必ず合格できるCWNP CWSP-208試験の正確な122問題と解答あります [Q64-Q83]

必ず合格できるCWNP CWSP-208試験の正確な122問題と解答あります

最新 [2025年12月17日]2025年最新の実際にある検証済みのCWSP-208問題集

質問 # 64
Given: ABC Company is implementing a secure 802.11 WLAN at their headquarters (HQ) building in New York and at each of the 10 small, remote branch offices around the United States. 802.1X/EAP is ABC's preferred security solution, where possible. All access points (at the HQ building and all branch offices) connect to a single WLAN controller located at HQ. Each branch office has only a single AP and minimal IT resources.
What security best practices should be followed in this deployment scenario?

A. An encrypted VPN should connect the WLAN controller and each remote controller-based AP, or each remote site should provide an encrypted VPN tunnel to HQ.
B. Remote management of the WLAN controller via Telnet, SSH, HTTP, and HTTPS should be prohibited across the WAN link.
C. RADIUS services should be provided at branch offices so that authentication server and supplicant credentials are not sent over the Internet.
D. APs at HQ and at each branch office should not broadcast the same SSID; instead each branch should have a unique ID for user accounting purposes.

正解：A

解説：
Because all APs (even those at branch offices) connect to a central controller:
Their control/data traffic must traverse the public internet or WAN.
VPNs (IPSec, GRE, or similar) ensure confidentiality and integrity of authentication traffic and user data over insecure links.
Incorrect:
B). Using different SSIDs complicates management and user experience unnecessarily.
C). Remote RADIUS at small branches contradicts the goal of centralized management.
D). Remote access protocols (SSH, HTTPS) should be secured, not entirely prohibited, to allow remote management.
References:
CWSP-208 Study Guide, Chapter 6 (Remote AP Security)
CWNP Controller-Based Architecture Deployment Guide

質問 # 65
In what deployment scenarios would it be desirable to enable peer-to-peer traffic blocking?

A. In corporate Voice over Wi-Fi networks with push-to-talk multicast capabilities
B. At public hot-spots in which many clients use diverse applications
C. In university environments using multicast video training sourced from professor's laptops
D. In home networks in which file and printer sharing is enabled

正解：B

解説：
Peer-to-peer blocking (also called client isolation) is useful in open or public WLANs to prevent devices from communicating directly with each other.
B). In public hot-spots, isolating users helps protect against malware spread, snooping, and attacks from nearby devices.
Incorrect:
A). In home networks, peer-to-peer communication is often desired for file sharing.
C). Voice over Wi-Fi may rely on peer communication (e.g., multicast).
D). In university setups using multicast, peer-to-peer restrictions could hinder functionality.
References:
CWSP-208 Study Guide, Chapter 3 (Access Control and WLAN Policies)
CWNP WLAN Best Practices for Public Networks

質問 # 66
Given: A large enterprise is designing a secure, scalable, and manageable 802.11n WLAN that will support thousands of users. The enterprise will support both 802.1X/EAP-TTLS and PEAPv0/MSCHAPv2. Currently, the company is upgrading network servers as well and will replace their existing Microsoft IAS implementation with Microsoft NPS, querying Active Directory for user authentication.
For this organization, as they update their WLAN infrastructure, what WLAN controller feature will likely be least valuable?

A. WIPS support and integration
B. SNMPv3 support
C. WPA2-Enterprise authentication/encryption
D. 802.1Q VLAN trunking
E. Internal RADIUS server

正解：E

解説：
In a large enterprise:
A central RADIUS (like Microsoft NPS) connected to Active Directory is preferred for scalability and centralized policy control.
WLAN controller internal RADIUS servers are minimal and not scalable for thousands of users.
Incorrect:
A). WPA2-Enterprise is essential for strong security.
C). WIPS support is vital for intrusion detection/prevention.
D). VLAN trunking is needed for network segmentation.
E). SNMPv3 is important for secure device monitoring and management.
References:
CWSP-208 Study Guide, Chapter 6 (WLAN Controller Capabilities and Scalability) CWNP Enterprise WLAN Design

質問 # 67
Which one of the following is a valid reason to avoid the use of EAP-MD5 in production WLANs?

A. It is not a valid EAP type.
B. It does not support mutual authentication.
C. It does not support the outer identity.
D. It does not support a RADIUS server.

