CWNE practice questions
CWNP · CWNE · 300 questions
Original practice questions for the CWNP Certified Wireless Network Expert (CWNE) credential, covering expert-level wireless LAN design, spectrum analysis, protocol analysis, security, performance optimization, and wireless IoT solutions.
This course contains the use of artificial intelligence.
About the CWNE exam
This credential is awarded by application and peer review, not by sitting a written exam.
- Exam fee
- $500 USD
- Format
- No written exam: an application with peer review by the CWNE Board of Advisors
Exam details published by the vendor, checked 28 August 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Spectrum Analysis and RF Management · 45 questions
- A city hall RF engineer sees the noise floor on channel 6 climb after facilities installs a new break-room microwave. Which spectrum approach best confirms a non-Wi-Fi interferer instead of blaming co-channel APs?
- A county library reports intermittent Wi-Fi near a security camera closet after new analog video gear was installed. What should the wireless expert do first?
- A municipal operations center needs overnight monitoring of a council chamber for intermittent RF events. When should AP- or sensor-based spectrum be preferred over a handheld analyzer walk-around?
- A fire-station WLAN shows high 2.4 GHz duty cycle with only a handful of associated clients. What does that spectrum utilization primarily indicate?
- A parks department 5 GHz PTP bridge link fails when a construction crane swings into the Fresnel zone. What is the most accurate expert diagnosis?
- A courthouse installs patch antennas aimed into drywall that contains foil-backed insulation. Coverage that looked acceptable in a soft-office predictive model collapses. What should the expert conclude?
- A city Wi-Fi team proposes raising AP transmit power to 'fill a coverage hole,' but neighboring cells already share channels. What is the expert risk of that change?
- A transit hub near an airport sees APs repeatedly leave DFS channels after radar events. What is the correct expert interpretation?
- A spectrum waterfall at a municipal warehouse shows narrow frequency-hopping bursts marching across 2.4 GHz. How should the expert classify that signature relative to Wi-Fi?
- During protests outside a civic center, staff report 'Wi-Fi jamming' and simultaneous failures across multiple channels. Spectrum shows persistent high-amplitude broadband energy blanketing 2.4 GHz. What is the most appropriate expert assessment?
- A wastewater plant’s metal process enclosure kills 5 GHz coverage that looked fine in a soft-office predictive model. What expert action best addresses the mismatch?
- During a civic-center ticket-booth review, an engineer cites a strong RSSI yet ignores a high noise floor. Why is that incomplete for link-quality decisions?
- A museum wants aesthetic AP mounts inside display cases with lossy laminated glass. What RF factors must the expert account for?
- A municipal stadium bowl needs capacity cells with controlled coverage rather than omni APs at full power. Which RF approach best matches expert design intent?
- Two civic-center APs are planned on overlapping adjacent 40 MHz channels and clients show degraded throughput. What interference mechanism should the expert diagnose?
- A public-works yard mounts outdoor APs on lightning-prone poles. Which RF-system practice is required rather than cosmetic?
- A density/historic spectrum view at city hall shows a strong interferer only after 10 p.m., missed during a 30-second daytime FFT glance. What lesson should guide the expert?
- A municipal warehouse sees unexpectedly weak links between an AP and vertically polarized clients despite short distance and clear LOS. Antenna documentation shows a horizontally polarized patch on the AP. What is the likely RF cause?
- A city CIO asks why Wi-Fi 6E 6 GHz planning differs from legacy 2.4 GHz densification. Which statement is most accurate at expert depth?
- An engineer sees strong amplitude on a spectrum analyzer in a permits office, yet protocol captures show few decodable 802.11 frames and clients fail. What does this distinction imply?
- A school district mesh backhaul underperforms after installers mount panel antennas without following azimuth and elevation aims from the RF design. What should the expert emphasize?
- After a crushed coax jumper on a city-yard AP, VSWR/return-loss measurements worsen and radiated performance drops. What does the expert recognize?
- A designer applies a free-space path loss estimate from a rooftop PTP worksheet to predict coverage inside a multi-floor atrium with glass and walkways. What is the expert critique?
- In a design review, a vendor claims 20 dBm equals 50 mW. Using the rules of 10 and 3, what quick sanity check should the municipal RF lead apply?
- A contractor sets 20 dBm conducted power into a 6 dBi antenna with 1 dB jumper loss and claims the link stays under a 20 dBm EIRP limit. What is the expert compliance finding?
- A sensor-based spectrum system alerts on a new interferer near a voting center during early voting. Poll workers report intermittent ballot-kiosk drops. Which remediation path best matches expert spectrum practice?
- In a reflective city-hall lobby, clients show rapidly fluctuating SNR and MCS even when they remain near the same AP. Which RF explanation best accounts for that pattern versus simple distance-based path loss?
- A vendor demo at a county IT summit claims 'spectrum AI auto-fixes everything,' so predictive and measured surveys are unnecessary before a courthouse WLAN refresh. What should the CWNE-level recommendation be?
- A dense municipal permit office needs higher per-client rates but already has many neighboring APs on 5 GHz. Which channel-width judgment is most appropriate?
- A city parks department deploys temporary portable APs for an outdoor festival. Which RF-management requirement must the design respect?
- After a library Wi-Fi 6 upgrade, an engineer validates airtime with a spectrum analyzer. Which observation best reflects expert recognition of modern Wi-Fi PHY and channel-width footprints?
