All certifications / CWNA / Cheat sheet

CWNA CWNA-109 cheat sheet

Every exam tip and key term from the free CWNA lessons, by domain. Use your browser's Print to save it as a PDF.

Domain 1: Radio frequency (RF) technologies (15%)

Exam tips

Remember the inverse relationship: higher frequency means shorter wavelength. Questions often describe it indirectly, for example asking which band gives larger coverage at equal power (2.4 GHz) or which band needs smaller antenna elements (the higher one).
Know which material maps to which behavior: metal and coated glass cause reflection, water and people cause absorption, chain-link fence and foliage cause scattering, and building edges cause diffraction. Also remember that FSPL happens even in a perfect vacuum.
Always apply the same step to both columns: +10 dB is x10 mW and +3 dB is x2 mW. Watch for questions that mix dBi and dBd; convert everything to dBi by adding 2.14 before you calculate EIRP.
SNR is a subtraction of two dBm values and the answer is in dB. Also remember that RSSI is vendor-defined and not directly comparable between devices, a point exam questions like to test.
IR power is measured before the antenna, and EIRP after it. If a question asks for the power at the antenna input, do not add antenna gain. If it asks for EIRP, subtract losses and add gain in dBi (convert dBd first).
Higher gain does not add power; it reshapes the pattern. A higher-gain omni gets farther horizontally but has a narrower vertical beamwidth, which can leave poor coverage directly underneath.
Beamwidth is measured at the half-power points, 3 dB below peak, not at the edge of coverage. Azimuth means horizontal (top-down) and elevation means vertical (side view); exams often swap them to test you.
Clear visual line of sight does not guarantee RF line of sight. The Fresnel zone is widest at the midpoint and larger at lower frequencies and longer distances; keep blockage under 40 percent and ideally under 20 percent.
In the notation 3x3:2, the first number is transmit chains, the second receive chains and the third spatial streams. The streams in use are limited by the less capable device, usually the client.
Know the bits per symbol: BPSK 1, QPSK 2, 16-QAM 4, 64-QAM 6, 256-QAM 8, 1024-QAM 10. Higher modulation always needs higher SNR. OFDM serves one user per transmission; OFDMA divides the channel among several.