正解：B

解説：
EAP-MD5:
Only authenticates the client.
Does not provide mutual authentication, making it vulnerable to man-in-the-middle attacks.
It also does not protect the user's identity or credentials in a secure tunnel.
Incorrect:
A). The outer identity concept is not relevant to EAP-MD5 since it doesn't support tunneling.
B). EAP-MD5 is a valid EAP type, just insecure.
D). It can be used with a RADIUS server, but security is insufficient.
References:
CWSP-208 Study Guide, Chapter 4 (EAP Method Comparison)
CWNP EAP Implementation Considerations

質問 # 68
What wireless authentication technologies may build a TLS tunnel between the supplicant and the authentication server before passing client authentication credentials to the authentication server? (Choose 3)

A. PEAPv0/MSCHAPv2
B. EAP-TLS
C. EAP-MD5
D. EAP-TTLS
E. LEAP

正解：A、B、D

解説：
All three EAP methods - EAP-TLS, PEAPv0, and EAP-TTLS - establish a secure TLS tunnel between the supplicant and the authentication server before client credentials are passed:
B). EAP-TLS uses mutual certificate authentication inside a TLS tunnel.
D). PEAPv0/MSCHAPv2 creates a TLS tunnel and then authenticates the user with MSCHAPv2 inside the tunnel.
E). EAP-TTLS creates a TLS tunnel and then supports legacy credentials (e.g., PAP, CHAP, MSCHAPv2) securely within it.
Incorrect:
A). EAP-MD5 does not use TLS at all.
C). LEAP is not TLS-based and is considered insecure.
References:
CWSP-208 Study Guide, Chapter 4 (TLS-Based EAP Methods)
CWNP EAP Protocol Comparison Matrix

質問 # 69
Which of the following security attacks cannot be detected by a WIPS solution of any kind? (Choose 2)

A. DoS
B. Social engineering
C. Rogue APs
D. Eavesdropping

正解：B、D

解説：
Wireless Intrusion Prevention Systems (WIPS) are excellent for detecting on-air threats such as rogue APs, DoS attacks, spoofing, and misconfigured devices. However, WIPS cannot detect:
C). Eavesdropping - Passive listening on wireless transmissions cannot be detected because no signal is transmitted by the attacker.
D). Social engineering - Human-based attacks like phishing or pretexting fall outside the scope of wireless monitoring.
Incorrect:
A). Rogue APs can be detected via MAC address comparison, frame analysis, and signal triangulation.
B). DoS attacks, such as deauth floods or RF jamming, can be detected with appropriate WIPS sensors.
References:
CWSP-208 Study Guide, Chapter 5 (WLAN Threats and Attacks)
CWNP WIPS Implementation Guidelines
CWNP Whitepapers on Wireless Threat Detection Capabilities

質問 # 70
Your organization required compliance reporting and forensics features in relation to the 802.11ac WLAN they have recently installed. These features are not built into the management system provided by the WLAN vendor. The existing WLAN is managed through a centralized management console provided by the AP vendor with distributed APs and multiple WLAN controllers configured through this console.
What kind of system should be installed to provide the required compliance reporting and forensics features?

A. Cloud management platform
B. WIPS overlay
C. WIPS integrated
D. WNMS

正解：B

解説：
When compliance reporting and forensic analysis are required and the WLAN vendor's centralized management system does not provide it, deploying a dedicated overlay WIPS is the most effective solution.
Overlay WIPS uses dedicated sensors independent of the WLAN's operational radios, offering detailed threat detection, compliance logging, and reporting capabilities that often surpass native WLAN features.
References:
CWSP-208 Study Guide, Chapter 7 - Overlay vs Integrated WIPS
CWNP CWSP-208 Objectives: "Compliance Monitoring and Forensics"

質問 # 71
What WLAN client device behavior is exploited by an attacker during a hijacking attack?

A. When the RF signal between a client and an access point is disrupted for more than a few seconds, the client device will attempt to associate to an access point with better signal quality.
B. After the initial association and 4-way handshake, client stations and access points do not need to perform another 4-way handshake, even if connectivity is lost.
C. When the RF signal between a client and an access point is lost, the client will not seek to reassociate with another access point until the 120 second hold down timer has expired.
D. As specified by the Wi-Fi Alliance, clients using Open System authentication must allow direct client- to-client connections, even in an infrastructure BSS.
E. Client drivers scan for and connect to access points in the 2.4 GHz band before scanning the 5 GHz band.