- A county clinic's 2.4 GHz IoT hub sits under voice SSIDs and staff report choppy VoWLAN. How should spectrum analysis be used?
- A long jail corridor needs reliable coverage for officer tablets without flooding RF into adjacent cell blocks. Which antenna approach best fits expert RF management?
- A 'dead' 5 GHz cell appears in a municipal annex. Comparing spectrum noise-floor readings across bands, which conclusion process is most sound?
- During a city warehouse survey, the laptop spectrum adapter sits behind a metal parts cart for much of the walk. What is the expert concern?
- A courthouse waterfall plot shows pulsed RF energy that lines up with HVAC compressor cycles. What should the engineer do next?
- In a design review with facilities, a contractor claims a higher-dBi antenna 'adds free amplification like an amplifier in the antenna.' How should the wireless expert respond?
- A city library AP still beacons, but clients report a 'slow AP' after a suspected MIMO radio-chain fault. What expert diagnosis fits?
- A high-capacity city permit office can cover desks adequately on 5 GHz. Leadership prefers 2.4 GHz 'because it reaches farther.' Which band-selection judgment is best?
- BLE gateways in a smart-city lobby show only low-duty-cycle energy on spectrum, yet adjacent Wi-Fi clients see rising retries. What is the correct interpretation?
- Facilities removed a noisy interferer near a city council chamber. Before closing the ticket, what validation should the wireless team perform?
- A municipal PTP bridge to a water tower drops SNR during heavy rain and after summer foliage growth along the path. What expert RF awareness applies?
- A sprawling community-center WLAN uses very large cells so fewer APs are needed. Users see collisions and uneven performance. Which RF-design insight is most accurate?
- A city NOC sees a vague interference alarm on the cloud WLAN dashboard's AP spectrum view. When should engineers escalate to a dedicated spectrum analyzer?
- Before escalating a persistent interferer to city facilities, what evidence package best supports expert operational handoff?
Protocol Analysis and Frame Operations · 60 questions
- A city NOC captures while troubleshooting voice-SSID dropouts but leaves the adapter scanning channels. The failure never appears in the trace. What capture-method lesson applies?
- Engineers must analyze a tablet that fails while roaming across three APs in a municipal clinic. Which capture strategy is most appropriate?
- While troubleshooting municipal staff 802.1X failures, a capture uses aggressive packet slicing and EAP payloads are truncated. What should the analyst change?
- A noisy courthouse capture contains thousands of frames. The analyst needs to focus on association failures without destroying evidence. Which analyzer practice is correct?
- In an authorized city lab, analysts must decrypt a WLAN capture to inspect upper-layer failures after association. Which statement best reflects expert practice?
- A city hall WLAN analyst reviewing a capture from the council chamber sees MCS and signal strength in the radiotap/PPI pseudo-header that the 802.11 MAC decode alone does not show. What should the analyst conclude about that metadata?
- After a municipal library upgrades APs to Wi-Fi 6/7, a capture shows rate and PPDU fields the analyst does not recognize from the old HT/VHT era. What is the expert next step?
- A county operations-center capacity complaint shows frequent Block Ack activity on a busy SSID. How should the analyst distinguish which aggregation method is primarily in play?
- A parks department mesh/bridge capture looks like 'wrong MAC addresses' on data frames until To DS and From DS are considered. What should the analyst do?
- After a courthouse AP firmware change, Beacons suddenly advertise an unexpected country code and tighter power constraints. What should the WLAN expert validate first from the capture?
- Municipal fleet tablets show low throughput despite high RSSI, and captures show missing or failed Block Ack sessions. What is the most likely protocol root cause to investigate?
- A transit-hub capture shows an unusually high ratio of RTS/CTS relative to data frames. What expert interpretation should guide next steps?
- A city public-safety SSID capture shows the 4-way handshake failing around message 3/4. Conceptually, what should the expert isolate next?
- While validating WPA3-Personal on a municipal guest SSID, what capture evidence distinguishes SAE from a legacy WPA2-PSK join?
- A civic plaza guest SSID is advertised as open, yet the capture shows an encryption key exchange after association. What mechanism is the analyst seeing?
- A city employee SSID capture shows EAP Request Identity looping and the TLS tunnel never establishing. What is the best protocol-analysis conclusion?
- On a municipal voice SSID, reassociation captures are used to tell Fast BSS Transition from OKC. Which distinction is correct?
- Before association on a Passpoint-enabled civic guest service, the capture shows GAS exchanges querying network selection data. What is occurring?
- A handheld at city hall stays associated to a distant AP with strong reported RSSI while a nearer AP is ignored, and probes/roams are rare in the capture. What pattern is this?
- Two overlapping strong APs in a county clerk office produce rapid back-and-forth reassociations on a laptop. What capture-driven diagnosis fits?
- Wi-Fi 6 clients underperform on a busy city permitting SSID even though RSSI is acceptable. Captures show little UL OFDMA activity. What should the analyst relate to multi-user uplink scheduling?
- While validating vendor multi-user features on a council-chamber WLAN, which frames indicate sounding for MU-MIMO or transmit beamforming?
- Sticky handhelds on a fire-station voice SSID show choppy audio while captures reveal aggressive power-save with TIM/APSD buffering behavior. What is the expert takeaway?
- A mixed BSS at a community center still allows legacy rates and captures show protection overhead inflating airtime. What should the analyst conclude?
