CWNP CWSP-208 - Certified Wireless Security Professional (CWSP)

WIPS provides multiple functionalities:

B. Policy enforcement – detects and responds to wireless threats such as rogue APs and misconfigurations.

D. Security monitoring – alerts staff when threats like deauth attacks or malware-hosting APs are detected.

A. Performance monitoring – supports diagnostics by capturing information on channel conditions, interference, and device behavior.

Incorrect options:

C. Detecting eavesdropping isn’t feasible—passive listening cannot be identified by sensors.

E. Carrier sense DoS and F. Wired device classification are outside WIPS's scope.

Many protocol analyzers require special drivers or place the NIC into monitor/promiscuous mode. When used this way, the original driver stack may be altered or replaced. Afterward, if not correctly reloaded, the adapter may lack full 802.1X support or required encryption features. This is likely the case here — Mary's WLAN adapter is still under the control of or affected by the analyzer’s NIC driver, which doesn’t support PEAP properly.

When compliance reporting and forensic analysis are required and the WLAN vendor’s centralized management system does not provide it, deploying a dedicated overlay WIPS is the most effective solution. Overlay WIPS uses dedicated sensors independent of the WLAN’s operational radios, offering detailed threat detection, compliance logging, and reporting capabilities that often surpass native WLAN features.

A Wireless Network Management System (WNMS) often uses SNMP to manage APs. SNMPv3 is the secure version of SNMP because it supports authentication, encryption, and message integrity. Unlike SNMPv1 and SNMPv2c, which transmit data (including community strings) in plaintext, SNMPv3 provides secure management communications.

PCI-DSS (Payment Card Industry Data Security Standard) applies to all entities that process, store, or transmit credit card data. Since Point-of-Sale (PoS) systems handle such transactions in retail environments, the wireless network supporting them must comply with PCI-DSS. This includes encrypting wireless transmissions, segmenting network traffic, and implementing WIPS for rogue detection and logging.

After deploying a WIPS, an essential baseline activity is to classify all detected devices in the RF environment. These classifications allow the system to enforce security policies and detect policy violations. Classifications include:

Authorized (managed devices)

Rogue (unauthorized, possibly dangerous)

Neighbor (not part of your network but legitimate)

External or Ad hoc devices

Without this initial classification, WIPS cannot properly assess threats or trigger alarms.

Before conducting a security audit of an 802.11ac WLAN, it is essential to know the current security implementations—such as the use of WPA2-Enterprise, 802.1X, or MAC filtering. This helps the auditor tailor tests to identify gaps, weaknesses, or misconfigurations in the existing system. Understanding the security solutions provides the most immediate insight into potential vulnerabilities.