正解：A

解説：
Hijacking attacks often rely on exploiting client behavior during signal disruption. Clients will seek better connections when RF is weak or interrupted. An attacker may:
Disrupt the signal (e.g., with a deauth attack)
Present a rogue access point (evil twin) with stronger signal
Trick the client into associating with the rogue AP, hijacking the session Incorrect:
B). There is no standard 120-second timer behavior.
C). Loss of connectivity typically triggers reassociation and reauthentication.
D). Direct client-to-client connections are not required in infrastructure mode.
E). Band selection logic varies and is unrelated to hijacking attacks.
References:
CWSP-208 Study Guide, Chapter 5 (Hijacking and Client Behavior)
CWNP Wi-Fi Threat Analysis

質問 # 72
What attack cannot be detected by a Wireless Intrusion Prevention System (WIPS)?

A. Hot-spotter
B. Deauthentication flood
C. Soft AP
D. EAP flood
E. MAC Spoofing
F. Eavesdropping

正解：F

解説：
WIPS (Wireless Intrusion Prevention Systems) monitor the RF environment and detect unauthorized activities. However, eavesdropping involves passive listening to wireless communications without transmitting any signals. Because the attacker is not transmitting or generating any detectable activity, a WIPS has no RF signal to detect and is thus unable to identify or prevent this attack.
References:
CWSP-208 Study Guide, Chapter 5 - Threats and Attacks
CWNP CWSP-208 Official Exam Objectives: "WLAN Threats", "WIPS Capabilities and Limitations"

質問 # 73
Given: During 802.1X/LEAP authentication, the username is passed across the wireless medium in clear text.
From a security perspective, why is this significant?

A. The username can be looked up in a dictionary file that lists common username/password combinations.
B. 4-Way Handshake nonces are based on the username in WPA and WPA2 authentication.
C. The username is an input to the LEAP challenge/response hash that is exploited, so the username must be known to conduct authentication cracking.
D. The username is needed for Personal Access Credential (PAC) and X.509 certificate validation.

正解：C

解説：
In Cisco LEAP (Lightweight EAP), the username is sent in clear text as part of the 802.1X authentication process. LEAP uses a challenge/response authentication mechanism that is susceptible to offline dictionary attacks because the attacker only needs to know the username and capture the challenge/response exchange to perform brute-force guessing of passwords. The username is used in generating the hash for the authentication exchange, making its disclosure critical for an attacker.
Incorrect:
A). PACs are used in EAP-FAST, not LEAP.
C). The 4-Way Handshake nonces are unrelated to the username.
D). While dictionary files may include username/password combos, the cryptographic significance in LEAP is due to the challenge/response mechanism.
References:
CWSP-208 Study Guide, Chapter 4 (EAP Types and Authentication Attacks)
CWNP Whitepaper: LEAP Vulnerabilities

質問 # 74
When implementing a WPA2-Enterprise security solution, what protocol must the selected RADIUS server support?

A. EAP
B. LDAP
C. LWAPP, GRE, or CAPWAP
D. CCMP and TKIP
E. IPSec/ESP

正解：A

解説：
WPA2-Enterprise relies on the IEEE 802.1X framework for authentication, which requires the use of the Extensible Authentication Protocol (EAP). The RADIUS server must support EAP to facilitate the exchange of authentication credentials and method negotiation between the client (supplicant) and the authentication server.
Incorrect:
A). LWAPP, GRE, and CAPWAP are used between APs and controllers-not for client authentication.
B). IPSec/ESP is a VPN protocol, not relevant here.
D). CCMP and TKIP are encryption protocols used between clients and APs, not within the RADIUS server.
E). LDAP may be queried by the RADIUS server, but it is not sufficient on its own-it doesn't replace EAP.
References:
CWSP-208 Study Guide, Chapter 4 (802.1X Authentication Framework)
CWNP AAA Architecture Overview

質問 # 75
You are configuring seven APs to prevent common security attacks. The APs are to be installed in a small business and to reduce costs, the company decided to install all consumer-grade wireless routers. The wireless routers will connect to a switch, which connects directly to the Internet connection providing 50 Mbps of Internet bandwidth that will be shared among 53 wireless clients and 17 wired clients.
To ensure the wireless network is as secure as possible from common attacks, what security measure can you implement given only the hardware referenced?