- Near a suspected interferer at the wastewater plant, protocol stats show elevated FCS/CRC errors and retries while spectrum also looks dirty. How should the expert use that evidence?
- Misbehaving scanners at a city warehouse generate continuous Probe Request storms that congest airtime. What is the protocol-analysis concern?
- A municipal IT policy hides the staff SSID 'for security,' yet directed probes still reveal the name in captures. What expert conclusion follows?
- Voice handsets on a courthouse SSID show choppy calls, and QoS data frames in the capture are marked Best Effort instead of Voice. What should be verified?
- A city Wi-Fi engineer validates the voice QoS profile by reading EDCA parameters from Beacons. What is being checked?
- On a busy permit-office SSID, airtime share looks roughly fair yet application latency spikes under load. Which DCF concepts best explain the diagnosis focus?
- A municipal permitting office captures an Association Response rejecting a tablet that requested 80 MHz while the city AP advertises only 40 MHz HT capabilities. What does that Association Response status most clearly indicate?
- A county warehouse SSID works for modern tablets but legacy handheld scanners never finish joining. Beacons show the lowest basic rate set to 24 Mbps. What should the CWNE conclude from that Beacon rates analysis?
- City inventory scanners on a public-works SSID show delayed discovery and odd roam timing after someone lengthened the Beacon interval to reduce overhead. What impact should the analyst attribute to that unusually long Beacon interval?
- A civic guest SSID capture shows an RSN IE advertising both WPA2 and WPA3 AKM suites together. What does that RSN IE evidence indicate about the BSS security mode?
- After a scheduled GTK rekey on a municipal classroom SSID, unicast browsing still works but broadcast instructional video to students freezes. Which frame-exchange problem best explains that symptom?
- A county NOC engineer hunting power-save behavior notices QoS Null and Null data frames are sparse or absent in a capture despite clients clearly sleeping. What analyzer limitation should the CWNE keep in mind?
- A city Wi-Fi team must prove whether a Wi-Fi 6E client is using multiple spatial streams on 6 GHz during a council-chamber event. What capture-device requirement is most critical?
- Peer maps from a courthouse SSID capture show an unexpected STA exchanging large volumes of data with many peers it should not. What is the most appropriate protocol-analysis use of that peer-map evidence?
- A parks-department PCAP is several gigabytes after a weekend festival outage. Which analyzer workflow should guide the first look?
- After a firmware update on city library laptops, frame statistics show an abnormal flood of Acknowledgement control frames relative to data. What should the analyst infer?
- A transit-hub laptop joins reliably on 5 GHz but fails intermittently on 2.4 GHz for the same municipal SSID name. How should the CWNE structure the capture?
- Enterprise roaming captures at city hall show reassociation with PMKID/PMK caching evidence and no full EAP on most AP moves, while a second SSID still runs full 802.1X every roam. What does the first pattern demonstrate?
- On a city employee 802.1X SSID, a junior tech expects DHCP Discover before EAP succeeds "because the client needs an IP to authenticate." What sequencing awareness should the CWNE enforce?
- During a civic center incident, the capture shows bursts of Deauthentication frames. How should the analyst interpret deauth/disassoc evidence at this stage?
- Museum clients suddenly disconnect when the AP moves off a DFS channel after radar detection. Which management exchange explains the coordinated move?
- A high-density municipal arena capture shows A-MSDU frames carried inside A-MPDU aggregates. What should the throughput analysis conclude?
- A county hospital WLAN design enables 802.11k/v assisted roaming. Which frame class should the analyst expect when validating radio measurement and neighbor-assisted roam behavior on the air?
- City leadership cites a client's peak PHY data rate from a vendor slide, but capture statistics show much lower MSDU goodput during a council livestream. What distinction should the CWNE present?
- Public library clients flake near one AP while captures show many Beacons from that AP failing FCS checks. What is the most appropriate conclusion?
- A wastewater-plant WLAN drops only during rare overnight chemical-delivery windows, but the overnight capture buffer wrapped and lost the incident. What configuration lesson applies?
- A municipal NOC wants faster triage of 802.1X problems across many rolling captures. Which analyzer workflow aid best supports that goal?
- During a dense city conference, captures show HE/VHT operating mode notifications as a client drops from 80 MHz to 20 MHz under interference. What do those frames indicate?
- A clerk's TCP transfers on a city finance SSID remain inefficient after association. Captures show ADDBA Request/Response failing, so Block Ack never establishes. What is the performance implication?
- Warehouse handheld scanners on a municipal logistics SSID show different power-save air patterns—some PS-Poll, others uAPSD triggers. What should the CWNE's analysis emphasize?
- A city mesh WLAN loses a portal path and field APs show mesh peering/action activity in the capture. What recognition skill should the analyst apply?
- During a municipal transit-yard capture, an analyst sees the same 802.11 data-frame sequence numbers repeating for one client while the retry bit stays clear. What should that anomaly primarily drive next?
- A county campus roam study uses separate analyzers on 2.4 GHz and 5 GHz. What must be done so the multi-channel captures can be aligned into one accurate roam timeline?
- A city hall AP radio advertises several SSIDs on one BSSID. How should the protocol analyst scope filters when investigating only the staff BSS?
- After a library WLAN profile change, Probe Responses for the public SSID lack the expected RSN information element. What is the most useful first split for the CWNE analyst?
- A parks-department scanner’s Association Request shows no HE capabilities, yet the AP continues to advertise HE-only features for that BSS. What diagnosis should guide remediation?
