I85PREP
⌘ K
CWT study materials
CWT study resources

CWT: Wireless Security Fundamentals and Site Survey Basics

CWT · Work through your exam, one topic at a time.

All guide sections

Wireless Security Fundamentals and Site Survey Basics

Wireless Security Fundamentals and Site Survey Basics

This domain tests security choices and the survey process: encryption and authentication, rogue detection, requirements gathering, survey types, and documentation.

Security standards

  • WEP uses RC4 with static keys and is broken; WPA used TKIP and is deprecated; WPA2 uses AES-CCMP; WPA3 uses SAE for personal networks and 192-bit Suite B for enterprise.
  • Enterprise networks use 802.1X/EAP: the client authenticates to a RADIUS server, often with EAP-TLS (certificates) or PEAP-MSCHAPv2 (credentials inside a TLS tunnel).
  • WPA3-SAE resists offline dictionary attacks; OWE encrypts open networks without a password. 802.11w management frame protection helps against forged deauthentication frames.
  • Rogue AP detection and WIPS compare neighboring BSSIDs against authorized inventories; evil twins imitate a legitimate SSID.

Site survey basics

  • Start with requirements: coverage areas, client types, capacity, applications, security, and roaming needs.
  • Predictive surveys model RF using floor plans and AP placement; passive surveys listen to existing APs; active surveys associate and measure actual throughput; AP-on-a-stick places one AP at candidate locations.
  • Validation surveys confirm the installed design. Document heat maps, SNR, channel plans, data rates, and problem areas.
  • Survey with the same antenna type, orientation, and client adapter class you will deploy; a laptop adapter is not a phone.

Worked example

A warehouse needs voice coverage and handheld scanners. Predictive modeling shows −60 dBm in the aisles, but the validation survey finds −72 dBm near racking because metal inventory absorbs and reflects RF. The reasoning: predictive tools use open-floor assumptions; validation measures the real environment. The fix is additional APs or directional antennas aimed down aisles, then revalidation.

Traps

  • Treating WEP or TKIP as acceptable because clients are old.
  • Assuming hidden SSIDs or MAC filtering provide real security.
  • Doing only a predictive survey and skipping validation.
  • Surveying with a different adapter or antenna than production.
  • Forgetting capacity and roaming, not just coverage.