A corporate office complains of intermittent Wi-Fi drops on channel 149 (5745 MHz). A spectrum analyzer shows a signal with a ~75% duty cycle that appears for 2-3 seconds at a time, sweeps across a 20 MHz channel width, and has a very fast rise time. The signal is present even when no Wi-Fi devices are actively transmitting. Which non-802.11 device is the most likely source of this interference?
Answer and explanation
Correct answer: C
Analog wireless video cameras operating in the 5.8 GHz ISM band are notorious for this RF signature. They transmit a wideband signal with a high duty cycle that can completely occupy a 20 MHz channel. Bluetooth operates in the 2.4 GHz band, and microwave ovens, while powerful interferers, also operate at 2.4 GHz. A misconfigured AP would show a valid 802.11 preamble and modulation, which is not described.
Question 2
A network uses WMM for QoS. A protocol capture of a VoIP call shows that voice packets (AC_VO) are experiencing high latency. Analysis of the AP's beacon frames reveals the following EDCA Parameter Set for AC_VO: AIFSN=2, CWmin=3, CWmax=7, TXOP Limit=1504 µs. The capture also shows frequent transmissions from clients in the Best Effort queue (AC_BE) with AIFSN=3, CWmin=15, CWmax=1023, TXOP Limit=0. What is the most likely cause of the high latency for voice traffic?
The provided EDCA parameters are the default and recommended values. AIFSN=2 for Voice gives it a shorter medium contention time than Best Effort (AIFSN=3). The CWmin/max values for Voice are much smaller than for Best Effort, giving it a significant statistical advantage. The TXOP allows for bursting. If voice traffic is still experiencing high latency with these correct parameters, it's highly indicative of extreme medium contention, where even the prioritized access for AC_VO is not enough to overcome the sheer volume of other traffic.
Question 3
A user is unable to connect to a WPA2-Personal network. A frame capture shows the client receiving Message 1 (ANonce) from the AP and sending Message 2 (SNonce, MIC). However, the AP never sends Message 3. Instead, after a timeout, the AP retransmits Message 1. This cycle repeats. What is the most probable cause of this failure?
Answer and explanation
Correct answer: A
In the 4-way handshake, Message 2 contains a Message Integrity Code (MIC) calculated using the PSK. When the AP receives Message 2, it calculates its own MIC and compares it. If they don't match (indicating an incorrect PSK on the client), the AP will discard the frame and not proceed to Message 3. It will typically retransmit Message 1 after a timeout, leading to the observed cycle. The other options would result in different failure symptoms.
Question 4
A wireless analyzer captures a data frame where the To DS bit is 1 and the From DS bit is 1 in the Frame Control field. Which type of communication does this frame represent?
graph TD
subgraph BSS1
STA1[Client STA 1]
end
subgraph BSS2
STA2[Client STA 2]
end
AP1((Access Point 1))
AP2((Access Point 2))
STA1 -- Frame --> AP1
AP1 -- WDS Link --- AP2
AP2 -- Frame --> STA2
linkStyle 1 stroke:#f00,stroke-width:2px,fill:none;
Answer and explanation
Correct answer: D
The combination of To DS=1 and From DS=1 is used exclusively for frames that are being forwarded from one access point to another over a Wireless Distribution System (WDS) or a mesh link. This indicates the frame has been received from the wireless medium by the first AP and is being sent back out onto the wireless medium to reach the second AP.
Question 5
A large retail warehouse uses handheld scanners connected via a 5 GHz 802.11ac network. Scanners frequently disconnect and reconnect, taking 5-10 seconds each time, which causes significant productivity loss. The network uses WPA2-Enterprise with EAP-TLS.
A wireless engineer is tasked with identifying the root cause. The engineer performs a multi-channel capture near a problematic area and filters for the MAC address of a failing scanner. The capture shows the scanner roams from AP-1 to AP-2. The reassociation with AP-2 is successful and happens within 50ms.
However, a full EAP-TLS exchange follows the reassociation, which takes over 6 seconds to complete before the 4-way handshake can begin. The RADIUS server is located on a remote corporate network accessible over a WAN link. Analysis of the EAP exchange shows significant delays between the RADIUS server's messages.
