One question at a time. Build your CWNE understanding.
First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.
Continue in the practice tool above to load more questions, 50 at a time.
Aruba's modern Mobility Controllers include the 7000 series (7005/7010/7030/7205/7210/7220/7240/7280) and the new 9000-series gateways (9004/9012/9024/9240). The 9240 is the high-end. Aruba CX 8400 is a switch, not a WLC. Aruba 650 is a small office router.
Marvis is Juniper Mist's AI-driven Virtual Network Assistant (VNA). It uses ML to provide root-cause analysis, recommendations, and natural-language queries about network health. Mist Edge enables L2/L3 tunneling. Wired Assurance covers Juniper EX switches. Premium Analytics is reporting.
Aruba's two main WLAN architectures are: Mobility Controller (centralized, with Aruba 7000/9000-series gateways tunneling traffic) and Aruba Instant / IAPs (controller-less, with virtual controller elected among APs). Aruba Central can manage either via cloud. ArubaOS-Switch and ArubaOS-CX are switch operating systems.
Cisco FlexConnect (formerly H-REAP) allows a remote-site AP to forward client traffic locally at the branch switch instead of tunneling all the way back through the WLC. This saves WAN bandwidth and keeps branch Wi-Fi running during WAN outages. The control plane still flows to the WLC.
Critical Wi-Fi deployments use Cisco SSO (Stateful Switchover) with active/standby WLC pairs, Aruba VRRP-based controller HA, or N+1 controller redundancy with AP failover. Cloud-managed (Meraki, Mist) provides redundancy via vendor cloud. Designs must validate seamless failover doesn't drop voice calls.
AI/ML-driven assurance: Juniper Mist (Marvis VNA, SLE metrics), Aruba User Experience Insights (UXI), Cisco DNA/Catalyst Center (Assurance, Network Issues, AI Endpoint Analytics), Extreme ExtremeCloud IQ Co-Pilot. These platforms predict issues, identify root cause, and recommend fixes from telemetry.
Cisco DNA Assurance (now part of Catalyst Center) collects telemetry from APs, WLCs, and clients to identify network issues, root causes, and recommend fixes. It includes ML-driven baselines, time-series analytics, and AI Endpoint Analytics for client classification.
Aruba User Experience Insights (UXI) uses sensors deployed at strategic sites to actively test the WLAN like a user, generating metrics on connectivity, throughput, latency, application performance, and DNS/DHCP. ClearPass is auth/policy. Mobility Master is the legacy controller-of-controllers. Central is the cloud platform.
Juniper Mist is best known for AI-native cloud-only architecture with ML-driven RRM, client steering, root-cause analysis (Marvis), and SLE metrics. While other vendors have cloud and ML offerings, Mist was an AI-first design from inception. Now part of Juniper, also includes Mist Edge for L2/L3 tunnels.
Cloud-managed Wi-Fi with per-site survivability (local APs continue forwarding even if cloud is unreachable) is ideal for multi-site retail. Vendors: Meraki, Mist, Aruba Central, Cisco Catalyst Center. A single on-prem WLC at HQ is a single point of failure for all sites.
Aruba Instant (IAP) is controller-less - APs elect a virtual controller among themselves. Some SD-WAN platforms (Versa, Aruba EdgeConnect) integrate Wi-Fi into the SD-WAN edge. Both eliminate dedicated WLCs. Cisco/Aruba controllers are the central-controller alternative.
In Cisco SD-Access (Software-Defined Access), Wi-Fi APs integrate with the fabric by joining the WLC (which is fabric-aware), using VXLAN to tunnel traffic to fabric edge nodes, and applying Scalable Group Tags (SGTs) for micro-segmentation. This unifies wired and wireless policy.
802.11r provides the relevant fast-transition mechanisms among these choices. Neighbor assistance, transition management and protected management frames have different roles. Actual client, security and network conditions determine interruption, and neither one amendment nor their combination guarantees every voice session a fixed roaming duration.
802.11v BSS Transition Management (BTM) Request, sent as an Action frame, asks the client to roam, often with a list of candidate APs. The client may comply, defer, or refuse. 802.11k provides the neighbor list info; 802.11r handles fast key transition during roam; 802.11w protects management frames.
Vendor client steering (Aruba ClientMatch, Cisco RRM, Mist client steering, Extreme ML) uses 802.11k/v hints and timing tricks to nudge sticky clients off a far AP onto a closer or less-loaded AP. This improves overall network performance. Older, less-cooperative clients may still resist.
802.11ai introduced FILS (Fast Initial Link Setup) to speed up new associations using parallel authentication, association, and DHCP exchanges, plus PMK caching. Useful for high-density public Wi-Fi where clients connect briefly. 802.11ah is HaLow (sub-GHz IoT). 802.11p is V2X. 802.11ad is 60 GHz WiGig.
