[2025年09月] ベストCWAP Wi-Fi Analysis学習ガイドはCWAP-405試験問題集
CWAP-405認定ガイド問題と解答トレーニング
質問 # 48
How does a VoIP Phone, using WMM Power Save, request data frames buffered at the AP?
- A. The VoIP phone sets the More Data bit in the MAC Header to 1
- B. The VoIP phone transmits a PS-Poll frame
- C. The VoIP phone transmits a trigger frame, which is a QoS Null frame or a QoS Data frame
- D. The VoIP phone transmits a WMM Action frame
正解：C
解説：
A VoIP phone, using WMM Power Save, requests data frames buffered at the AP by transmitting a trigger frame, which is a QoS Null frame or a QoS Data frame. WMM Power Save is a power saving mode that allows a STA (station) to conserve battery power by periodically sleeping and waking up. WMM Power Save is based on WMM (Wi-Fi Multimedia), which is a QoS (Quality of Service) enhancement that provides prioritized and differentiated access to the medium for different types of traffic. When a STA sleeps, it cannot receive any data frames from the AP, so it informs the AP of its power save status by setting a bit in its MAC header. The AP then buffers any data frames destined for the sleeping STA until it wakes up. When a STA wakes up, it sends a trigger frame to the AP, indicating its AC (Access Category), which is a logical queue that corresponds to its QoS level. A trigger frame can be either a QoS Null frame or a QoS Data frame, depending on whether it has any payload or not. The AP then responds with one or more data frames from the same AC as the trigger frame, followed by an ACK or BA (Block Acknowledgement) frame from the STA.
The other options are not correct, as they are not used by a VoIP phone using WMM Power Save to request data frames buffered at the AP. A PS-Poll (Power Save Poll) frame is used by a STA using legacy power save mode, not WMM Power Save mode, to request data frames buffered at the AP. A PS-Poll frame does not indicate any AC or QoS information. Setting the More Data bit in the MAC header to 1 does not request any data frames from the AP, but indicates that there are more data frames to be sent by the STA or received by the STA. Transmitting a WMM Action frame does not request any data frames from the AP, but performs various management actions related to WMM features, such as admission control, parameter update, etc. References: [Wireless Analysis Professional Study Guide CWAP-405], Chapter 7: QoS Analysis, page
198-199
質問 # 49
You have implemented an AP at a remote office. It is a single-band AP supporting 802.11ac. Several users complain that their laptops cannot connect to the WLAN. These laptops are from multiple vendors and range in age from 2 to 4 years. The SSID and security profile settings are correct. All default settings were used on the AP with the exception of the SSID and security settings.
What is the most likely issue preventing these STAs from connecting to the AP?
- A. They are 5 GHz-only devices
- B. They do not support VHI and only support OFDM
- C. They do not support the basic data rates
- D. They are 2.4 GHz-only devices
正解：A
質問 # 50
You work as an SE for a value-added reseller. A client has an existing deployment of 802.11n Aps and wants to upgrade several BSSs to 802.11ac.
What hardware feature of some enterprise Aps may allow for this without a forklift upgrade?
- A. Simply check the Enable 802.11ac checkbox in the web-based configuration interface
- B. Adding an 802.11ac module to the existing APs
- C. Converting the 802.11n radio to an 802.11ac radio through software
- D. Replace the antennas with 802.11ac antennas
正解：A
質問 # 51
As a wireless network consultant you have been called in to troubleshoot a high-priority issue for one of your customers. The customer's office is based on two floors within a multi-tenant office block. On one of these floors (floor 5) users cannot connect to the wireless network. During their own testing the customer has discovered that users can connect on floor 6 but not when they move to the floor 5. This issue is affecting all users on floor 5 and having a negative effect on productivity.
To troubleshoot this issue, you perform both Spectrum and Protocol Analysis. The Spectrum Analysis shows the presence of Bluetooth signals which you have identified as coming from wireless mice. In the protocol analyzer you see the top frame on the network is Deauthentication frames. On closer investigation you see that the Deauthentication frames' source addresses match the BSSIDs of your customers APs and the destination address is FF:FF:FF:FF:FF:FF:FF.
