Study guide
12.4 PMF, Fast Roaming, WIPS and Secure Management
CWNA Certified Wireless Network Administrator CWNA-109
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current Exam Facts 1.2 CWNA-109 Knowledge Domains and Study Strategy
2 RF Fundamentals
2.1 RF Waves, Propagation, Gain and Loss 2.2 Reflection, Multipath, VSWR and Free-Space Path Loss 2.3 RF Units and the Rule of 10s and 3s
3 RF Measurement and Antenna Systems
3.1 Noise Floor, SNR, RSSI and EIRP 3.2 Line of Sight, Fresnel Zone, Polarization and MIMO 3.3 Antenna Types, Charts, Cables and Lightning Protection
4 Industry Bodies and Legacy PHY
4.1 Industry Organizations and OSI Layers 4.2 Legacy 802.11 PHY Standards 4.3 Spread Spectrum, Modulation and MCS
5 Modern 802.11 PHY and Channel Concepts
5.1 Wi-Fi 4 HT and Wi-Fi 5 VHT 5.2 Wi-Fi 6 and Wi-Fi 6E High Efficiency 5.3 Primary Channels, OBSS, Throughput and Guard Interval
6 Spectrum Rules and WLAN Use Cases
6.1 Frequency Bands, DFS and Transmit Power Control 6.2 WLAN, Bridging, Peer-to-Peer and Mesh
7 802.11 Service Sets and Framing
7.1 Stations, BSS, ESS and the Distribution System 7.2 MSDU, MPDU, PSDU, PPDU and Aggregation 7.3 MAC Frame Format and Addressing
8 Frame Types, Discovery, and Association
8.1 Management, Control and Data Frames 8.2 Scanning, Authentication and Association
9 Channel Access, MAC Operations, and Devices
9.1 DCF, EDCA, RTS/CTS and Interframe Spaces 9.2 Roaming, Power Save and Protection Mechanisms 9.3 Access Points, Controllers and Client Devices
10 PoE, Architectures, and Proprietary Features
10.1 Power over Ethernet, PSE and Power Budgets 10.2 Centralized vs Distributed Forwarding and Network Planes 10.3 Airtime Fairness, Band Steering and RRM
11 WLAN Design and Supporting Services
11.1 Data, Voice, Video and Legacy Client Design 11.2 High-Density, Location Services and Guest Access 11.3 DHCP, DNS, Time, VLANs and AAA
12 WLAN Security
12.1 Weak and Deprecated WLAN Security 12.2 AES, WPA2-Personal and WPA2-Enterprise 12.3 WPA3, SAE and Opportunistic Wireless Encryption 12.4 PMF, Fast Roaming, WIPS and Secure Management
13 RF Validation Surveys and Tools
13.1 Post-Implementation Validation Surveys 13.2 Application and Performance Testing 13.3 Validation Tools: Survey, Protocol and Spectrum
14 Interference, Troubleshooting, and Common Faults
14.1 Co-Channel Contention vs Adjacent Channel Interference 14.2 Protocol Analyzers, Spectrum Analyzers and Monitoring 14.3 Common WLAN Faults and Hidden Nodes
12.4 PMF, Fast Roaming, WIPS and Secure Management
Key Takeaways Explain This Topic AI
Choose access control to match identity: captive portal for guest AUP, PSK/SAE for scoped devices, 802.1X for employees.
Protected Management Frames (802.11w) integrity-protect deauthentication, disassociation, and other robust management frames; WPA3 requires PMF.
OKC and 802.11r FT shorten 802.1X roams by reusing key context so voice and real-time sessions survive BSS transitions.
A rogue AP is an unauthorized AP on your wired network; an interfering or neighbor AP contends in RF without that wired attachment.
Manage infrastructure with SSH and HTTPS, not Telnet or HTTP, and with SNMPv3 rather than community-string SNMPv1/v2c.
Last updated: September 2026
Objective 5.4 asks you to describe common security options and tools used on wireless networks: access control solutions, Protected Management Frames, fast secure roaming, WIPS and rogue detection, protocol and spectrum analyzers, and secure management protocols. Domain 5 is still 10 percent of CWNA-109, but this objective is where architecture, voice design, and day-two operations meet. You are selecting who is allowed on which SSID , keeping management frames from being spoofed , keeping 802.1X users in a call while they roam , noticing an AP that should not be on your switch , and not administering the controller over Telnet .
Access control solutions: captive portal, 802.1X, and PSK
Pick the control that matches the identity you actually need.
