CWSP (ABWM) study guide
CWSP · Work through your exam, one topic at a time.
The Certified Wireless Security Professional (CWSP) is CWNP's professional-level, vendor-neutral certification for securing enterprise Wi-Fi networks. It sits above the foundational CWNA and is aimed at network administrators, security engineers, consultants, and analysts who assess WLAN vulnerabilities, design authentication and encryption architectures, run security audits, and deploy Wireless Intrusion Prevention Systems. The CWSP study guide has 8 sections and about 2,429 words.
01WLAN Discovery Techniques and Intrusion and Attack Techniques
Passive discovery places a radio in monitor (RFMON) mode and listens to every 802.11 frame - beacons, probe responses, association exchanges - without transmitting. It is invisible to the network, exposes management frames a normal client never sees, and is the foundation of WIPS classification.
309 words, about 2 min02802.11 Protocol Analysis
802.11 has three frame types. Management (association request 0/response 1, reassociation 2/3, probe request 4/response 5, beacon 8, disassociation 10, authentication 11, deauthentication 12, action 13) builds and tears down relationships.
286 words, about 1 min03Wireless Intrusion Prevention Systems (WIPS) Implementation
A WIPS is an overlay of sensors (or APs with a dedicated monitor radio) feeding an engine that correlates, classifies, alerts, and optionally contains. A sensor scans one channel at a time, so coverage planning must account for dwell time; 2.4 GHz needs denser placement than 5 GHz because of co-channel overlap.
303 words, about 2 min04802.11 Authentication and Key Management (AKM) and 802.1X-EAP
Supplicant (client), authenticator (AP/WLC) and authentication server (RADIUS) exchange EAP inside EAPOL. The AP relays EAP without inspecting the method; on success the server returns keying material used to derive the PMK.
307 words, about 2 min05Building Robust Security Networks and Fast BSS Transition
An RSNA pairs 802.1X or PSK key management with a strong cipher - AES-CCMP or GCMP - and, ideally, management frame protection. WPA2-Enterprise is 802.1X plus CCMP; WPA2-Personal is PSK plus CCMP; WPA3-Personal replaces PSK with SAE for forward secrecy and dictionary resistance; WPA3-Enterprise adds a 192-bit suite; OWE encrypts open networks without credentials.
296 words, about 1 min06Layer 2 and Layer 3 VPNs and Using Secure Applications
Layer 2 VPNs carry Ethernet or PPP frames: PPTP (MS-CHAPv2, treat as broken), L2TP (no encryption on its own), and L2TP/IPsec. Layer 3 VPNs carry IP: IPsec in tunnel mode (ESP encrypts and authenticates; AH authenticates only), negotiated by IKEv1 or IKEv2 with NAT traversal, and TLS/DTLS SSL VPNs, either clientless reverse proxy or full tunnel.
340 words, about 2 min07Enterprise, SMB, SOHO and Public-Network Security Design Models
Enterprise : WLC-based deployment (CAPWAP split-MAC, cloud or distributed), redundant controllers, RADIUS/AAA with EAP-TLS for managed devices, role-based access control mapped to VLANs and ACLs, a dedicated guest SSID anchored in a DMZ, WIPS overlay, NAC with posture assessment, and MDM for BYOD certificate provisioning. SMB : fewer SSIDs, controller-less or cloud-managed APs, WPA2/WPA3-Personal or PSK plus 802.1X if a RADIUS server exists, separate guest VLAN, basic rogue detection, firmware discipline.
290 words, about 1 min08Wireless Security Policy, WNMS, Managed Endpoint Security and Compliance Monitoring
A policy states intent: all wireless access to sensitive data must be encrypted with AES-CCMP and authenticated per user. Standards specify technology - WPA2-Enterprise, EAP-TLS, TLS 1.2 or later.
298 words, about 1 min