What do you conclude from this troubleshooting exercise?
- A. The CCI from the APs on the floor 4 is the problem and you need to ask the tenant below to turn down their APs Tx power
- B. The customers APs are misbehaving and a technical support case should be open with the vendor
- C. The customer should replace all their Bluetooth wireless mice as they are stopping the users on floor 5 from connecting to the wireless network
- D. The users on floor 5 are being subjected to a denial of service attack, as this is happening across the entire floor it is likely to be a misconfigured WIPS solution belonging to the tenants on the floor below
正解：D
解説：
The users on floor 5 are being subjected to a denial of service attack, as this is happening across the entire floor it is likely to be a misconfigured WIPS solution belonging to the tenants on the floor below. This is because the Deauthentication frames have a source address that matches the BSSIDs of the customer's APs and a destination address that is a broadcast address (FF:FF:FF:FF:FF:FF). This indicates that someone is sending spoofed Deauthentication frames to all STAs associated with the customer's APs, causing them to disconnect from the wireless network. This is a common type of DoS attack on wireless networks, and it could be caused by a rogue device or a WIPS solution that is configured to protect the wireless network of another tenant on the floor below12. References: CWAP-405Certified Wireless Analysis Professional Study and Reference Guide, Chapter 13: Troubleshooting Common Wi-Fi Issues, page 4961; CWAP-405Certified Wireless Analysis Professional Study and Reference Guide, Chapter 14: Troubleshooting Tools, page 5272.
質問 # 52
Which one of the following is not a valid acknowledgement frame?
- A. Ack
- B. Block Ack
- C. CTS
- D. RTS
正解：D
解説：
RTS is not a valid acknowledgement frame. RTS stands for Request To Send, and it is a control frame that is used to initiate an RTS/CTS exchange before sending a data frame. The purpose of an RTS/CTS exchange is to reserve the medium for a data transmission and avoid collisions with hidden nodes. An acknowledgement frame is a control frame that is used to confirm the successful reception of a data frame or a block of data frames. The valid acknowledgement frames are CTS (Clear To Send), Ack (Acknowledgement), and Block Ack (Block Acknowledgement) . References: CWAP-405Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 186; CWAP-405Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 187; CWAP-405Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 189; CWAP-405Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 190.
質問 # 53
You are explaining capacity planning to another engineer assisting you on a WLAN implementation project.
As part of the explanation, you provide the following formula: C = B * log2(1 + S/N).
What does this formula define?
- A. The WEP encryption algorithm
- B. Maximum signal strength of a channel
- C. Minimum signal strength for a data rate
- D. Bandwidth capabilities of a channel
正解：D
質問 # 54
You are analyzing a packet decode of a Probe Request and notice the SSID element has a length of zero.
What do you conclude about the transmitting STA?
- A. The STA's WLAN adaptor is disabled
- B. The STA is discovering a list of available BSSs
- C. The STA is operating in Ad-Hoc mode
- D. The WLAN adaptor is configured in promiscuous mode
正解：B
解説：
The STA is discovering a list of available BSSs by sending a Probe Request with an empty SSID element.
This is also known as a broadcast Probe Request, as it does not specify any particular SSID to probe for. Any AP that receives this Probe Request will respond with a Probe Response containing its own SSID and other information about its BSS. This way, the STA can learn about all the BSSs in its vicinity and choose which one to associate with . References: CWAP-405Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 191; CWAP-405Certified Wireless Analysis Professional Study and Reference Guide, Chapter 6: MAC Sublayer Frame Exchanges, page 193.
質問 # 55
Which common feature of a Spectrum Analyzer would be the best to help you locate a non-802.11 interference source?