Key terms

Frequency: The number of cycles an RF wave completes each second, measured in hertz (Hz).
Wavelength: The distance a wave travels during one complete cycle; it equals the speed of light divided by the frequency.
Amplitude: The height or strength of a wave, which relates to signal power.
Phase: The position of a wave in its cycle relative to another wave of the same frequency, measured in degrees.
Hertz (Hz): The unit of frequency, one cycle per second; Wi-Fi uses GHz, or billions of cycles per second.
Reflection: A wave bouncing off a smooth surface larger than its wavelength, such as metal or coated glass.
Diffraction: A wave bending around an obstacle, leaving an RF shadow behind it.
Scattering: A wave splitting into many weaker reflections after hitting an uneven surface or many small objects.
Absorption: Loss of RF energy as a material converts it to heat; water, people and concrete absorb strongly.
Free space path loss (FSPL): Signal weakening caused by the wavefront spreading out with distance, about 6 dB for each doubling of distance.
Multipath: Multiple copies of a signal reaching a receiver at different times over different paths.
dB (decibel): A relative, logarithmic comparison of two power levels; +3 dB doubles power and +10 dB multiplies it by ten.
dBm: Decibels referenced to 1 milliwatt, so 0 dBm equals 1 mW; used for absolute power.
dBi: Antenna gain relative to a theoretical isotropic radiator.
dBd: Antenna gain relative to a dipole antenna; dBi equals dBd plus 2.14.
Rule of 10s and 3s: A mental method for converting mW and dBm by adding or subtracting 10 dB (multiply or divide by 10) and 3 dB (double or halve).
RSSI: Received Signal Strength Indicator, a vendor-specific relative value radios use to represent received signal; not comparable across vendors.
Noise floor: The background RF energy level on a channel when no Wi-Fi transmission is present, measured in dBm.
SNR: Signal-to-noise ratio, the difference in dB between received signal and noise floor.
Receive sensitivity: The weakest signal, in dBm, at which a radio can decode frames at a particular data rate.
Fade margin: Extra signal designed above receive sensitivity so a link keeps working when the signal fluctuates.
Link budget: A calculation of all gains and losses from transmitter to receiver used to predict received signal and margin.
Intentional radiator (IR): The transmitter plus cabling and connectors up to, but not including, the antenna; its power is measured at the antenna input.
EIRP: Equivalent Isotropically Radiated Power, the power radiated in the antenna's strongest direction: transmit power minus losses plus antenna gain.
Cable loss: Signal attenuation in coaxial cable, which increases with cable length and with frequency.
Omnidirectional antenna: An antenna that radiates in all horizontal directions, producing a doughnut-shaped pattern.
Semi-directional antenna: An antenna that focuses energy in one general direction; includes patch, panel, Yagi and sector types.
Yagi antenna: A semi-directional antenna using a row of parallel elements to produce a relatively narrow beam.
Sector antenna: A semi-directional antenna designed to cover a defined horizontal slice, often combined on a tower to cover 360 degrees.
Parabolic dish: A highly directional antenna with a very narrow beam and high gain, used for long point-to-point links.
Beamwidth: The angle between the half-power (-3 dB) points of an antenna's main lobe, given for horizontal and vertical planes.
Polarization: The orientation of a radio wave's electric field, usually vertical or horizontal for Wi-Fi antennas.
Azimuth chart: A radiation pattern showing the horizontal plane, viewed from above.
Elevation chart: A radiation pattern showing the vertical plane, viewed from the side.
Gain: How strongly an antenna focuses energy in its main direction relative to a reference, in dBi or dBd.
Visual line of sight: A clear straight line of sight between two antennas as seen by eye.
RF line of sight: A path in which the Fresnel zone around the visual line is sufficiently free of obstructions for RF.
Fresnel zone: An ellipsoid-shaped region around the direct path between antennas that must be kept mostly clear for a strong link.
Earth bulge: The curvature of the earth rising into the path of long links, which must be added to antenna height calculations.
Radio chain: A complete transmit or receive path in a radio, consisting of an antenna and its associated electronics.
Spatial stream: An independent data stream transmitted simultaneously on the same channel using spatial multiplexing.
Transmit beamforming (TxBF): Adjusting phase and amplitude across multiple antennas so signals combine constructively at a target receiver.
MU-MIMO: Multi-user MIMO, in which an AP sends or receives separate spatial streams to or from several clients at the same time.
Maximal ratio combining (MRC): A receive technique that combines signals from multiple antennas to improve SNR.
DSSS: Direct sequence spread spectrum, the 802.11 and 802.11b technique that spreads each bit across a 22 MHz channel with a code.
OFDM: Orthogonal frequency division multiplexing, which splits a channel into many orthogonal subcarriers carrying data in parallel.
OFDMA: Orthogonal frequency division multiple access, an 802.11ax extension that assigns subsets of subcarriers to different users at once.
QAM: Quadrature amplitude modulation, which encodes several bits per symbol by varying both amplitude and phase.
MCS index: A number identifying a combination of modulation, coding rate and, in 802.11n, spatial streams.

Domain 2: WLAN regulations and standards (20%)

Exam tips

The IEEE does not certify products and does not set power limits. If a question asks who tests interoperability, answer Wi-Fi Alliance; who sets legal power, answer the local regulator such as the FCC; who defines RADIUS or EAP, answer the IETF.
Wi-Fi 6E is the same 802.11ax amendment as Wi-Fi 6, just in 6 GHz. Wi-Fi 5 (802.11ac) is 5 GHz only, while Wi-Fi 4 and Wi-Fi 6 operate in both 2.4 and 5 GHz.
Match names to bands: OFDM (a) and VHT (ac) are 5 GHz only; DSSS, HR-DSSS and ERP are 2.4 GHz only; HT (n) and HE (ax) are dual band, and HE also operates in 6 GHz.
Channels 1, 6 and 11 are the only three non-overlapping channels when 1 to 11 are allowed. Overlapping channels (ACI) cause corruption, which is usually worse than co-channel contention, where devices simply take turns.
Wider channels increase peak rate but reduce the number of channels for reuse and raise the noise floor. In dense enterprise designs, 20 or 40 MHz is often the right choice in 5 GHz.
6 GHz requires WPA3 or Enhanced Open with PMF; WPA2 and open networks are not allowed. Put 6 GHz primary channels on PSCs and remember RNR, sent in 2.4 and 5 GHz beacons, helps clients find 6 GHz APs.
DFS protects radar in U-NII-2A and U-NII-2C. Remember the sequence: channel availability check before use, in-service monitoring, move off with a Channel Switch Announcement on detection, then a non-occupancy period.
OFDMA shares frequency (resource units), MU-MIMO shares space (spatial streams). Uplink MU-MIMO and OFDMA are new in 802.11ax; downlink MU-MIMO started with 802.11ac. BSS coloring is about spatial reuse, not security.
Match problem to amendment: which AP is nearby (k), network suggests moving (v), fast secure key exchange (r), protect deauth and disassoc frames (w). The client always makes the final roaming decision, even with 802.11v.
Regulators usually limit EIRP, so changing to a higher-gain antenna can make an installation illegal unless transmit power is reduced. The administrator, not the vendor, is responsible for setting the correct country code.