Advanced WLAN Design and Validation · 60 questions
- A city clerk office needs softphone coverage with strict one-way latency targets. What should the WLAN designer gather before placing APs?
- City council aesthetics rules ban visible hallway APs in a renovated civic center. What must the designer document in the requirements?
- Budget caps how many weatherproof outdoor enclosures a county fairgrounds WLAN can buy. How should the designer balance AP density versus antennas?
- A courthouse WLAN that carries recording and case-related traffic must satisfy retention and monitoring rules. How should those obligations enter the design brief?
- A municipal warehouse WLAN must support an older handheld scanner that needs roughly −67 dBm and solid SNR. Which client should set the RF targets?
- On permit day the city lobby fills with dozens of concurrent devices. What should capacity requirements drive in the WLAN design?
- A county hospital wing adds RTLS asset tracking on the WLAN. How do location accuracy needs change the design versus data-only coverage?
- Before running a predictive design for a city services building, which inputs should the designer insist on gathering?
- What pre-design activity should a municipal WLAN team run to discover incumbents before finalizing a channel plan?
- A multi-site parks department has limited on-site IT staff. Which WLAN management architecture choice best matches that operational reality?
- A county campus has constrained WAN links between buildings. How should WLAN data-forwarding architecture be chosen?
- In an RF-hostile industrial plant with stable, well-characterized interferers, what RF management approach should an expert often recommend?
- A historic stone city hall has irregular attenuation that CAD defaults will miss. Which survey methodology fit is most appropriate?
- During predictive design for a civic annex, why must floor plans be imported and scaled correctly?
- Predictive defaults understate loss through elevators and stairwells in a multi-story municipal building. What should the designer do?
- A municipality has mixed dual-band clients including sticky IoT. How should band steering and load balancing be applied?
- On shared AP hardware for a city network, how should employee, guest, and IoT SSIDs be designed?
- Voice and video for emergency operations must keep priority from servers to Wi-Fi clients. What QoS planning is required?
- Wi-Fi 6E APs with USB accessories will hang on older municipal access switches. What infrastructure check belongs in the design?
- Two fire stations need a wireless bridge for shared CAD traffic in addition to indoor WLAN. What extra design work is required?
- A city hall WLAN redesign lists access points in procurement but omits external antennas, PoE injectors for non-PoE closet runs, controller licenses, and mounting kits shown on the RF drawings. What should the designer produce before purchasing begins?
- County stakeholders ask how the proposed civic-center WLAN will cover galleries, which channels and power levels will be used, and which survey assumptions drove AP counts. Which deliverable should answer those questions as the primary design package?
- Contractors will install APs in a municipal courthouse where ceiling heights, antenna orientation, and approved cable paths are constrained by security and aesthetics. What documentation should the WLAN designer provide so the build matches the RF plan?
- Before installing directional antennas in a city council chamber, the project lead wants to stop contractors from 'improving' downtilt or azimuth on their own. What deployment practice best prevents that drift?
- During staged deployment of a public library floor, APs are coming online while other floors remain on the old plan. What RF configuration check should occur as each new AP is commissioned?
- A parks department is replacing controller-based APs with cloud-managed APs in recreation centers. Why must the deployment checklist change rather than reuse the old controller discovery steps unchanged?
- After APs are mounted in a museum gallery that forbids visible antennas and requires exact downtilt, what installation QA should the city WLAN team perform before acceptance?
- A fire-station WLAN was installed from a predictive model targeting -67 dBm coverage and adequate SNR for voice. What validation step is required after install before declaring success?
- A municipal operations center needs acceptance testing for a new WLAN that will carry voice handsets, dense tablet use during emergencies, and 802.1X staff access. Which validation approach best supports go-live acceptance?
- Post-validation at a city warehouse shows a coverage null behind dense racking where AP density is already moderate and channels are clean. Power is near design maximum on the nearest AP, and the antenna is an integrated omni. What remediation is most appropriate?
- On municipal permit day, a service lobby shows acceptable RSSI but clients experience high retries and airtime contention under crowd load. Validation points to oversized cells. What remediation should the design team recommend?
- Voice clients in a city office building drop calls when users move between floors via stairwells, even though SSIDs are consistent. Surveys show weak secondary coverage in the stair core. What remediation addresses the root cause?
- A county building's WLAN design requires staff 802.1X and isolated guest access. After install, what security validation belongs in acceptance testing?
- A vendor is finishing a city WLAN project. Operations staff will own the network next week. What closure package best completes project hand-off?
- A city's AI-assisted WLAN design tool places APs quickly using a floorplan upload. Historic masonry attenuation and a council-chamber voice requirement were not reviewed by an engineer. What should happen before build?
- A public library board requires visitor BYOD Internet with an acceptable-use captive portal and bandwidth limits so research PCs stay usable. Where should those needs be captured?
- A multi-building municipal campus has overlapping outdoor plazas and adjacent wings where each building team historically picked channels independently. What specification should the WLAN design include to avoid CCI?
- A city is migrating recreation-center WLAN to Wi-Fi 6E. Existing mounts and cable plants vary by age. What upgrade-design decision must the specifications address?
- A city RFP for campus WLAN must choose among vendors with similar AP counts but different feature depth, support SLAs, and ecosystem integrations. What selection approach best fits expert design practice?
- A transit hub WLAN design requires continuous threat awareness and performance assurance, not only AP coverage. How should monitoring be treated in the design package?