- A. Location filter
- B. Device finder
- C. Min hold
- D. Max hold
正解：B
解説：
The device finder is a common feature of a spectrum analyzer that helps locate a non-802.11 interference source. The device finder uses a directional antenna to measure the signal strength of a specific frequency or signal source. By pointing the antenna in different directions, the device finder can indicate the direction and distance of the interference source. The device finder can also filter out other signals that are not related to the interference source. The other options are not correct, as they do not help locate a non-802.11 interference source. Max hold and min hold are features that show the maximum and minimum RF power levels over time, respectively. Location filter is a feature that filters out signals that are not from a specific location or area. References: [Wireless Analysis Professional Study Guide CWAP-405], Chapter 3: Spectrum Analysis, page 77-78
質問 # 56
Which one of the following portions of information is communicated by bits in the PHY Header?
- A. Noise
- B. Data rate
- C. Signal strength
- D. SNR
正解：B
解説：
One of the information that is communicated by bits in the PHY header is data rate. Data rate is the speed at which data is transmitted or received over the wireless medium. Data rate depends on factors such as modulation, coding, channel width, spatial streams, and guard interval. Data rate is indicated by bits in different fields of the PHY header, depending on the type of PPDU (e.g., OFDM, HT, VHT, HE). The receiver uses these bits to determine how to decode and demodulate the rest of the PPDU. The other options are not correct, as they are not communicated by bits in the PHY header. SNR (Signal-to-Noise Ratio), noise, and signal strength are measured by the receiver based on its own capabilities and environment. References: [Wireless Analysis Professional Study Guide CWAP-405], Chapter 4: 802.11 Physical Layer, page 101-105
質問 # 57
During a VHT Transmit Beamforming sounding exchange, the beamformee transmits a Compressed Beamforming frame to the beamformer. What is communicated within this Compressed Beamforming frame?
- A. Steering Matrix
- B. Feedback Matrix
- C. Beamformee Matrix
- D. Beamforming Matrix
正解：B
解説：
The beamformee transmits a Feedback Matrix within the Compressed Beamforming frame to the beamformer.
The Feedback Matrix contains information about the channel state between the beamformee and each spatial stream of the beamformer. This information is used by the beamformer to adjust its transmit weights and optimize its signal for the beamformee34. References: CWAP-405Certified Wireless Analysis Professional Study and Reference Guide, Chapter 11: 802.11n/ac/ax PHYsical Layer Frame Exchanges, page 4033; CWAP-405Certified Wireless Analysis Professional Study and Reference Guide, Chapter 11: 802.11n/ac/ax PHYsical Layer Frame Exchanges, page 4064.
質問 # 58
ABC Company requires the ability to identify and quickly locate rogue devices. ABC has chosen an overlay WIPS solution with Wi-Fi sensors that use dipole antennas to perform this task. No other sensors are included. Use your knowledge of location tracking techniques to answer the question.
Which one of the following location methods is not available in the described system?
- A. Trilateration of RSSI measurements
- B. Time Difference of Arrival (TDoA)
- C. RF Fingerprinting
- D. GPS Positioning
正解：C
質問 # 59
In which element of a Beacon frame would you look to identity the current HT protection mode in which an AP is operating?
- A. ERP Information Element
- B. HT Capabilities Element
- C. HT Operations Element
- D. HT Protection Element
正解：C
解説：
The HT protection mode in which an AP is operating can be identified by looking at the HT Operations element in a Beacon frame. The HT Operations element is a part of the Beacon frame that contains information about the High Throughput (HT) capabilities and operation of an 802.11n BSS. The HT Operations element has a field called HT Protection, which indicates how the BSS protects its HT transmissions from interference or collisions with non-HT devices or BSSs. The HT Protection field can have four values: No Protection, Nonmember Protection, 20 MHz Protection, or Non-HT Mixed Mode. The other options are not correct, as they do not contain information about the HT protection mode. The HT Protection element does not exist, the ERP Information element is used for Extended Rate PHY (ERP) protection mode for 802.11g devices, and the HT Capabilities element is used for indicating the supported HT features of an individual device. References: [Wireless Analysis Professional Study Guide CWAP-405], Chapter 5: 802.11 MAC Sublayer, page 125-126
質問 # 60
You suspect an interfere may exist in a BSS that is experiencing sporadic problems. You want to identify and locate the device. The actual device identify is not known.