Key terms

IEEE: The standards body that creates and maintains the 802.11 standard defining the Wi-Fi PHY and MAC layers.
Wi-Fi Alliance: An industry group that certifies interoperability of Wi-Fi products and created WPA2, WPA3, WMM and the Wi-Fi generation names.
IETF: The Internet Engineering Task Force, which publishes RFCs defining protocols such as RADIUS, EAP and CAPWAP.
FCC: The United States Federal Communications Commission, which regulates spectrum use, power limits and device certification.
Amendment: An addition to the 802.11 standard identified by letters, such as 802.11ax, later rolled into a revised base standard.
Wi-Fi 4: The Wi-Fi Alliance name for 802.11n (HT), in 2.4 and 5 GHz.
Wi-Fi 5: The Wi-Fi Alliance name for 802.11ac (VHT), in 5 GHz only.
Wi-Fi 6 and 6E: 802.11ax (HE); Wi-Fi 6E is 802.11ax operating in the 6 GHz band.
Wi-Fi 7: The Wi-Fi Alliance name for 802.11be (EHT), adding 320 MHz channels, 4096-QAM and multi-link operation.
Passpoint: A Wi-Fi Alliance certification that lets devices automatically discover and securely connect to hotspots.
PHY: A physical layer specification in the 802.11 standard, defining how bits are transmitted over the air.
ERP: Extended Rate PHY from 802.11g, bringing OFDM rates up to 54 Mbps to 2.4 GHz with backward compatibility.
HT: High Throughput PHY from 802.11n, with MIMO, 40 MHz channels and rates up to 600 Mbps.
VHT: Very High Throughput PHY from 802.11ac, 5 GHz only, with up to 160 MHz channels and 256-QAM.
HE: High Efficiency PHY from 802.11ax, with OFDMA, 1024-QAM and operation in 2.4, 5 and 6 GHz.
ISM band: Industrial, Scientific and Medical band; unlicensed spectrum that includes 2.4 GHz and is shared by many device types.
Channel overlap: The situation where signals on nearby channel numbers occupy overlapping frequencies because channels are 5 MHz apart but signals are 20 to 22 MHz wide.
Adjacent channel interference (ACI): Interference from devices on overlapping channels that corrupts frames because the devices do not defer to each other.
Co-channel contention (CCC): Airtime sharing among devices on the same channel that hear each other and take turns under medium access rules.
U-NII: Unlicensed National Information Infrastructure, the US naming for 5 GHz (and 6 GHz) sub-bands.
Channel bonding: Combining adjacent 20 MHz channels into 40, 80 or 160 MHz channels for higher data rates.
Primary channel: The 20 MHz channel within a bonded channel on which beacons and basic medium access take place.
Center frequency formula: In 5 GHz, center frequency in MHz = 5000 + 5 x channel number.
Preferred Scanning Channel (PSC): One of a subset of 6 GHz 20 MHz channels, one per 80 MHz block, that clients scan first when discovering APs.
Reduced Neighbor Report (RNR): An element in 2.4 and 5 GHz beacons and probe responses that advertises co-located 6 GHz BSSs.
Enhanced Open (OWE): A Wi-Fi Alliance certification using Opportunistic Wireless Encryption to encrypt open networks without a password.
AFC: Automated Frequency Coordination, a system Standard Power 6 GHz devices consult to avoid interfering with licensed users.
DFS: Dynamic Frequency Selection, which requires Wi-Fi devices to detect radar and vacate the channel.
Channel Availability Check (CAC): The listening period before transmitting on a DFS channel to confirm no radar is present.
Non-occupancy period: The time, commonly 30 minutes, a channel may not be used after radar is detected on it.
TPC: Transmit Power Control, an 802.11h mechanism that allows devices to reduce transmit power, including through the Power Constraint element.
Channel Switch Announcement: An element that tells associated clients the AP is moving to a new channel and when.
Resource unit (RU): A group of OFDMA subcarriers, such as 26, 52, 106 or 242 tones, assigned to one client within a transmission.
Trigger frame: An 802.11ax control frame that schedules uplink OFDMA or uplink MU-MIMO transmissions from multiple clients.
BSS coloring: A number from 1 to 63 in the HE header that identifies a BSS so radios can distinguish overlapping BSS traffic and apply spatial reuse.
Target Wake Time (TWT): A negotiated schedule for when a client wakes to communicate, improving battery life and reducing contention.
1024-QAM: A modulation carrying 10 bits per symbol, added in 802.11ax as MCS 10 and 11.
802.11k: Radio Resource Measurement, providing neighbor reports and other measurements that help clients choose roaming targets.
802.11v: Wireless Network Management, including BSS Transition Management requests that suggest a better AP to a client.
802.11r: Fast BSS Transition, which pre-distributes keys so clients can roam without repeating full 802.1X and the 4-way handshake.
802.11w: Protected Management Frames, adding integrity protection to deauthentication, disassociation and robust action frames.
Regulatory domain: The set of spectrum rules (channels, power, DFS) for a country, selected on equipment with a country code.
Conducted power: The transmit power delivered by the radio to the antenna system, before antenna gain.
Point-to-point (PtP): A link between exactly two fixed sites, often allowed more antenna gain because of its narrow beam.
3:1 rule: An FCC 2.4 GHz rule for fixed PtP links: reduce transmitter power by 1 dB for every 3 dBi of antenna gain above 6 dBi.

