CWNE cheat sheet

dB, dBm and dBi use different references.

A usable link needs both directions and appropriate receiver behavior.

Propagation and attenuation need actual assumptions and measurements.

Signal/noise arithmetic does not define a universal acceptance threshold.

Requirements and acceptance evidence lead the design.

Capacity depends on airtime and representative concurrent demand.

Channel width and infrastructure choices are contextual.

Documentation and validation must make assumptions and limits visible.

Predictive, passive, active and spectrum methods answer different questions.

Instrument and representative-client assumptions affect interpretation.

A beacon or spectrum reading does not prove a complete user service.

Reports must distinguish measurements, inferences and proposed changes.

Management location does not alone determine the client data path.

Association, identity, keying, addressing and application stages differ.

Roaming assistance and application-session continuity are different.

QoS differentiation is not a deterministic airtime guarantee.

802.1X framework, EAP method and data protection are distinct.

SAE does not eliminate the later four-way handshake.

Validate the intended server identity and actual client trust behavior.

PMF and detection tools have specific coverage and response limits.

Locate the actual failed client/service stage.

Capture coverage depends on adapter, channel and placement.

A missing observation is different from proof an event never occurred.

Validate representative outcomes and document limited conclusions.

Identification, authentication, authorisation and accounting are four distinct steps.

MFA needs two different factor categories, not two instances of one.

RBAC suits stable job roles; ABAC suits context-dependent, fine-grained rules.

Kerberos uses a KDC with TGT and service tickets for SSO.

Symmetric ciphers handle bulk data; asymmetric ciphers solve key distribution and signatures.

Signing uses a specified signature scheme with the signer’s private key; verification and custody are essential to origin evidence.

ECB leaks patterns; use authenticated modes such as GCM or encrypt-then-MAC.

Asset inventory and configuration baselines underpin every operational control.

Changes need an appropriate authorization path, recovery planning and relevant evidence.

Emergency changes still require retrospective documentation within a defined window.

Monitor log sources for silence, not just for events.

Distinguish historical Revision 2 phases from current NIST incident-response guidance integrated with broader risk management.

Containment precedes eradication in almost every scenario.

Capture volatile evidence (memory, connections) before disk and before power-off.

Distinguish tolerated data loss from tolerated interruption.

A recovery point and restore time must both meet the stated targets.

A same-failure-domain snapshot alone does not cover loss of that domain.

Verify complete restore procedures and actual dependency behavior.