- A courthouse WLAN design assumes reliable addressing, name resolution, and time sync for 802.1X and certificate validation. What should the designer document as network service dependencies?
- A city hall atrium has very high ceilings; omni APs at full power paint the atrium but bleed badly onto adjacent office floors. What design approach is most appropriate?
- A historic parks pavilion cannot be cabled without damaging protected finishes, so mesh is proposed for a few APs. What must the WLAN design document that a simple 'mesh mode' checkbox does not provide?
- A municipal building needs VoWLAN-grade SNR in emergency dispatch and only low-rate IoT telemetry in basement storage. How should requirements be expressed?
- Landmark-preservation rules block visible AP and antenna placement on a historic city facade and ornate lobby ceilings. How should the WLAN specifications treat that constraint?
- A city hall WLAN must go live for permitting counters in eight weeks, but full-campus AP installs will take five months. How should the design support phased deployment without stranding interim users?
- A civic library is deploying multi-radio Wi-Fi 6E APs that can saturate a 1 Gbps copper uplink under peak study-hall load. What switching requirement should the RF design call out?
- Before accepting a predictive design for a municipal courts building, what should the design package record so future auditors can re-check the model?
- After a city council chamber remodel replaces open seating with dense wooden daises and glass partitions, what validation action is most appropriate?
- A county RF engineer will run a measured survey before replacing APs in a health-department clinic. What practice best keeps the measured results trustworthy?
- Public-safety VoWLAN handsets on a dedicated SSID drop calls when aggressive AP load balancing and band steering are enabled campus-wide. What design adjustment is most appropriate?
- A parks department needs APs under pavilion eaves exposed to rain, heat, and dust. What equipment-selection criterion should dominate?
- Installers finish a community center WLAN with a different channel plan than the approved RF design. What must happen before acceptance?
- Engineers will perform AP-on-a-stick measured design in an unfinished municipal annex. What gear approach supports proper methodology?
- A town wants predictive RF design started immediately, but departments still disagree on VoWLAN, guest isolation, and coverage in temporary trailers. What should gate design work?
- A multi-story public-safety training academy with dorm-style rooms shows strong inter-floor co-channel interference. What design focus best controls multi-floor bleed?
- Before a city declares a new permitting-office WLAN accepted, what belongs in the validation plan?
- A municipal BoM for a citywide indoor WLAN lists only exact install quantities with no extras. What resilience gap should the design documentation close?
- After validating a new recreation-center WLAN, the integrator prepares to leave. What closure activity should still be treated as mandatory?
- While gathering RF coverage and capacity targets for a tax-assessor office WLAN, what else must be captured as a first-class design input?
Wireless Security, IDP, and WIPS · 60 questions
- A city payments kiosk SSID may process cardholder data and sits near HIPAA-adjacent clinic check-in devices. What should security policy authors do first?
- During a stakeholder workshop for civic guest Wi-Fi, IT security and the communications office disagree about Acceptable Use. What should the session establish?
- After a city migrates enterprise SSIDs to WPA3-Enterprise, what policy-lifecycle action is most appropriate?
- Facilities staff keep plugging consumer APs into wall jacks behind reception desks, creating rogue SSIDs. Which program element most directly addresses the root behavior?
- A vulnerability bulletin lists a high-impact CVE in the city’s AP firmware train. What is the sound vulnerability-management response?
- A municipal open guest SSID provides no OWE and no other Layer-2 encryption. What threat should policy and design explicitly recognize?
- Citizens report captive-portal lookalikes near a municipal plaza guest network. Which defensive approach best addresses evil-twin / MitM patterns?
- A parks festival SSID uses WPA2-Personal with a short, guessable passphrase shared on flyers. What cracking-related risk should drive a redesign?
- Staff receive phishing messages asking them to “re-enter Wi-Fi credentials” on a lookalike city portal. What mitigation belongs in the WLAN security program?
- A legacy SCADA SSID in a utilities plant still permits WEP and TKIP. What threat-driven action is required?
- A county CIO authorizes a WLAN penetration test of the civic center. What must the security team lock before any active testing begins?
- A multi-vendor municipal campus needs consistent rogue detection across controllers from different manufacturers. Which WIPS approach best fits?
- The city SOC needs 24/7 visibility into wireless threats. How should WIDS alerts be handled?
- Justice-system WLAN policy demands the strongest WPA3 enterprise mode for courthouse staff devices. Which design choice aligns?
- Small city satellite offices still use WPA2-PSK for a handful of staff laptops. What should replace that AKM for stronger personal-mode security?
- City laptops already enroll in a managed PKI. Which EAP method best matches that certificate maturity for employee WLAN?
- Municipal employee WLAN depends on 802.1X. How should RADIUS/AAA be designed for resilience?
- An engineer reviewing RSN settings for a WPA3 civic SSID must distinguish modern pairwise ciphers. Which statement is accurate?
- A public library wants open guest Wi-Fi without a shared password, yet still needs encryption on the air. What should the design use?
- City guest Wi-Fi must onboard visitors, stop guest-to-guest snooping, and limit bandwidth abuse. Which control set fits?
- A convention center for municipal events wants scalable visitor onboarding without SMS captive portals. Which approach aligns?
- Voice SSID roaming must stay fast without weakening WPA3 security on city handsets. What is the sound approach?
- Municipal IoT sensors cannot perform 802.1X. Which onboarding pattern best limits blast radius versus one global PSK?