Domain 3: WLAN protocols and devices (20%)

Exam tips

Know the type of each frame: beacons, probes, authentication, association and action frames are management; ACK, RTS, CTS, Block Ack and PS-Poll are control; null data is a data frame even though it carries no payload.
Address 1 is always the receiver and Address 2 is always the transmitter. With To DS set, Address 1 is the BSSID; with From DS set, Address 2 is the BSSID. Four addresses appear only when both bits are 1.
Order matters: scan, 802.11 authenticate, associate, then 802.1X/EAP (if Enterprise), then the 4-way handshake. Open System authentication is not security; real authentication happens with 802.1X/EAP or SAE.
Physical carrier sense is CCA (signal detect and energy detect); virtual carrier sense is the NAV, set from the Duration field. Wi-Fi avoids collisions and relies on ACKs because a half-duplex radio cannot detect collisions while transmitting.
SIFS is always the shortest and is used for ACKs and CTS responses, which is how an exchange keeps control of the medium. A lower AIFSN and smaller CWmin give an access category higher priority.
Know the four categories in order (voice, video, best effort, background) and that UP 1 and 2 map to background, below UP 0 best effort. Priority comes from lower AIFSN and smaller contention windows; it is statistical, not guaranteed.
RTS/CTS helps with hidden nodes because the receiver's CTS warns stations near the AP. CTS-to-self is cheaper but does not solve hidden nodes. Both reduce throughput because they add overhead.
TIM is for buffered unicast traffic and appears in every beacon; DTIM governs buffered broadcast and multicast. A longer DTIM period saves battery but delays multicast. U-APSD replaces one-frame-at-a-time PS-Poll with a trigger and a burst.
A-MSDU uses one header and one FCS, so any error loses the whole frame; A-MPDU gives each subframe its own header and FCS so only failed subframes are resent. The Retry bit marks retransmissions, and a high retry percentage is a key health indicator.
The client always decides when to roam. 802.11k helps it find candidates (neighbor reports), 802.11v lets the network suggest a move (BTM), and 802.11r speeds up the security exchange during the roam.
Watch for questions that mix up where configuration lives and where data flows. Cloud-managed APs are configured from the cloud, but client traffic is normally forwarded locally, not through the cloud.