What tool should be used for this purpose?
- A. Protocol analyzer
- B. Throughput tester
- C. Spectrum analyzer
- D. Cable tester
正解：C
質問 # 61
What is the function of the PHY layer?
- A. Convert PPDUs to MSDUs for transmissions and MSDUs to PPDUs for receptions
- B. Convert PSDUs to PPDUs for transmissions and PPDUs to PSDUs for receptions
- C. Convert PPDUs to PSDUs for transmissions and PSDUs to PPDUs for receptions
- D. Convert MSDUs to PPDUs for transmissions and PPDUs to MSDUs for receptions
正解：B
解説：
The function of the PHY layer is to convert PSDUs to PPDUs for transmissions and PPDUs to PSDUs for receptions. A PSDU (PHY Service Data Unit) is the data unit that is passed from the MAC layer to the PHY layer for transmission, or from the PHY layer to the MAC layer for reception. A PPDU (PHY Protocol Data Unit) is the data unit that is transmitted or received over the wireless medium by the PHY layer. A PPDU consists of a PSDU and a PHY header, which contains information such as modulation, coding, and data rate.
The PHY layer adds or removes the PHY header to or from the PSDU during the conversion process. References: [Wireless Analysis Professional Study Guide CWAP-405], Chapter 4: 802.11 Physical Layer, page 97-98
質問 # 62
How many frames make up the Group Key Handshake excluding any Ack frames that may be required?
- A. 0
- B. 1
- C. 2
- D. 3
正解：D
解説：
The Group Key Handshake consists of two frames excluding any Ack frames that may be required. The Group Key Handshake is used to distribute and update the Group Temporal Key (GTK) for encrypting broadcast and multicast traffic. The AP initiates the Group Key Handshake by sending a Group Key Message
1 frame to a STA, which contains the new GTK and other information. The STA responds with a Group Key Message 2 frame to the AP, which confirms the receipt of the GTK and other information. After this, both the AP and the STA can use the new GTK for encryption and decryption of broadcast and multicast traffic .
References: CWAP-405Certified Wireless Analysis Professional Study and Reference Guide, Chapter 7:
802.11 Security, page 246; CWAP-405Certified Wireless Analysis Professional Study and Reference Guide, Chapter 7: 802.11 Security, page 247.
質問 # 63
You are using the real-time FFT display of a spectrum analyzer.
In what domain does this show the RF energy detected in the swept frequencies?
- A. Frequency
- B. Time
- C. Length
- D. Phase
正解：D
質問 # 64
You are performing a multiple adapter channel aggregation capture to troubleshoot a VoIP roaming problem and would like to measure the roaming time from the last VoIP packet sent on the old AP's channel to the first VoIP packet sent on the new AP's channel. Which timing column in the packet view would measure this for you?
- A. Relative
- B. Roaming
- C. Absolute
- D. Delta
正解：D
解説：
Delta is the timing column in the packet view that measures the time difference between two consecutive packets in a capture file. Delta can be used to measure the roaming time from the last VoIP packet sent on the old AP's channel to the first VoIP packet sent on the new AP's channel by selecting these two packets and looking at their delta values. The other timing columns are not suitable for this measurement because they do not show the time difference between two specific packets. Roaming is a column that shows whether a packet belongs to a roaming event or not. Relative is a column that shows the time elapsed since the beginning of the capture file. Absolute is a column that shows the date and time when a packet was captured5 References:
* CWAP-405Study Guide, Chapter 2: Protocol Analysis, page 57
* CWAP-405Objectives, Section 2.4: Analyze timing values
質問 # 65
......
ベストCWNP CWAP-405学習ガイドと問題集は2025年に更新されました：https://www.passtest.jp/CWNP/CWAP-405-shiken.html
CWAP-405認定お試しPDF最新CWAP-405問題集：https://drive.google.com/open?id=1ChmPFd8wXh0ZIytFxdRbBJxiJB6NR4lE