CWSP (ABWM) study plan

Map every WLAN discovery method (passive beacon/probe sniffing, active probe request sweeps, client probing, RF spectrum sweep) to the specific frame types each one relies on.

Classify the major Layer 1/2 intrusion categories (rogue AP, evil twin, ad-hoc/soft AP, deauth/disassoc flood, beacon flood, MITM) by the observable signature each leaves in a capture.

Build a written attack-tree for each of five attack categories, listing prerequisites, observable indicators, and the countermeasure that breaks the chain.

Practice identifying at least six attack signatures in provided packet captures without looking at the answer key first.

Decode the full 802.11 MAC header field by field and explain what each Frame Control subfield changes about interpretation.

Differentiate management, control, and data frame subtypes and state which ones matter for security monitoring.

Trace a complete association and 4-way handshake exchange in a capture and annotate every frame in sequence.

Explain HT/VHT/HE capability and information element parsing well enough to spot malformed or spoofed IEs.

Diagnose at least three anomaly scenarios (retransmission storms, mismatched IEs, unexpected control frames) from captures.

Compare WIPS deployment modes (overlay, integrated, dedicated sensor) and justify a choice for three different site profiles.

Define the policy/classification pipeline from signature and anomaly detection through alarm, triage, and containment action.

Write the exact configuration logic for rogue-AP classification using authorized-AP lists, switch-port correlation, and wired-side checks.

Distinguish false-positive sources (neighbor APs, client mis-association, non-Wi-Fi interference) and prescribe tuning steps for each.

Design an escalation workflow that states who is paged, when auto-containment is allowed, and what the audit trail must capture.

Walk through the 802.11 authentication and key management (AKM) suites and match each to its enterprise or personal use case.

Diagram the complete 802.1X/EAP exchange from EAPOL-Start through PMK derivation and the 4-way handshake, naming each key at each step.

Compare at least five EAP types (EAP-TLS, PEAP, EAP-TTLS, EAP-FAST, EAP-SIM/AKA) on credential type, server certificate requirement, and known weaknesses.

Identify the specific failure mode behind downgrade, evil-twin credential capture, and misconfigured server-validation attacks on 802.1X.

Assemble the components of a robust security network (RSN) and state which ones are mandatory versus optional.

Explain OKC and 802.11r fast BSS transition key hierarchies, including PMK-R0/PMK-R1 and the role of the mobility domain.

Contrast fast roaming mechanisms against each other and against full re-authentication on latency and risk trade-offs.

Evaluate the security trade-offs of 802.11k/v/r, including known fast-transition attack surfaces and mitigations.

Differentiate Layer 2 VPN approaches (PPTP, L2TP/IPsec, and WPA2/WPA3-Enterprise tunneling) on what they actually protect.

Explain Layer 3 VPN types (IPsec mode differences, SSL/TLS VPN) and where each terminates relative to the wireless edge.

Specify how to harden common secure applications (HTTPS, SSH, RADIUS over TLS, RADIUS/IPsec) against credential and session attacks.

Identify the top weaknesses that still defeat encrypted transports: weak ciphers, certificate validation bypass, and split tunneling.

Distinguish enterprise, SMB, SOHO, and public/hotspot security design models by trust boundary and enforcement point.

Design a guest/public network that separates traffic, enforces captive portal authentication, and rate-limits abuse.

Select the right architecture for a given site (WLC-based, controller-less, cloud-managed) based on scale, guest needs, and monitoring requirements.

Apply defense-in-depth layering: segmentation/VLAN design, firewall policy, management-plane isolation, and rogue-AP handling.

Draft a wireless security policy that covers acceptable use, BYOD, guest access, key management, and incident response roles.

Define the WNMS monitoring metrics and alert thresholds you would actually configure, and tie each to a policy clause.

Describe managed endpoint security controls (posture checks, EAP-based endpoint verification, MDM integration) that gate network access.

Design a compliance monitoring cycle that continuously validates policy against configuration and produces evidence artifacts.

Re-audit the Domain 1 attack list and confirm every attack has a policy or technical control in the final plan.