A. WPA2-Enterprise
B. 802.1X/EAP-PEAP
C. WPA2-Personal
D. WPA-Enterprise

正解：C

解説：
Given that only consumer-grade routers are used and no RADIUS server or enterprise infrastructure is mentioned, WPA2-Personal is the most secure option available. It uses a pre-shared key (PSK) for authentication and AES-CCMP for encryption, offering strong protection for small businesses lacking enterprise equipment.
Enterprise methods such as WPA2-Enterprise, 802.1X, and EAP-PEAP require a RADIUS server or authentication backend, which isn't supported in typical consumer-grade routers.
References:
CWSP-208 Study Guide, Chapter 3 (WLAN Security Technologies)
CWNP Wi-Fi Security Deployment Guide for Small Businesses
CWNP E-Learning Modules: WPA2-PSK vs WPA2-Enterprise

質問 # 76
Wireless Intrusion Prevention Systems (WIPS) provide what network security services? (Choose 2)

A. Policy enforcement and compliance management
B. Wireless vulnerability assessment
C. Analysis and reporting of AP CPU utilization
D. Application-layer traffic inspection
E. Configuration distribution for autonomous APs

正解：A、B

解説：
WIPS systems provide proactive security by continuously scanning for threats and ensuring WLAN policy compliance. Their capabilities include:
B). Wireless vulnerability assessment: Scanning for misconfigured APs, weak encryption, and unauthorized devices.
E). Policy enforcement and compliance: Ensuring security settings adhere to enterprise or regulatory requirements and alerting on deviations.
Other options like application-layer inspection and AP CPU monitoring are outside the WIPS function scope.
References:
CWSP-208 Study Guide, Chapter 7 - WIPS Services and Capabilities
CWNP CWSP-208 Objectives: "WIPS Threat Mitigation and Enforcement"

質問 # 77
Given: In a security penetration exercise, a WLAN consultant obtains the WEP key of XYZ Corporation's wireless network. Demonstrating the vulnerabilities of using WEP, the consultant uses a laptop running a software AP in an attempt to hijack the authorized user's connections. XYZ's legacy network is using 802.11 n APs with 802.11b, 11g, and 11n client devices.
With this setup, how can the consultant cause all of the authorized clients to establish Layer 2 connectivity with the software access point?

A. All WLAN clients will reassociate to the consultant's software AP if the consultant's software AP provides the same SSID on any channel with a 10 dB SNR improvement over the authorized AP.
B. A higher SSID priority value configured in the Beacon frames of the consultant's software AP will take priority over the SSID in the authorized AP, causing the clients to reassociate.
C. If the consultant's software AP broadcasts Beacon frames that advertise 802.11g data rates that are faster rates than XYZ's current 802.11b data rates, all WLAN clients will reassociate to the faster AP.
D. When the RF signal between the clients and the authorized AP is temporarily disrupted and the consultant's software AP is using the same SSID on a different channel than the authorized AP, the clients will reassociate to the software AP.

正解：D

解説：
Clients seek connectivity when their connection is lost. If the attacker broadcasts a matching SSID on a different channel and the client is disconnected (via RF jamming or deauthentication), the client will often reassociate with the stronger signal or first-responding AP broadcasting the same SSID, even if it's rogue.
Incorrect:
A). SNR alone doesn't force reassociation-clients consider multiple factors.
B). SSID priority is not a standardized field influencing client behavior.
D). Clients won't reassociate based purely on advertised data rates unless connectivity is disrupted and other AP parameters are more attractive.
References:
CWSP-208 Study Guide, Chapter 5 (Hijacking and Evil Twin Attacks)
CWNP Roaming Behavior and Signal Loss Analysis
IEEE 802.11-2016 Standard (Association and Reassociation Behavior)

質問 # 78
Given: An 802.1X/EAP implementation includes an Active Directory domain controller running Windows Server 2012 and an AP from a major vendor. A Linux server is running RADIUS and it queries the domain controller for user credentials. A Windows client is accessing the network.
What device functions as the EAP Supplicant?