802.11r FT pre-computes PMK-R0/R1 at mobility domain key holders. When the client roams, the new AP already has the keys, and the client completes a 4-message FT exchange in milliseconds, vs hundreds of ms for full EAP. This is essential for voice and real-time apps.
OKC pre-shares the client's PMK across APs in the same mobility group. When the client roams, the new AP uses the cached PMK to skip full EAP, completing the 4-way handshake fast. OKC is non-standard but widely supported. 802.11r FT is the standardized successor; many deployments use both.
CSA (Channel Switch Announcement) is sent in beacons and action frames to tell associated clients the AP is switching to a new channel in a specified count. This minimizes disruption from DFS-triggered moves and from RRM-driven channel changes. Clients hop to the new channel without reassociating.
EAP-TLS uses mutual X.509 certificate authentication: server cert proves the RADIUS/network identity; client cert proves the user/device. It is the most secure common EAP method and is enterprise best practice. EAP-PEAP and EAP-TTLS only require server certs; the client uses passwords inside the TLS tunnel.
RadSec (RADIUS over TLS, also called RADIUS/TCP over TLS, RFC 6614) protects RADIUS exchanges with TLS, vs the legacy RADIUS over UDP with shared secret. RadSec is preferred for cross-organization RADIUS, eduroam federations, and any scenario where RADIUS traverses untrusted networks.
WPA3 mandates PMF (802.11w) - it must be required, not just capable. WPA2-mixed often has PMF capable but optional; pure WPA2-Enterprise can be configured PMF required. PMF protects deauth/disassoc/action frames from spoofing attacks.
Passpoint (Hotspot 2.0) automates discovery and authentication on partner networks using carrier or service-provider credentials (SIM via EAP-SIM/AKA, or X.509 certificate). Roaming consortium agreements let users connect without portals. Used by airports, stadiums, hotels, and large WAN service providers.
WPA3-Personal uses Simultaneous Authentication of Equals (SAE / Dragonfly), a password-authenticated key exchange that defeats offline dictionary attacks even with weak passphrases and provides forward secrecy. WPA2-PSK's 4-way handshake is vulnerable to offline cracking when the handshake is captured.
DPP (Device Provisioning Protocol, marketed as Wi-Fi Easy Connect) lets devices be onboarded by scanning a QR code or NFC tap, exchanging public keys without ever sharing the passphrase. Useful for headless IoT devices and BYOD. WPA3 includes DPP support.
Quad-radio APs (or sensor-only APs) dedicate a radio to continuous WIPS scanning and spectrum analysis, leaving client-serving radios undisturbed. Cisco aWIPS, Aruba RFProtect, Mist WIPS use this approach. In sensitive environments (financial, defense), dedicated sensor APs are deployed alongside client APs.
SAE-PK (SAE Public Key) lets a deployment expose a SAE Public Key (often shown to guests in signage or printed material). Clients use the public key to verify the AP's identity, defeating evil-twin and MitM attacks even on Personal-mode networks. Useful for cafes, hotels, conference centers.
PMF (Protected Management Frames, 802.11w) cryptographically protects deauth, disassoc, and key action frames, preventing attackers from spoofing them to kick clients off. Without PMF, deauth flooding is trivial with aircrack-ng or similar tools. PMF doesn't protect against DHCP, ARP, or DNS attacks (those need other controls).
For devices without DPP support, use per-device PSK (iPSK, PPSK, MPSK) tied to MAC and policy, or self-service onboarding portals (Cisco ISE BYOD, Aruba ClearPass Onboard, Mist Onboard) that provision per-user certs or unique keys. Both scale better than shared PSK.
WPA3 Transition mode (WPA2/WPA3 mixed) lets WPA3-capable clients use SAE while legacy clients fall back to WPA2-PSK. PMF must be capable but not required so WPA2 clients can still connect. As clients refresh, deployments move to WPA3-only with PMF required.
ANQP (Access Network Query Protocol) is part of 802.11u and underpins Passpoint / Hotspot 2.0. Carriers (AT&T, T-Mobile, Verizon) use it to authenticate phones onto Wi-Fi seamlessly via EAP-SIM/AKA, providing handoff between cellular and Wi-Fi without user interaction.
WPA2/3-Enterprise uses 802.1X port-based access control, with EAP methods (TLS, PEAP, TTLS, FAST, SIM, AKA) running over EAPoL between supplicant and authenticator. The authenticator passes EAP messages to a RADIUS server. Without 802.1X/EAP, only PSK or open modes are available.
HIPAA compliance for WLAN typically requires strong authentication (802.1X with EAP-TLS preferred), strong encryption (AES-CCMP/GCMP), VLAN/ACL segmentation between clinical and other traffic, central logging to a SIEM, and periodic vulnerability and configuration audits. Documentation matters as much as the controls.
Enterprise WPA3-Enterprise best practice: EAP-TLS with private CA, automated certificate enrollment (SCEP, MDM), PMF required, AES-CCMP-128 (or GCMP-256 for 192-bit mode), RadSec for cross-org or untrusted RADIUS paths, NAC/posture checks via Cisco ISE / Aruba ClearPass / Mist Onboard.