Key terms

Management frame: An 802.11 frame type used to discover, join, maintain and leave a BSS, such as beacons, probes, authentication and association.
Control frame: An 802.11 frame type that assists delivery and medium access, such as ACK, RTS, CTS and Block Ack.
Data frame: An 802.11 frame type carrying upper-layer payload, including QoS Data; null data frames carry no payload.
Beacon: A management frame sent periodically by an AP to advertise the BSS and its capabilities.
Null data frame: A data frame with no payload, commonly used to signal power management state to the AP.
BSSID: The 48-bit MAC address that uniquely identifies a BSS, usually derived from the AP radio's MAC.
SSID / ESSID: The logical network name; ESSID refers to the name shared across all BSSs in an extended service set.
Transmitter address (TA): The MAC address of the radio that sent the frame over the air.
Receiver address (RA): The MAC address of the radio intended to receive the frame over the air.
To DS / From DS: Frame Control bits indicating whether a frame is going to or coming from the distribution system, which define address field meanings.
Passive scanning: Discovering networks by listening for beacons on each channel.
Active scanning: Discovering networks by sending probe requests and receiving probe responses.
Open System authentication: A two-frame 802.11 authentication exchange that performs no real identity verification.
Association identifier (AID): A number the AP assigns to a client in the association response, used in the TIM for power management.
4-way handshake: An EAPOL-Key exchange that confirms both parties hold the PMK and derives the PTK and delivers the GTK.
CSMA/CA: Carrier Sense Multiple Access with Collision Avoidance, the 802.11 method of sensing the medium and using backoff and ACKs to avoid and detect failed transmissions.
DCF: Distributed Coordination Function, the basic 802.11 contention-based access method used by all stations.
Clear Channel Assessment (CCA): Physical carrier sense that uses signal detect and energy detect thresholds to decide whether the medium is busy.
NAV: Network Allocation Vector, a timer set from the Duration field of heard frames that provides virtual carrier sense.
Duration/ID field: A MAC header field stating how long, in microseconds, the medium will be busy for the current exchange.
SIFS: Short interframe space, the shortest wait, used between frames of an ongoing exchange such as data and ACK.
DIFS: DCF interframe space, equal to SIFS plus two slot times, used by non-QoS stations before contending.
AIFS: Arbitration interframe space, a per-access-category wait used by QoS stations, equal to SIFS plus AIFSN times the slot time.
Contention window: The range of slots from which a station picks its random backoff, starting at CWmin and growing after failures up to CWmax.
Slot time: The basic timing unit for backoff, 9 microseconds for OFDM PHYs and 20 microseconds for DSSS.
WMM: Wi-Fi Multimedia, the Wi-Fi Alliance certification of 802.11e QoS features based on EDCA.
EDCA: Enhanced Distributed Channel Access, the QoS contention method using per-access-category AIFS and contention windows.
Access category: One of four WMM priority queues: voice, video, best effort and background.
User priority (UP): An 802.1D priority value from 0 to 7 that determines a frame's access category.
TXOP: Transmit opportunity, a time period during which a station may send multiple frames after winning contention.
RTS/CTS: A Request to Send and Clear to Send exchange that reserves the medium for both sender and receiver neighborhoods before a data frame.
CTS-to-self: A protection method in which the sender transmits a CTS addressed to itself to reserve the medium before sending data.
Use_Protection bit: A flag in the ERP element of beacons indicating that ERP stations must use protection because non-ERP stations are present.
Hidden node: A station that cannot hear another station transmitting to the same AP, leading to collisions at the AP.
RTS threshold: A configurable frame size above which a station uses RTS/CTS before transmitting.
Power Management bit: A Frame Control bit a client sets to tell the AP it is entering power save mode.
TIM: Traffic Indication Map, a beacon element with a bitmap by AID showing which sleeping clients have buffered unicast traffic.
DTIM: Delivery Traffic Indication Message, a special TIM after which the AP sends buffered broadcast and multicast frames.
U-APSD: Unscheduled Automatic Power Save Delivery, the WMM Power Save method in which a client trigger frame prompts delivery of buffered frames.
PS-Poll: A legacy control frame a client sends to retrieve one buffered unicast frame from the AP.
A-MSDU: Aggregate MSDU, multiple payloads in one MPDU sharing a single MAC header and FCS.
A-MPDU: Aggregate MPDU, multiple complete MPDUs, each with its own header and FCS, sent in one PHY transmission.
Block Ack: A control frame with a bitmap that acknowledges multiple frames at once, set up with ADDBA action frames.
Retry flag: A Frame Control bit set on retransmitted frames, used to detect duplicates and to measure retry rates.
Frame Control field: The first MAC header field, containing protocol version, type, subtype and flags such as To DS, From DS, Retry and Protected Frame.
Roaming: A client moving its association from one AP to another in the same ESS.
Reassociation: The management frame exchange a client uses to associate with a new AP during a roam, including the previous AP's BSSID.
Sticky client: A client that stays associated with a distant AP despite a better AP being available.
BSS Transition Management (BTM): An 802.11v mechanism that lets an AP suggest better APs to a client, which may accept or decline.
Neighbor report: An 802.11k response listing nearby APs and their channels to speed client scanning.
Autonomous AP: An AP that stores its own configuration and makes its own decisions without a controller or cloud manager.
Controller-managed AP: A lightweight AP that receives configuration and coordination from a central WLAN controller, often over a CAPWAP or vendor tunnel.
Mesh AP: An AP that uses a wireless backhaul through other APs to reach a wired root AP.
PSE: Power sourcing equipment: the switch port (endspan) or injector (midspan) that supplies PoE power.
PD: Powered device: the equipment, such as an AP, that is powered by PoE.

Domain 4: WLAN network architecture and design concepts (15%)

Exam tips

Exam questions often ask which plane is affected by an outage. Losing a cloud manager affects management; losing a controller that tunnels traffic affects the data plane too.
If a question mentions a single choke point, WAN hairpinning or controller throughput limits, the answer usually favors local forwarding; if it stresses central policy, guest isolation or simple roaming, tunneled forwarding fits.
When a question asks what to do first in a design project, the answer is usually to gather and document requirements, not to run a survey or pick hardware.
Strong signal does not mean enough capacity. If a scenario shows good RSSI but poor performance with many users, think airtime and capacity rather than coverage.
Co-channel contention is about devices deferring to each other (lost capacity), while adjacent channel interference is about overlapping energy that corrupts frames (retries). The exam tests this distinction.
If a question asks why calls drop while roaming even though signal is acceptable, look for a lack of secondary coverage or missing fast-roaming support rather than raising AP power.
In high-density scenarios, the correct answer is rarely to increase power. Look for lower power, more APs, directional antennas, narrower channels and more use of 5 and 6 GHz.
When a question describes high utilization with few users, suspect beacon overhead from too many SSIDs and low basic rates.
Remember the rule: a client must support every basic rate to join the BSS, and management frames go out at the lowest basic rate. Raising that rate cuts overhead and cell size.
Distinguish per-port limits from the total switch budget. A switch may support 802.3at on every port but not have enough total power to run all ports at full PoE+ at once.