A. Windows client
B. Windows server
C. An unlisted switch
D. Linux server
E. Access point
F. An unlisted WLAN controller

正解：A

解説：
In an 802.1X/EAP authentication model:
Supplicant: The device requesting access (the Windows client).
Authenticator: The AP or switch enforcing access decisions.
Authentication Server: The RADIUS server (Linux in this case), which communicates with a backend credential database (Active Directory).
The Windows client runs the EAP supplicant software to initiate authentication.
Incorrect:
A). The Linux server is the Authentication Server (not Supplicant).
C). The AP acts as the Authenticator.
D). The Windows Server is the credential store, not the supplicant.
References:
CWSP-208 Study Guide, Chapter 4 (802.1X Roles and Communication)
CWNP 802.1X Architecture Diagram

質問 # 79
Given: A WLAN consultant has just finished installing a WLAN controller with 15 controller-based APs.
Two SSIDs with separate VLANs are configured for this network, and both VLANs are configured to use the same RADIUS server. The SSIDs are configured as follows:
SSID Blue - VLAN 10 - Lightweight EAP (LEAP) authentication - CCMP cipher suite SSID Red - VLAN 20 - PEAPv0/EAP-TLS authentication - TKIP cipher suite The consultant's computer can successfully authenticate and browse the Internet when using the Blue SSID.
The same computer cannot authenticate when using the Red SSID.
What is a possible cause of the problem?

A. The TKIP cipher suite is not a valid option for PEAPv0 authentication.
B. The client does not have a proper certificate installed for the tunneled authentication within the established TLS tunnel.
C. The Red VLAN does not use server certificate, but the client requires one.
D. The consultant does not have a valid Kerberos ID on the Blue VLAN.

正解：B

解説：
PEAPv0/EAP-TLS is a tunneled EAP method that requires:
The server to present a certificate for TLS tunnel establishment.
The client to present a valid client certificate within the tunnel (in the case of EAP-TLS).
If the client does not have a valid X.509 certificate installed, authentication will fail.
Incorrect:
A). The server certificate is required for the TLS tunnel, and it is typically present; the issue here lies with the client cert.
B). TKIP is technically compatible with PEAPv0, although AES-CCMP is preferred.
D). Kerberos is unrelated to EAP authentication and VLAN use.
References:
CWSP-208 Study Guide, Chapter 4 (PEAP and EAP-TLS Authentication)
IEEE 802.1X and TLS Frameworks

質問 # 80
What is one advantage of using EAP-TTLS instead of EAP-TLS as an authentication mechanism in an 802.11 WLAN?

A. EAP-TTLS supports client certificates, but EAP-TLS does not.
B. EAP-TTLS sends encrypted supplicant credentials to the authentication server, but EAP-TLS uses unencrypted user credentials.
C. EAP-TTLS does not require an authentication server, but EAP-TLS does.
D. EAP-TTLS does not require the use of a certificate for each STA as authentication credentials, but EAP- TLS does.

正解：D

解説：
EAP-TLS requires both server and client-side digital certificates, which adds complexity in client certificate management.
EAP-TTLS uses a server certificate to establish a secure TLS tunnel, after which user credentials (e.g., username/password) are sent inside the encrypted tunnel. No client certificate is needed.
Incorrect:
A). EAP-TLS also encrypts credentials using TLS.
B). EAP-TLS supports client certificates (it's the core requirement).
C). Both EAP methods require an authentication server.
References:
CWSP-208 Study Guide, Chapter 4 (EAP Methods Comparison)
CWNP EAP-TTLS Deployment Guide

質問 # 81
What security vulnerabilities may result from a lack of staging, change management, and installation procedures for WLAN infrastructure equipment? (Choose 2)

A. The WLAN system may be open to RF Denial-of-Service attacks
B. Management interface exploits due to the use of default usernames and passwords for AP management
C. WIPS may not classify authorized, rogue, and neighbor APs accurately
D. Authentication cracking of 64-bit Hex WPA-Personal PSK
E. AES-CCMP encryption keys may be decrypted

正解：B、C

解説：
Without proper staging, change management, and installation procedures, significant vulnerabilities may arise:
(B) WIPS relies on a known database of authorized APs and clients. If devices are deployed without proper registration and staging, WIPS cannot accurately classify devices as authorized, rogue, or neighbor.
(D) If APs are installed without changing default credentials, attackers can exploit them through common web or SNMP-based management interfaces.
This undermines both operational visibility and network security posture.
References:
CWSP-208 Study Guide, Chapter 8 - WLAN Security Design and Architecture CWNP CWSP-208 Official Objectives: "Security Design and Policy Implementation"

質問 # 82
Role-Based Access Control (RBAC) allows a WLAN administrator to perform what network function?