SAE provides forward secrecy and resists offline dictionary attacks: even with captured handshakes, attackers cannot brute-force the passphrase. WPA2-PSK 4-way handshakes can be cracked offline if the passphrase is weak. SAE makes weak passphrases far less catastrophic.
WPA3-Enterprise 192-bit mode (CNSA suite) uses ECDH P-384 for key exchange, ECDSA P-384 for signatures, AES-256-GCMP for encryption, SHA-384 for hashing, and BIP-GMAC-256 for management frame integrity. This aligns with US government CNSA requirements.
EAP-TLS security depends on clients validating the RADIUS server certificate against a trusted root CA, automated certificate enrollment and renewal (SCEP, MDM), and certificate revocation (CRL distribution or OCSP). Misconfigured clients that ignore server cert validation are vulnerable to evil-twin RADIUS attacks.
OWE (Opportunistic Wireless Encryption) replaces Open networks with unauthenticated but encrypted Wi-Fi. Each client negotiates a unique key without a password. Ideal for guest networks where pre-sharing passphrases is impractical and Open networks expose traffic. Part of WPA3.
Under PMF, unicast management frames (like deauth/disassoc directed at one client) are encrypted with the same CCMP or GCMP cipher as data frames. Broadcast/multicast management frames are protected by BIP (Broadcast/Multicast Integrity Protocol). Together they thwart common Wi-Fi attacks.
Best practice for WPA3-Enterprise (and WPA2-Enterprise) is to enforce client server cert validation against the trusted CA - clients must reject unknown RADIUS server certs. This stops evil-twin RADIUS that captures credentials. Many BYOD onboarding tools explicitly install the CA cert on devices.
iPSK (Cisco), Private PSK (Aruba), and Multi-PSK (Mist) assign a unique PSK per device or per user, often mapped to a specific VLAN or policy by RADIUS lookup based on MAC or PSK. This balances onboarding ease with per-device segmentation. Compromise of one PSK doesn't expose others.
Compliance frameworks (PCI-DSS, HIPAA, GDPR, SOX) require centralized logging of user authentication, session events, and security incidents to a SIEM (Splunk, Sentinel, QRadar) with documented retention periods. WLAN platforms must integrate with these via syslog, RADIUS accounting, or vendor APIs.
U-APSD (WMM Power Save) lets clients send a 'trigger' frame (any QoS Data) to wake the AP's buffered downlink delivery. This is more efficient than legacy PSM with TIM/PS-Poll and is critical for battery-powered VoWiFi. Wi-Fi 6 TWT goes further with explicit scheduling.
Voice and video traffic is marked with DSCP at the application/endpoint, switched and routed through the wired infrastructure preserving DSCP, and the AP maps DSCP to 802.11 User Priority and WMM access categories on egress. End-to-end QoS requires consistent marking and trust boundaries.
Reviewing AP and representative client transmit capabilities helps address an unbalanced two-way link. Actual antenna gain, receive sensitivity, path loss and regulatory limits also matter. Do not treat a generic indoor power range as universally appropriate or increase every AP to maximum solely to improve a signal indicator.
Voice-grade Wi-Fi requires cells overlapping at -67 dBm with 20-25% overlap, fast roaming protocols (802.11r/k/v) enabled, PMF, WMM, U-APSD for power efficiency, low minimum data rates disabled, and minimum SNR of 25-30 dB. Skipping any of these breaks call quality during roams.
Parabolic dish antennas provide very high gain (24+ dBi) through extremely narrow beamwidth (5-10 degrees), ideal for outdoor point-to-point bridges over kilometers. Patch antennas have moderate gain and beamwidth (60-90 degrees, 6-13 dBi). Omnidirectional has 0-5 dBi.
802.3bt Type 4 (also called UPOE+ or PoE++) provides up to ~90 W at the PSE port, enough to power high-end Wi-Fi 6E and Wi-Fi 7 APs with multi-gig uplinks and full radio operation. 802.3af is 15.4 W. 802.3at is 30 W. 802.3az is Energy Efficient Ethernet, not power delivery.
Outdoor link budget = Tx power + Tx antenna gain - Tx cable loss - FSPL (free-space path loss = 32.45 + 20log10(d_km) + 20log10(f_MHz)) + Rx antenna gain - Rx cable loss. Compare to receiver sensitivity for a fade margin (typically 10-20 dB). Also account for Fresnel zone clearance, rain fade, weather.
Hospital design prioritizes life-safety reliability: HA controllers, redundant power and uplinks, consistent RF coverage (no dead zones), RTLS for asset tracking, low-latency roaming for nurse-call and voice, segmented VLANs (clinical, medical-IoT, guest, IT), HIPAA-compliant logging, and frequent post-deployment validation.