- Before city employees reach the corporate SSID, devices must prove patch and disk-encryption posture. Which control provides that gate?
- Contractors on the civic WLAN must land in a restricted role and VLAN via AAA. How should that be enforced?
- Rogue APs keep appearing when someone plugs unauthorized gear into empty wall jacks near city meeting rooms. What wired control helps most?
- City WLAN carries corporate, guest, and IoT SSIDs. What wired-side practice is essential?
- An IoT VLAN hosts municipal security cameras that should not freely reach workstation subnets. What should limit east-west movement?
- AP management planes in city halls still allow HTTP, Telnet, and SNMPv1. What hardening step is required?
- New outdoor APs for parks still ship with vendor default admin passwords. What baseline hygiene is mandatory before production use?
- WLAN security lifecycle for the municipality must include ongoing platform upkeep. Which practice belongs?
- An engineer wants to change the employee SSID from WPA3-Enterprise to a shared PSK “just for the weekend festival.” What process should stop that?
- Leadership asks how WLAN security health should be reviewed on a recurring basis. What audit practice fits?
- Risk ranking for city wireless assets must guide spending. How should public-safety WLAN be treated versus open guest Wi-Fi?
- WIPS detects a rogue AP advertising the city’s employee SSID near city hall. What response aligns with policy-driven containment?
- County sheriff deputies' laptops sometimes join a neighboring agency's SSID that overlaps City Hall's RF footprint. Beyond reminding staff of the acceptable-use policy, which combined approach best reduces misassociation risk?
- A municipality is rolling out EAP-TLS for thousands of city and school devices. Which CA and certificate-lifecycle consideration is most important at that scale?
- A school district places teacher BYOD tablets on a WPA3-Enterprise SSID. How should mobile device management (MDM) primarily support that security design?
- City inspectors must use hotel and conference Wi-Fi while traveling. What role should a VPN overlay play relative to the untrusted wireless LAN?
- Facilities still has a mix of WPA3-capable phones and older barcode scanners. Leadership asks whether to force strict WPA3 or allow a transition mode. What is the sound selection principle?
- A county SOC notices bursts of failed 802.1X authentications against the city RADIUS cluster. Why should authentication-failure logging be prioritized?
- NAC marks a contractor laptop non-compliant during posture check on the city employee SSID. What network design element best supports remediation?
- WLAN controllers for the transit authority sit in unlocked telecom closets shared with janitorial storage. Which hardening step belongs in the security architecture?
- Finance insists the tax-system SSID use a shared WPA2-Personal passphrase 'because it is simpler than 802.1X.' 802.1X infrastructure already exists. What architecture choice is appropriate?
- The city WLAN team plans to enable Wi-Fi 6E/7 features including 6 GHz operation. What security lifecycle step should precede broad enablement?
- A warehouse barcode scanner cannot support WPA3 and must remain on a constrained SSID. How should the exception be handled?
- During a festival hotspot event, WIPS reports floods of deauthentication frames targeting the city guest SSID. What is the appropriate defensive focus?
- Malware on one library guest laptop begins scanning other devices on the open public SSID. Which control best limits lateral movement?
- City network engineers currently manage outdoor APs over HTTPS from the public Internet using default accounts. What management-plane hardening is most appropriate?
- After a downtown channel replan, WIPS begins flagging many authorized APs as suspicious. What operational step should follow?
- Public-safety leadership asks what business impact analysis should capture if the dedicated public-safety WLAN becomes unavailable during an incident. What should that analysis emphasize?
- Controller admin accounts for the parks WLAN still use shared passwords without a second factor. What control best hardens administrative access?
- The county jail WLAN must remain highly isolated, while city corporate offices need segmented but interconnected services. What security-model takeaway applies?
- WIPS and switch logs show an employee laptop bridging the city WLAN to a personal hotspot via Windows Internet Connection Sharing. How should this be treated?
- Nightly backups of WLAN controller configurations include RADIUS secrets, certificates, and PSKs. How should those backups be protected?
- Auditors ask whether Management Frame Protection (PMF / 802.11w) is enabled on SSIDs that require it. What should the WLAN security design validate?
- Marketing wants visitor foot-traffic analytics SSIDs collocated with employee 802.1X SSIDs using the same VLAN and identity store. What design guidance applies?
- During a city council livestream, attendees report a suspected wireless man-in-the-middle near the chambers. What incident-response approach is most appropriate?
- A construction vendor plugs an unmanaged consumer AP into a city building VLAN without change control. How should this be classified and handled?
- Continuous monitoring shows RADIUS authentication volume climbing with new clinics joining the municipal WLAN. What capacity-planning action aligns with security-service lifecycle needs?
Performance, QoS, and Optimization · 45 questions
- On permit day, a municipal licensing lobby fills with mixed phones, tablets, and a few legacy scanners that still associate at very low rates. Voice and tablet sessions stall while those slow clients stay associated. Which remediation best restores fairer airtime without abandoning capacity planning?
- City hall’s VoWLAN SSID shows retry rates climbing above a 10% operational baseline during morning council prep, while associated RSSI still looks acceptable. How should the wireless expert interpret that metric?
- Marketing materials for the civic center Wi-Fi advertise a 1.2 Gbps PHY rate. Stakeholders expect every visitor tablet to see that speed in a file download. What should the CWNE-level explanation emphasize?
