CWNP Exam CWAP-404 Topic 1 Question 15 Discussion

Actual exam question for CWNP's CWAP-404 exam

Question #: 15
Topic #: 1

As a wireless network consultant you have been called in to troubleshoot a high-priority issue for one of your customers. The customer's office is based on two floors within a multi-tenant office block. On one of these floors (floor 5) users cannot connect to the wireless network. During their own testing the customer has discovered that users can connect on floor 6 but not when they move to the floor 5. This issue is affecting all users on floor 5 and having a negative effect on productivity.

To troubleshoot this issue, you perform both Spectrum and Protocol Analysis. The Spectrum Analysis shows the presence of Bluetooth signals which you have identified as coming from wireless mice. In the protocol analyzer you see the top frame on the network is Deauthentication frames. On closer investigation you see that the Deauthentication frames' source addresses match the BSSIDs of your customers APs and the destination address is FF:FF:FF:FF:FF:FF:FF.

What do you conclude from this troubleshooting exercise?

AThe customer should replace all their Bluetooth wireless mice as they are stopping the users on floor 5 from connecting to the wireless network

BThe users on floor 5 are being subjected to a denial of service attack, as this is happening across the entire floor it is likely to be a misconfigured WIPS solution belonging to the tenants on the floor below

CThe customers APs are misbehaving and a technical support case should be open with the vendor

DThe CCI from the APs on the floor 4 is the problem and you need to ask the tenant below to turn down their APs Tx power

Show Suggested Answer

Suggested Answer: B

802.11k Neighbor Requests and Neighbor Reports are sent in Action frames. An Action frame is a Management frame that is used to perform various operations or functions related to the operation or maintenance of a wireless network. An Action frame consists of a Category field that indicates the type of action being performed, and a variable-length Action Details field that contains specific information related to the action. For example, an Action frame with a Category field value of 5 indicates a Radio Measurement action, and the Action Details field may contain a Neighbor Request or a Neighbor Report subelement . Reference: CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 207; CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 208; CWAP-404 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 12: 802.11k/v/r/u/w/ai Amendments, page 434.

by Edna at Jul 07, 2024, 03:51 PM

Limited Time Offer

25%

Off

Get Premium CWAP-404 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Scarlet

13 days ago

I'd bet my wireless router that option B is the correct answer. Gotta love those sneaky WIPS systems, always causing more problems than they solve.

upvoted 0 times

...

Novella

18 days ago

Nah, can't be the APs on floor 4. Probably just a bunch of mice playing a prank on the floor 5 users. Better call in the exterminator!

upvoted 0 times

...

Omer

19 days ago

Hmm, the deauthentication frames pointing to the customer's APs is definitely a red flag. Looks like a vendor support case is in order.

upvoted 0 times

...

Reuben

23 days ago

Ah, the old wireless mice vs. rogue WIPS debate. I'd say option B is the way to go here. Gotta love wireless troubleshooting!

upvoted 0 times

Florinda

Yeah, it's probably a misconfigured WIPS causing the issue. The tenants on the floor below need to check their settings.

upvoted 0 times

...

Isabella

2 days ago

I agree, option B seems like the most likely scenario. Those Deauthentication frames are definitely suspicious.

upvoted 0 times

...

Werner

25 days ago

Seems like a tricky issue. The Bluetooth mice could be causing interference, but the deauthentication frames are more concerning. I'm leaning towards the WIPS solution being the culprit.

upvoted 0 times