Key terms

Management plane: Functions used to configure, monitor, upgrade and report on network devices.
Control plane: Functions that coordinate the network during operation, such as RF management, roaming and client tracking.
Data plane: The forwarding of user traffic between the wireless and wired networks.
Split MAC: An architecture where time-critical 802.11 MAC functions stay on the AP and other MAC functions move to a controller.
Tunneled forwarding: Client traffic is encapsulated from the AP to a controller, which then places it on the wired network.
Local forwarding: The AP bridges client traffic directly onto its own switch port, usually with VLAN tags.
Hairpinning: Traffic that travels to a central point and back even though its source and destination are close together.
CAPWAP: Control and Provisioning of Wireless Access Points, an IETF protocol for AP-to-controller control and data tunnels.
Client capability: The bands, PHYs, spatial streams, security and roaming features a client device supports.
Density: The number of active devices competing for airtime in a given area at the same time.
Constraint: A limit on the design, such as budget, building materials, mounting restrictions, cabling, policy or regulation.
Coverage design: A design that primarily ensures a usable signal everywhere, typically with fewer APs at higher power.
Capacity design: A design that ensures enough airtime and throughput for the expected devices and applications, typically with more APs at lower power.
Airtime: The time a channel is occupied by transmissions; the shared resource that all devices on a channel compete for.
Cell: The area around an AP in which clients can associate and communicate with it.
Channel reuse plan: An assignment of channels to APs that keeps same-channel APs as far apart as possible.
Co-channel contention (CCC): Airtime sharing that happens when devices on the same channel hear each other and defer under CSMA/CA.
Adjacent channel interference (ACI): Interference from transmitters on overlapping neighboring channels, which raises noise and corrupts frames.
Channel width: The amount of spectrum a channel occupies, such as 20, 40, 80 or 160 MHz.
-67 dBm: A commonly used minimum received signal target for voice-grade Wi-Fi coverage.
SNR: Signal-to-noise ratio, the difference in dB between received signal strength and the noise floor.
Secondary coverage: Coverage from a second AP on a different channel at a usable level everywhere, supporting roaming and redundancy.
Jitter: Variation in packet delay, which disrupts real-time audio and video.
High-density WLAN: A network where a large number of devices compete for airtime in a small area, making capacity the main design concern.
Directional antenna: An antenna that focuses energy in a particular direction, such as a patch or panel, used to shape and separate cells.
Body loss: Attenuation of RF signals caused by human bodies, which are mostly water.
SSID: Service set identifier, the logical name of a wireless network.
802.1Q trunk: A switch link that carries multiple VLANs by adding a VLAN tag to Ethernet frames.
Native VLAN: The VLAN whose frames are sent untagged on an 802.1Q trunk.
Dynamic VLAN assignment: Placing a user into a VLAN based on attributes returned by RADIUS after 802.1X authentication.
Basic rate: A data rate a client must support to associate; management and broadcast frames are often sent at the lowest basic rate.
Supported rate: A rate the AP can use for data but does not require clients to support.
Band steering: A technique that encourages dual-band clients to associate on 5 or 6 GHz instead of 2.4 GHz.
Load balancing: Techniques that spread clients across APs to avoid overloading any single AP.
802.3af: The original PoE standard, up to 15.4 W at the PSE port (Type 1).
802.3at: PoE+, up to 30 W at the PSE port (Type 2).
802.3bt: Four-pair PoE with Type 3 (up to 60 W) and Type 4 (up to 90 W) at the PSE port.
PoE budget: The total PoE power a switch can supply across all its ports at the same time.