802.1X / WPA2- or WPA3-Enterprise is the employee and managed-device path. The authenticator holds the virtual port closed until RADIUS returns Access-Accept. You get a user or certificate identity, dynamic keys, VLAN/ACL attributes, and revocation. Pair it with NAC or MDM when you must check posture (disk encryption, OS version) or auto-enroll EAP-TLS certificates for BYOD. That is access control in the strong sense.
PSK or SAE is a shared (or per-device vendor) secret. Use it for IoT, printers, and small offices that cannot run a supplicant against AAA. WPA3-SAE is the better password mode when clients support it. Do not put staff laptops on the same PSK SSID as a lobby TV.
Captive portal (web authentication) is a layer-7 click-through after the station already has some 802.11 connectivity—often on open, OWE, or a guest PSK . The portal enforces an acceptable-use page, sponsors guest accounts, or bills a hotel stay. It is not 802.1X. After login, many systems authorize by MAC address , which is spoofable; mitigate with short session timeouts, client isolation, a guest VLAN with no path to internal prefixes, and rate limits . Never place a captive-portal guest SSID on the employee VLAN. BYOD onboarding portals that install a certificate and then move the device to 802.1X are a different, better pattern than leaving guests on MAC-auth forever.
Method Proves at 802.11/AAA Typical SSID Failure if misused
802.1X + EAP User or device identity, per-session keys Staff, managed endpoints Slow roams without FT/OKC; PEAP without cert validation
PSK / SAE Knowledge of a password IoT, tiny office Shared PSK: no per-user revoke; WPA2-PSK offline grind
Captive portal Web login / AUP after join Guest, venue Wi-Fi MAC-based session; open sniffing unless OWE; easy to skip isolation
Protected Management Frames (IEEE 802.11w)
Protected Management Frames (PMF) integrity-protect robust management frames . The important pair on every practice item is deauthentication and disassociation . Without PMF, those frames are unauthenticated. A transmitter that spoofs the AP’s address can tell a STA to leave, which is a cheap denial of service and a way to force reconnects. PMF does not encrypt Beacons and does not hide the SSID. It binds deauth/disassoc (and many Action frames) to keys so a stranger cannot forge them.
Unicast robust management frames use the pairwise key. Broadcast robust management frames use BIP (Broadcast Integrity Protocol) with an integrity GTK (IGTK). The RSN information element advertises MFPC (capable) and MFPR (required):
Both zero: PMF off (WPA2 legacy).
Capable, not required: mixed BSS; old clients join without PMF; PMF clients should still use it when the AP offers it.
Capable and required: only PMF clients join . WPA3-only modes set this.
Enable PMF required on employee SSIDs as soon as the client mix allows. WPA3 already requires it. Expect breakage on antique barcode scanners; give them a dedicated SSID rather than disabling PMF globally. PMF is complementary to AES-CCMP: data confidentiality without management integrity still leaves a kick-off path.
Fast secure roaming: OKC and 802.11r FT
A full 802.1X exchange plus 4-way handshake on every roam can cost hundreds of milliseconds to seconds. Voice, video, and some warehouse scanners drop. Fast secure roaming reuses key context so the STA can install keys with the target AP without repeating EAP to RADIUS.
Opportunistic Key Caching (OKC) is a widely deployed non-IEEE method. After the first 802.1X success, APs in a mobility domain can derive a PMK identifier so a roam completes with a 4-way handshake only . It is simple and usually “on” in controller families, but it is not the IEEE FT protocol.
IEEE 802.11r Fast BSS Transition (FT) is the standard. After an initial mobility-domain association, the STA performs an FT reassociation either over-the-air with the target AP or over-the-DS through the current AP. A shortened handshake installs keys. CWNA wants awareness that 802.11r exists and that it is the standards-based fast-roaming AKM , not a lab in R0KH/R1KH key naming (that depth is CWSP).
Related but distinct: PMK caching and 802.11i preauthentication (EAP to the target through the current AP) are older 802.11i tools. 802.11k neighbor reports and 802.11v BSS transition management help the client choose a roam target; they do not by themselves install keys faster. Voice designs combine coverage overlap , FT or OKC , and often k/v. Fast roaming is not a reason to use PSK “because 802.1X is slow”—it is a reason to turn on FT/OKC on the Enterprise SSID .
