CWNA-109 Exam Dumps : Certified Wireless Network Administrator

DHCP (Dynamic Host Configuration Protocol) is the network service where option 43 must be configured to allow access points to locate controllers. DHCP is a protocol that allows a device to obtain an IP address and other network configuration parameters from a server. In a wireless controller scenario, the access points can use DHCP to request an IP address from a DHCP server, which can also provide the IP address or hostname of the wireless controller as an option in the DHCP response. Option 43 is a vendor-specific option that can be used to encode custom information for different types of devices. For example, Cisco access points can use option 43 to receive the IP address of the wireless controller from the DHCP server, while Aruba access points can use option 43 to receive the hostname of the wireless controller from the DHCP server. This way, the access points can discover the wireless controller and establish a connection with it. References: 1, Chapter 8, page 309; 2, Section 5.2

The string of characters and digits that is entered into an AP and a client STA for WPA2 security and is 8 characters long is called a passphrase. A passphrase is a human-readable text that is used to generate a Pre-Shared Key (PSK) for WPA2-Personal security. A passphrase can be between 8 and 63 characters long and can include any ASCII character. The PSK is a 256-bit key that is derived from the passphrase using a hashing algorithm called PBKDF2. The PSK is used to encrypt and decrypt the data frames between the AP and the client STA. A MSK is a Master Session Key that is generated by an authentication server for WPA2-Enterprise security. A WEP key is a 40-bit or 104-bit key that is used for Wired Equivalent Privacy (WEP) security, which is deprecated and insecure. A PSK is not a string of characters and digits, but a binary key. References: [CWNP Certified Wireless Network Administrator Official Study Guide: ExamCWNA-109], page 303; [CWNA: Certified Wireless Network Administrator Official Study Guide: ExamCWNA-109], page 293.

The response that you should give to your manager’s suggestion of implementing the security practices of disabling the broadcasting of the SSID in Beacons and configuring the access points not to respond to Probe Request frames that have a null SSID field is that any 802.11 protocol analyzer can see the SSID in clear text in frames other than Beacons frames. This negates any security benefit of trying to hide the SSID in Beacons and Probe Response frames. The SSID (Service Set Identifier) is a human-readable name that identifies a WLAN and allows users to connect to it. The SSID is transmitted in clear text in several types of 802.11 frames, such as Beacon frames, Probe Request frames, Probe Response frames, Association Request frames, Association Response frames, Reassociation Request frames, and Reassociation Response frames. Some people may think that hiding the SSID can improve the security of the WLAN by making it invisible to potential intruders. However, this is not true, as hiding the SSID only removes it from Beacon frames and Probe Response frames that have a null SSID field. The SSID is still present in other types of frames that can be easily captured and analyzed by any 802.11 protocol analyzer or wireless scanner tool. Therefore, hiding the SSID does not provide any real security benefit and may even cause some compatibility and performance issues for legitimate users. References: 1, Chapter 4, page 133; 2, Section 4.1