CWAP study plan

Decode a full 802.11 PHY preamble and PLCP header byte-by-byte for at least three different PHY types (DSSS, OFDM, and one HT or VHT variant)

Map every field of the PPDU structure to its function and explain how a receiver uses each field during synchronization and channel estimation

Distinguish the modulation and coding scheme parameters (modulation order, coding rate, guard interval, and channel width) and calculate the resulting data rate for at least four MCS configurations

Identify the differences between legacy, HT, VHT, and HE preamble formats and explain why each new format was introduced

Explain how OFDM subcarrier allocation, pilot tones, and guard intervals affect spectral efficiency and robustness

Describe the purpose of beamforming and MU-MIMO sounding in the PHY and identify the frames used in the sounding process

Compare the spectral mask and transmit power requirements across 2.4 GHz, 5 GHz, and 6 GHz bands

Interpret PHY-layer metrics such as RSSI, SNR, and EVM and explain how each relates to frame reception success

Diagram the general MAC frame format and label every field, including Frame Control subfields, duration/ID, address fields, sequence control, and FCS

Classify all management frame subtypes and state the purpose and key fields of each

Differentiate the four address field usage patterns (To DS / From DS combinations) and map each to a network topology

Explain the role of the Frame Check Sequence and how a receiver validates a frame

Analyze control frame subtypes (RTS, CTS, ACK, Block ACK, PS-Poll, and trigger frames) and explain when each is used

Describe the structure of data frames and the QoS Control field, including TID and ACK policy bits

Explain the Block ACK agreement setup, ADDBA and DELBA exchange, and how the scoreboard works

Identify how frame aggregation (A-MPDU and A-MSDU) changes frame structure and overhead

Trace the complete station join process from probe request through association, authentication, and the four-way handshake

Explain the CSMA/CA contention procedure, including DIFS, backoff, and the role of the NAV

Describe the power save mechanisms (legacy, WMM-PS, and U-APSD) and the frame exchanges that support them

Identify the frames involved in roaming and explain how a client decides to transition between APs

Analyze a channel scan to identify overlapping BSSs, co-channel interference, and adjacent-channel interference

Interpret a spectrum analyzer waterfall and identify signatures of microwave ovens, Bluetooth, cordless phones, and video cameras

Explain how channel width, channel bonding, and regulatory constraints interact in the 5 GHz and 6 GHz bands

Correlate PHY-layer metrics with observed throughput and retransmission behavior

Set up a protocol analyzer with a supported adapter and capture both management and data traffic on a monitor-mode interface

Apply display filters to isolate specific frame exchanges, retransmissions, and malformed frames

Diagnose at least three common problems (excessive retries, low data rates, failed authentication) using capture evidence

Explain the difference between capture-level and protocol-level analysis and when each is appropriate

Review every domain's key concepts and close remaining knowledge gaps identified from practice assessments

Complete at least two full-length timed practice exams and analyze every missed question by domain

Re-derive the most commonly tested calculations (data rate, airtime, and throughput) from memory

Build a personal cheat sheet of frame formats, field values, and troubleshooting decision trees