WIPS and rogue versus interfering APs
A Wireless Intrusion Prevention System (WIPS) (or WIDS if it only alerts) watches the air and, in integrated architectures, correlates with the wired edge. Classification language matters on the exam:
Valid / friendly AP — your infrastructure BSSID, known to the controller or WIPS inventory.
Neighbor / interfering AP — an 802.11 device you can hear that is not attached to your wired network . It contends for airtime (co-channel or adjacent) and may be a café next door. It is an RF problem first, a policy problem second. Containing it can disrupt someone else’s legal BSS.
Rogue AP — an AP that is unauthorized and connected to your wired LAN (a desk AP on an access port, a misconfigured printer with a soft AP bridged to Ethernet, an attacker who found an open jack). That is a network-security incident : it can bridge your VLAN to an SSID you do not control. WIPS wired correlation (seeing the AP’s MAC on a switch port and in the air) is how products promote a device from “interfering” to “rogue.”
Evil twin is a different story: an AP that imitates your SSID to collect credentials. It may or may not touch your wire. WIPS looks for SSID/BSSID impersonation, unexpected security IEs (your SSID advertised as open), and often location. Response is alert, locate, and wired port disable for true rogues; RF containment is a policy decision with legal and safety implications—know that the button exists, and that blindly containing every heard BSSID is how you attack the clinic next door.
Sensors may be dedicated overlay radios or APs that off-channel scan . Off-channel scanning is cheaper and misses some time on the serving channel; overlay is more complete. For CWNA, know both exist and that WIPS is how you detect , classify , and optionally prevent —not a substitute for 802.1X on the real SSID.
Protocol analyzers and spectrum analyzers as security visibility
A protocol analyzer (with a NIC in monitor mode) decodes 802.11 MPDUs . For security work you read the RSN information element (AKM, pairwise/group ciphers, MFPC/MFPR), watch EAPOL 4-way and 802.1X exchanges, and match association status codes to mismatches (PMF required vs client incapable, wrong AKM, TKIP where you expected CCMP). You confirm whether a “hidden” SSID is in a probe, whether a guest BSS is truly OWE, and whether deauths are appearing without PMF. It sees frames , not non-Wi-Fi energy.
A spectrum analyzer shows RF energy versus frequency and time: duty cycle, center frequency, pulse patterns. It identifies non-802.11 interferers (microwaves, analog video, some RADAR, poorly shielded cameras) and jamming-like energy that never appears as a valid MPDU. It cannot tell you the EAP method. Security and troubleshooting both need the pair: protocol for policy and handshake truth , spectrum for energy that is not a BSS .
WLAN scanners (client utilities, Ekahau-class tools, controller maps) sit in between: they list BSSIDs, RSSI, and security type without a full frame decode. Use them for inventory and rogue hunting at walking speed , then drop to a protocol capture when the RSN IE must be authoritative.
Secure management protocols
The WLAN can be WPA3-Enterprise and still be owned if the controller GUI is HTTP or the AP Telnet login uses admin/admin . Best practices at CWNA depth:
SSH (version 2) for CLI; disable Telnet .
HTTPS for GUI and APIs; disable HTTP or redirect it.
SNMPv3 with authentication and privacy ( authPriv ); do not use SNMPv1/v2c community strings on production. If a monitoring tool still needs v2c, isolate it and treat it as technical debt.
AAA for administrators (RADIUS or TACACS-style) rather than a shared local password; unique accounts; rotate secrets.
Management VLAN or OOB network ; do not manage APs from the client SSID.
VPN for staff who must reach the WLC from the Internet.
NTP so logs and certificates have trustworthy time; central logging .
Signed firmware, disable unused services (FTP, HTTP, old SSL), and no default certificates left trusted for admin if the vendor lets you replace them.
- Insecure default Replace with Why
- Telnet SSHv2 Telnet carries credentials and session text in the clear
- HTTP GUI HTTPS Same exposure for cookies and admin passwords
- SNMPv2c public / private SNMPv3 authPriv Community strings are reusable cleartext secrets
- Shared local admin Per-user AAA No attribution and painful rotation
Domain 5 as a whole is a sequence you can recite: refuse WEP, Shared Key, cloaking-as-security, MAC-as-auth, and TKIP ; use AES-CCMP/GCMP ; prefer 802.1X for people and SAE for password SSIDs ; require PMF ; encrypt guest with OWE ; roam with FT or OKC ; classify rogues with WIPS ; manage with SSH, HTTPS, and SNMPv3 . That is the entire 10 percent, taught as production practice rather than a toolkit of attacks.