A. Allow simultaneous support for multiple EAP types on a single access point.
B. Allow access to specific files and applications based on the user's WMM access category.
C. Minimize traffic load on an AP by requiring mandatory admission control for use of the Voice access category.
D. Provide two or more user groups connected to the same SSID with different levels of network privileges.

正解：D

解説：
RBAC enables dynamic assignment of different access privileges (e.g., VLAN, ACLs, bandwidth) to users even when they connect through the same SSID. This simplifies SSID management while maintaining fine- grained access control.
Incorrect:
A). Admission control is a QoS/WMM function, not RBAC.
B). Access category (AC) affects frame prioritization, not file/app access.
D). Multiple EAP types are supported in authentication servers-not directly tied to RBAC.
References:
CWSP-208 Study Guide, Chapter 6 (Role-Based Access Control and SSID Simplification)

質問 # 83
......

CWNP CWSP-208 認定試験の出題範囲：

トピック	出題範囲
トピック 1	脆弱性、脅威、攻撃：この試験セクションでは、ネットワークインフラストラクチャエンジニアがWLANシステム内の脆弱性と脅威を特定し、軽減する能力を評価します。受験者は、CVEデータベースなどの信頼できる情報源を用いてリスクを評価し、修復策を適用し、隔離プロトコルを実装することが求められます。また、この分野では盗聴やフィッシングなどの攻撃の検知と対応にも重点を置いています。侵入テスト、ログ分析、SIEMシステムやWIPS WIDSなどの監視ツールの使用も含まれます。さらに、資産管理、リスク評価、損失計算などのリスク分析手順を網羅し、情報に基づいたリスク管理計画の策定をサポートします。
トピック 2	セキュリティライフサイクル管理：この試験セクションでは、ネットワークインフラストラクチャエンジニアが、新しいテクノロジーの特定から継続的な監視と監査に至るまで、セキュリティライフサイクル全体を監督する能力を評価します。新しいWLAN実装に関連するリスクを評価し、適切な保護を適用し、SIEMなどのツールを使用してコンプライアンスチェックを実行する能力が問われます。受験者は、効果的な変更管理、保守戦略、そして脆弱性を検出し、洞察に富んだセキュリティレポートを生成するための監査ツールの活用能力も実証する必要があります。評価には、ユーザーインタビューの実施、アクセス制御のレビュー、スキャンの実行、組織の目標に沿った調査結果の報告などのタスクが含まれます。
トピック 3	WLAN セキュリティ設計とアーキテクチャ：この試験では、確立されたポリシーに沿って適切な WLAN セキュリティソリューションを選択し、導入する無線セキュリティアナリストの能力に重点が置かれます。WPA2、WPA3、802.1X EAP、ゲストアクセス戦略などの認証メカニズムの実装、AES や VPN などの適切な暗号化方式の選択などが含まれます。さらに、このセクションでは、無線監視システムに関する知識、AKM プロセスの理解、VLAN、ファイアウォール、ACL などの有線セキュリティシステムをセットアップして無線インフラストラクチャをサポートする能力も評価されます。受験者は、安全なクライアントオンボーディングの管理、NAC の設定、802.11r などのローミング技術の実装能力もテストされます。最後に、パブリックネットワークの保護、一般的な設定エラーの回避、脆弱なセキュリティプロトコルに関連するリスクの軽減に関する実践を評価します。
トピック 4	セキュリティポリシー：このセクションでは、ワイヤレスセキュリティアナリストのスキルを評価し、WLANセキュリティ要件がどのように定義され、組織のニーズと整合されているかを検証します。規制および技術ポリシーの評価、関係者の関与、インフラストラクチャおよびクライアントデバイスのレビューに重点が置かれます。また、高レベルのセキュリティポリシーがライフサイクル全体にわたってどの程度適切に作成、承認、維持されているか、関係者の継続的な意識向上とコンプライアンス確保のためのトレーニング活動も含め、評価されます。