Domain 5: WLAN network security (10%)

Exam tips

If a question asks which option provides real security, eliminate SSID hiding and MAC filtering first. They are obscurity measures, not encryption or authentication.
Personal vs Enterprise is about how users authenticate (shared secret vs 802.1X), while CCMP vs GCMP is about how data is encrypted. Do not mix up the layers in exam answers.
SAE stops offline guessing, not online guessing. A weak password is still a risk if an attacker can try guesses against the live AP.
Enhanced Open provides encryption but not authentication. If a question asks whether OWE stops evil twin attacks, the answer is no.
The AP or controller is the authenticator, not the authentication server. It passes EAP through; the RADIUS server makes the decision.
Memorize certificate requirements: EAP-TLS needs server and client certificates; PEAP and EAP-TTLS need only a server certificate.
Remember the order: ANonce in message 1, SNonce and MIC in message 2, GTK delivered in message 3, confirmation in message 4. Also remember the PMK is never transmitted.
Know which frames PMF protects (deauth, disassoc, robust action) and which it does not (beacons, probes, authentication, association). Know that WPA3 and 6 GHz require it.
A rogue AP is defined by its connection to your wired network; an evil twin is defined by impersonating your SSID. Neighbor APs are neither.

Key terms

WEP: Wired Equivalent Privacy, the original 802.11 encryption using RC4 and a 24-bit IV; completely broken.
TKIP: Temporal Key Integrity Protocol, an interim RC4-based fix with per-packet keys and the Michael MIC; now deprecated.
Shared key authentication: A legacy WEP challenge-response method that exposes plaintext and ciphertext to eavesdroppers.
MAC filtering: Allowing only listed client MAC addresses to associate; easily bypassed by spoofing.
WPA2: Wi-Fi Alliance security certification based on 802.11i RSN, using CCMP/AES with PSK or 802.1X.
WPA3: The newer Wi-Fi Alliance security certification that adds SAE for Personal, requires PMF and offers a 192-bit Enterprise mode.
CCMP: AES-based encryption and integrity protocol used by WPA2 and WPA3.
GCMP: AES Galois/Counter Mode Protocol, an efficient authenticated encryption method; GCMP-256 is used in WPA3-Enterprise 192-bit mode.
AKM: Authentication and key management suite advertised in the RSN element, such as PSK, SAE or 802.1X.
SAE: Simultaneous Authentication of Equals, WPA3-Personal's password-based key exchange that resists offline guessing.
Offline dictionary attack: Testing password guesses against captured data without further interaction with the network.
Forward secrecy: A property where compromise of a long-term secret does not expose past session keys.
Transition mode: A configuration allowing both WPA3-SAE and WPA2-PSK clients on one SSID with PMF optional.
Enhanced Open: Wi-Fi Alliance certification that adds encryption to open networks using OWE.
OWE: Opportunistic Wireless Encryption, an unauthenticated Diffie-Hellman key exchange during association, defined in RFC 8110.
OWE transition mode: Pairing an open BSS with a hidden OWE BSS so both legacy and OWE-capable clients can connect.
Supplicant: The client software that requests network access and provides credentials in 802.1X.
Authenticator: The device controlling the port, such as an AP or WLAN controller, which relays EAP between supplicant and server.
Authentication server: The server, usually RADIUS, that validates credentials and returns accept or reject.
EAPOL: EAP over LAN, the encapsulation used to carry EAP between the supplicant and the authenticator.
EAP-TLS: Certificate-based mutual authentication requiring certificates on both the server and every client.
PEAP: An EAP method that builds a TLS tunnel with a server certificate, then authenticates the user inside it, commonly with MSCHAPv2.
EAP-TTLS: A tunneled method like PEAP that supports a wider range of inner authentication methods, including PAP.
PKI: Public key infrastructure, the system of certificate authorities and processes used to issue and manage certificates.
PMK: Pairwise master key, the top-level key from PSK, SAE or 802.1X from which session keys are derived.
PTK: Pairwise transient key, derived from the PMK, both nonces and both MAC addresses; contains the KCK, KEK and TK.
GTK: Group temporal key, shared by all clients of an AP to protect broadcast and multicast frames.
Nonce: A random number used once, here ANonce from the AP and SNonce from the client.
PMF: Protected Management Frames, the Wi-Fi Alliance certification of 802.11w that protects robust management frames.
Robust management frame: A management frame protected under 802.11w, such as deauthentication, disassociation and certain action frames.
BIP: Broadcast/Multicast Integrity Protocol, which provides integrity checks for group-addressed management frames using the IGTK.
SA Query: An 802.11w procedure an AP uses to confirm a protected client is still present before accepting a new association.
Rogue AP: An unauthorized AP connected to the organization's wired network.
Evil twin: An attacker-controlled AP that imitates a legitimate SSID to lure clients.
WIPS: Wireless intrusion prevention system that monitors RF, classifies devices and detects wireless attacks.
Captive portal: A web page that guests must pass through before gaining network access.
Client isolation: A setting that blocks direct traffic between wireless clients on the same SSID or AP.

