic follows the beacon Correct answer.

Explanation

The TIM element carries the DTIM count and period. When the count reaches zero the beacon is a DTIM, and the AP transmits any buffered broadcast or multicast traffic immediately after it.

Question 45802.11 Protocol Analysis

Why does a power-saving station send a Null Data frame to its AP?

  1. To trigger a channel switch in the BSS
  2. To tear down its association with the AP
  3. To request buffered frames from the AP
  4. To signal a change in its power management mode Correct answer.

Explanation

Null and QoS Null frames carry no payload and exist so a station can set the Power Management bit in the Frame Control field, telling the AP it is entering or leaving power save. RetRIEVING buffered data is done with a PS-Poll instead.

Question 46802.11 Protocol Analysis

In a monitor-mode capture from a typical Linux adapter, which header precedes the 802.11 MAC header of each frame?

  1. Radiotap header Correct answer.
  2. 802.11 FCS field
  3. Ethernet II header
  4. LLC/SNAP header

Explanation

Monitor-mode captures usually prepend a radiotap header that records metadata such as channel, data rate, and signal strength, followed by the 802.11 MAC header. LLC/SNAP appears inside data frames, above the MAC header.

Question 47802.11 Protocol Analysis

How does a CCMP receiver detect a replayed MPDU?

  1. It checks the FCS and discards frames with errors
  2. It compares the TSC in the WEP IV field against the ICV
  3. It compares the 48-bit PN with the key's replay counter Correct answer.
  4. It verifies that the sequence number is greater than the last one seen

Explanation

CCMP uses a 48-bit packet number both as the nonce and as a replay counter. Any MPDU whose PN is not greater than the highest PN already accepted for that key is discarded.

Question 48802.11 Protocol Analysis

Which key does the R0KH derive and provide to a target AP so a fast transition can complete without contacting the original AP?

  1. PMK-R0
  2. GTK
  3. PMK-R1 Correct answer.
  4. PTK

Explanation

In 802.11r the R0KH holds the PMK-R0 and derives a PMK-R1 for each R1KH. Supplying the PMK-R1 in advance lets the target AP derive the PTK locally during the transition.

Question 49802.11 Protocol Analysis

Under 802.11k, which action frame does a client send to obtain information about neighboring APs?

  1. Link Measurement request
  2. Neighbor Report request Correct answer.
  3. BSS Transition Management request
  4. Beacon Report request

Explanation

A Neighbor Report request asks the AP to return a Neighbor Report listing nearby BSSIDs, channels, and PHY types. The client uses that list to make informed roaming decisions.

Question 50802.11 Protocol Analysis

What does the header of each A-MSDU subframe contain?

  1. RA, TA, and a sequence number
  2. DA, SA, and a length field Correct answer.
  3. A TID and a packet number
  4. An FCS and a duration value

Explanation

Each A-MSDU subframe starts with a 14-byte header holding the destination address, source address, and a 2-byte length, followed by the MSDU payload and padding to a 4-byte boundary.