- After APs on adjacent floors of a municipal office slowly crept up in transmit power, clients report sluggish browsing even though each floor heatmap still looks green. Captures show frequent deferrals to same-channel BSS energy. What performance limiter is most likely?
- Dispatch radios on the city’s voice SSID still lose contention during busy shift changes even though WMM is enabled. Protocol analysis shows the voice access category waiting as long as best-effort because AIFSN values were mis-set. What should be corrected?
- Softphones at the utility call center mark voice packets DSCP EF on the wired LAN, yet airtime traces show those frames competing in best-effort WMM queues after they hit the AP edge. What end-to-end fix is required?
- A constrained courtroom VoWLAN cell occasionally admits so many softphones that existing calls degrade. Controllers support WMM Admission Control (WMM-AC). When is enabling it most appropriate?
- A clerk’s laptop remains associated to a distant AP across the municipal records wing, running low MCS and consuming excess airtime while a nearer AP is available. Which optimization approach best addresses the sticky-client performance hit?
- Inspectors’ VoWLAN handsets in a dense city annex ping-pong between APs every few seconds, creating audible gaps. Coverage overlap was increased aggressively after a complaint about dead spots. What should the expert tune next?
- A dense permitting office currently uses 40 MHz channels on 5 GHz and suffers heavy co-channel contention during peak filing hours. Capacity modeling shows many modest flows rather than a few very wide clients. Which channel-width change best improves reuse?
- Leadership proposes one high-power AP to “cover” an entire municipal service lobby that fails capacity tests at lunch. What CWNE-aligned capacity response should replace that idea?
- A single 802.11b barcode scanner remains on the city’s 2.4 GHz facilities SSID. Throughput for modern clients collapses whenever the scanner is active. What performance mechanism explains most of that loss?
- A large municipal VLAN spans hundreds of wired printers and IoT endpoints; wireless clients on the same broadcast domain see airtime spikes from ARP and other BCMC floods. Which remediation best protects WLAN airtime?
- A city warehouse Wi-Fi 6 deployment supports many handheld scanners and softphones exchanging frequent small frames under load. Which HE feature most directly improves efficiency for that traffic pattern?
- Post-install validation in the council chamber shows ICMP ping success to the gateway, yet Microsoft Teams calls fail quality thresholds. What testing principle should the expert insist on?
- County VoIP markings remain correct inside the campus, but quality collapses across the WAN after a firewall at the edge rewrites DSCP to zero. What QoS design issue does this reveal?
- During a live emergency-ops voice call, aggressive AP load-balancing steers the handset to another radio mid-conversation and the call glitches. What feature-interaction lesson applies?
- A festival temporary WLAN plan places every 5 GHz AP only on DFS channels to maximize count. Mid-event radar detections force channel moves and capacity collapses. What risk should have been highlighted in the design review?
- Monitoring for a city clinic WLAN shows client MCS distributions skewed low even though RSSI histograms look healthy. Retries are elevated. What should the expert investigate first?
- At a sold-out civic concert, APs show high channel utilization with relatively little user data. Traces reveal storms of probe requests from hundreds of phones. What performance issue dominates?
- Bulk TCP transfers on a records-office SSID crawl even though PHY rates look decent. Captures show data MPDUs without successful Block Ack agreements, so aggregation never stays enabled. What performance conclusion follows?
- Facilities IoT sensors that only support 2.4 GHz keep failing association when band steering is set aggressively on the municipal WLAN. What optimization exception should be applied?
- Planners estimate WLAN capacity for a busy municipal courtroom using expected client counts, application duty cycles, and assumed MCS values. What is the sound use of that model?
- Collision counters rise in a long municipal hallway where clients often cannot hear each other; a temporary enablement of RTS/CTS reduces errors but adds overhead. What is the expert stance?
- Nightly RRM runs extensively retune channels across city-hall APs; each morning users experience roam storms and unstable performance until the plan settles. How should RRM be stabilized?
- A municipal public-safety outdoor WLAN with sparse AP spacing is choking when patrol bodycams stream uplink video during an incident. Coverage heatmaps still look acceptable. What design change best addresses the uplink-heavy load?
- County VoWLAN handsets clip during hallway moves between civic-center APs. Which measurement best proves whether roam latency violates the voice budget?
- A dense municipal office WLAN has solid SNR in primary work areas, yet airtime charts show slow stations consuming disproportionate medium time. What optimization most directly shrinks effective cell size and improves airtime efficiency?
- On a shared civic Wi-Fi RF medium, guest bulk downloads and employee VoWLAN compete. How should QoS be applied so voice remains protected?
- After a city WLAN team changes channel widths and minimum rates, how should they validate that optimization actually helped?
- During a festival on the civic plaza, RF utilization still has headroom, but an AP refuses new associations and CPU is pegged. What does this indicate?
- A Wi-Fi 6 AP in city hall shows high PHY rates and low wireless retries, yet users report slow large transfers. The AP Ethernet uplink is a Fast Ethernet (100 Mbps) switch port. What should the engineer conclude?
- Spectrum at a municipal garage shows high duty cycle on the working channel, yet 802.11 retry counters stay low. What performance impact is still likely?
- Guest firmware and OS update storms on the civic guest SSID degrade daytime VoWLAN on shared APs. Besides RF and WMM tuning, what operational control helps most?
- A county WLAN advertises several near-duplicate SSIDs that differ mainly by QoS profile, and clients often join the wrong one. What optimization should the designer pursue?