Domain 6: RF validation and remediation (20%)

Exam tips

Passive means listening only; active means associated and passing traffic. If a question asks which survey reveals roaming delays or throughput, the answer is active.
If a question asks what to do before a survey, think: accurate scaled floor plans, documented requirements, access arrangements and safety. Calibrate scale over the longest distance you can measure.
A validation survey is always measured against documented requirements. If an answer choice skips comparing to requirements, it is probably wrong.
Protocol analyzers decode 802.11 frames; spectrum analyzers see all RF energy. For non-Wi-Fi interference, the answer is always a spectrum analyzer.
One radio, one channel. To capture roaming across channels you need multiple adapters or AP-based captures, and to see a client's experience you capture near the client.
Compare RSSI values between different client devices carefully; the scale is vendor-specific. SNR, retries and utilization often explain a problem better than signal alone.
CCC means deferral and lost capacity (low retries, high utilization). ACI and hidden nodes mean corrupted frames and high retries. Hidden node fixes include RTS/CTS; CCC fixes do not.
Remember that the client decides when to roam. The network can influence roaming with rates, power, 802.11k and 802.11v, but cannot force a well-behaved roam on a poorly written driver.
Map symptoms to the stage: failure after message 2 of the handshake suggests a wrong passphrase; failure inside EAP-TLS or PEAP suggests certificates; connected but no IP suggests DHCP or VLAN.
Exam questions often ask what the next step is. After identifying the problem, form a theory; after fixing, verify; and always finish by documenting.

Key terms

Predictive survey: A software model of RF coverage based on floor plans and wall attenuation, without on-site measurements.
Passive survey: A walk-through that records beacon signals from all APs without associating to any network.
Active survey: A walk-through with the survey client associated to an SSID to measure throughput, retries, latency and roaming.
AP-on-a-stick: Measuring the real coverage of a temporarily mounted AP at a proposed location before final installation.
Floor plan calibration: Setting the scale of an imported floor plan in survey software using a known distance.
Site access: Permissions, escorts, badges and schedules needed to enter all areas of the survey.
Personal protective equipment: Safety gear such as hard hats, vests and safety shoes required in some survey environments.
Validation survey: A post-installation survey that measures the live network and compares it with design requirements.
Remediation: Changes made to fix gaps found during validation, such as adjusting power or moving APs.
Baseline: Documented measurements of normal network performance used for comparison in later troubleshooting.
Spectrum analyzer: A tool that measures RF energy across frequencies regardless of the transmitter type.
FFT view: A display of amplitude versus frequency at the current moment, often with max hold and average traces.
Waterfall (spectrogram): A display of frequency over time with color representing amplitude.
Duty cycle: The percentage of time RF energy exceeds a threshold on a frequency.
Monitor mode: An adapter mode that captures all 802.11 frames on a channel without associating to a network.
Radiotap header: Metadata added to captured frames, such as signal strength, channel and data rate.
Display filter: A rule in an analyzer that shows only matching frames from a capture.
Capture location: The physical position of the analyzer, which determines which frames it can hear.
RSSI: A vendor-specific relative measure of received signal strength, commonly displayed in dBm.
Retry rate: The percentage of frames retransmitted because an acknowledgment was not received.
Channel utilization: The percentage of time a channel is detected as busy.
MCS index: A number identifying the modulation and coding scheme, which together with streams and width determines the data rate.
Co-channel contention: Sharing of airtime among devices on the same channel that hear each other and defer.
Adjacent channel interference: Corruption and noise from transmitters on overlapping or nearby channels.
Hidden node: A situation where clients that cannot hear each other transmit at the same time, causing collisions at the AP.
RTS/CTS: A protection exchange where a client requests to send and the AP clears it, reserving the medium for all that hear the CTS.
Sticky client: A client that remains associated to a distant AP instead of roaming to a better one.
Power mismatch: An imbalance where the AP transmits much more strongly than the client, so the client hears the AP but the AP struggles to hear the client.
802.11k: An amendment that lets APs provide neighbor reports to help clients find roaming candidates.
802.11v BSS transition management: A mechanism that lets the network suggest that a client move to a different AP.
MIC failure: A failed message integrity check in the 4-way handshake, commonly caused by a wrong passphrase in Personal mode.
Server certificate: The certificate a RADIUS server presents to clients during TLS-based EAP methods.
DHCP scope exhaustion: A condition where all addresses in a DHCP pool are leased, so new clients get no address.
DHCP relay: A router function that forwards DHCP broadcasts from a client VLAN to a DHCP server on another subnet.
Root cause: The underlying reason a problem occurs, as opposed to its symptoms.
Theory of probable cause: A proposed explanation for a problem that is then tested with tools and evidence.
Verification: Confirming the fix resolved the issue and did not introduce new problems.
Documentation: A written record of symptoms, evidence, root cause, changes and outcomes.

Study CWNA for free
Lessons, quizzes, exam simulations and hands-on labs.

Open the CWNA study plan