What is the most likely issue and the best remediation step?
Answer and explanation
Correct answer: C
The capture analysis clearly shows that the reassociation itself is fast (50ms), but the subsequent full EAP-TLS authentication is taking over 6 seconds. This is the root cause of the delay. EAP-TLS requires multiple round trips to the RADIUS server, which is slow over a WAN. Implementing 802.11r (Fast BSS Transition) is the designed solution for this problem. It allows the client to establish security keys with the new AP via the existing AP (over-the-DS) or directly, bypassing the lengthy RADIUS exchange on subsequent roams within the same mobility domain.
Question 6
An analyst examines a captured 802.11ax frame using Wireshark. The Radiotap header contains the "HE Information" field. Within this field, BSS Color is set to 12, and the UL/DL flag is set to 1 (Uplink). What is the primary purpose of the BSS Color value in this context?
Answer and explanation
Correct answer: B
BSS Coloring is a spatial reuse technique introduced in 802.11ax. A station can detect a frame from an OBSS and, if the signal is below a certain threshold, ignore it and transmit simultaneously, even if its carrier sense mechanism would normally defer. The BSS color is a value from 1-63 that identifies frames belonging to a particular BSS, allowing STAs to make this differentiation and improving medium efficiency in dense environments.
Question 7
Multiple answers
A network administrator needs to verify that an access point is correctly advertising support for WPA3-Personal and 802.11k for assisted roaming. Which TWO of the following Information Elements should be present and correctly configured in the AP's Beacon and Probe Response frames? (Select TWO)
Answer and explanation
Correct answers: B, E
The RSN (Robust Security Network) Information Element is used to advertise the security capabilities of the BSS. For WPA3-Personal, the AKM suite selector within the RSN IE would be set to indicate support for SAE (Simultaneous Authentication of Equals).
The RM (Radio Measurement) Enabled Capabilities element (part of the 802.11k amendment) is used to indicate that the AP supports radio measurement features, such as providing Neighbor Reports to clients, which is a key part of 802.11k assisted roaming.
Question 8
True or False: In the 802.11 DCF contention mechanism, a station that wins contention and transmits a frame must wait for a DIFS period plus a new random backoff before transmitting its next frame, even if the medium remains idle after it receives the ACK.
Answer and explanation
Correct answer: A
This statement is true. DCF is designed to provide fair access to the medium. To prevent a single station from monopolizing the channel, every station must contend for each transmission opportunity. After a successful transmission (frame and ACK), the station must wait for the medium to be idle for a DIFS period and then begin a new random backoff procedure before it can transmit again.
Question 9
A spectrum analyzer in a dense office environment shows the following on the 2.4 GHz band: A strong 802.11g signal centered on channel 6. Another slightly weaker 802.11g signal is also visible, centered on channel 7. The energy from the channel 7 signal bleeds significantly into the frequency space of channel 6. How should this interference be classified, and what is its primary impact?
Answer and explanation
Correct answer: B
This is a classic example of Adjacent Channel Interference (ACI). The AP on channel 7 is 'adjacent' but also 'overlapping' with channel 6. Unlike CCI, where devices on the same channel can understand each other's transmissions and defer properly, ACI introduces raw RF energy (noise) into the adjacent channel. This raises the noise floor and can corrupt frames, preventing clear reception and decoding, which leads to retransmissions and poor performance. CCI is interference from a device on the same channel.
Question 10
A protocol capture of a file transfer shows an AP sending a Block Ack Request (BAR) frame to a client. The BAR frame's 'Starting Sequence Number' is 100. The client responds with a Block Ack (BA) frame. The BA's bitmap field, when decoded, indicates that frames with sequence numbers 101, 102, and 104 were received successfully, but 100 and 103 were not. What will the AP do next?
Answer and explanation
Correct answer: A
The Block Ack mechanism allows for selective retransmission. The bitmap in the Block Ack frame informs the transmitter exactly which frames in the block were received successfully. The AP will use this information to retransmit only the missing frames, which in this case are those with sequence numbers 100 and 103. This is much more efficient than retransmitting the entire block.