- In a civic auditorium, upper-balcony seats see strong CCI from floor APs aimed too high. What physical remediation best reduces that interference while preserving floor coverage?
- A fleet of county tablets shows persistently low MCS despite excellent SNR and clean spectrum at the AP. Packet captures implicate the client driver. What is the most appropriate remediation focus?
- Municipal environmental sensors send short periodic telemetry but experience delayed bursts when WMM-Power Save is enabled on their WLAN profile. What should the engineer evaluate?
- A civic exam hall needs many concurrent clients with carefully controlled CCI. Which high-density pattern best fits?
- A city network team must prove VoWLAN remains protected when guest load rises. Which monitoring approach best supports that proof?
- A parks-department predictive heatmap is fully green at −67 dBm, yet a capacity test with hundreds of clients fails SLAs. What lesson should guide validation?
- Airtime reports for a municipal WLAN show excessive management overhead from many SSIDs. What optimization most directly reduces beacon overhead?
- During a failover drill, a city controller cluster fails. Some client data forwarding continues while new 802.1X authentications stall. What does this most likely demonstrate?
- An outdoor civic patio SSID shows rising retries each summer as trees leaf out between APs and seating. What should the WLAN team do?
- After accepting a new municipal WLAN, what performance artifacts should the team capture to detect future regressions?
Wireless IoT Solutions · 30 questions
- A municipal smart-building team needs room-level occupancy with coin-cell sensors that must last years. Wi-Fi RTT infrastructure is available but power-hungry for the endpoints. Which technology choice best matches accuracy and power needs?
- A city wants backhaul from water meters buried in pits where enterprise Wi-Fi coverage is impractical. Which approach best fits?
- A school retrofit adds a Zigbee lighting fabric on 2.4 GHz alongside the enterprise WLAN. What coexistence planning is most appropriate?
- Municipal parking sensors must send frequent small telemetry to a city cloud. Which application protocol choice is most fit for efficient telemetry versus chatty HTTP polling?
- On a municipal IoT architecture diagram, how should WLAN, WPAN, and WSN roles be classified?
- A municipal utilities team plans outdoor LoRaWAN gateways on city poles adjacent to a federal spectrum coordination zone. What planning step best applies regulatory constraints before deployment?
- A city facilities group wants Bluetooth-enabled smart lockers across every civic building this quarter. What implementation approach best reduces risk before citywide rollout?
- A municipal warehouse will use BLE and Zigbee sensors that must reach a city IoT platform. How should gateway placement and backhaul be designed?
- A civic IoT fleet will grow to about 5,000 sensors on the city network. Which security design is most appropriate at that scale?
- A municipal clinic will co-locate Wi-Fi, BLE patient tags, and Zigbee environmental sensors in the same 2.4 GHz band. What planning action best coordinates those systems?
- A city hospital wants either coarse presence detection for infusion pumps or meter-level RTLS trilateration for high-value assets. How should wireless density requirements be treated?
- A municipal public-works shop floor is evaluating Industry 4.0 sensors and actuators that need deterministic timing. What expectation should the wireless architect set about best-effort enterprise Wi-Fi?
- Overnight, several blocks of a smart-city street-lighting mesh go dark in the municipal operations console. What support playbook focus best matches common outdoor IoT mesh and gateway failure modes?
- A county clinic is onboarding wireless infusion pumps and bedside monitors. Which network placement best supports clinical IoT?
- A city IoT platform generates gateway-down and sensor-threshold alerts that operations wants inside the municipal ITSM tool. What integration approach best fits that goal?
- A municipal IoT engineer must review a controller configuration payload before pushing it to field gateways. Which statement best reflects basic data-structure literacy for that task?
- Public works wants to add thousands of Wi-Fi IoT clients to the existing municipal WLAN. What planning step should come first?
- A city environmental program needs low-throughput, long-range sensors for remote flood gauges. At a concept-planning level, how do Sigfox and LoRaWAN typically compare as LPWAN options?
- A civic IoT program is designing the application tier that will process sensor telemetry and drive dashboards. What systems-planning consideration belongs in that design?
- A municipal parking sensor stops reporting. How should support structure the first isolation steps among weak signal, wrong application key, and RF interference?
- After a civic IoT deployment, which documentation hand-off package best enables sustained operations?
- A school district proposes BLE attendance beacons that continuously track student devices across campus. What constraint should shape the wireless IoT design?
- A large public civic venue will use temporary IoT ticket scanners for a three-day festival. What WLAN/IoT design approach is most appropriate?
- A municipal wireless architect tracks evolving standards for Wi-Fi, Bluetooth, and LoRa-class IoT. Which awareness of standards organizations is most accurate?
- When explaining long-range LoRa-class municipal sensor links at a conceptual RF level, which modulation association is most appropriate?
- Constrained civic sensors must send small telemetry with minimal protocol overhead. When is CoAP over UDP often a better fit than MQTT over TCP?
- County agriculture extension deploys battery-powered soil sensors in remote fields. What trade-off should drive report-interval planning?
- A department proposes using consumer smart-home hubs as the architecture for citywide municipal IoT. What planning stance is most appropriate?
- A civic campus places dense BLE tags on an IoT VLAN while WIPS/IDS watches the WLAN. What monitoring awareness is most important?
- Facilities crews will replace failed Zigbee sensors in civic buildings. What training focus best prevents breaking the mesh during routine swaps?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by CWNP.