CWNA Domain 5: WLAN Network Security (10%) - Complete Study Guide 2026

What Domain 5 Actually Covers - and Why 10% Still Matters

At first glance, 10% looks like the domain you can afford to skim. That instinct is a mistake. On a 60-question CWNA exam where you need 42 correct answers to pass (70%), every domain matters - and WLAN Network Security questions tend to be among the most precise and unforgiving on the entire test. A single misremembered EAP type or a confused understanding of which cipher suite WPA3 mandates can cost you a question you should have gotten right.

Domain 5 also overlaps meaningfully with other domains. Security architecture decisions intersect with Domain 4 (WLAN Network Architecture and Design Concepts), and the regulatory framework that drives security compliance requirements connects back to Domain 2. Understanding security in isolation is not enough - the exam tests whether you can apply it in context.

For a full picture of how Domain 5 fits within the entire exam blueprint, see the CWNA Exam Domains 2026: Complete Guide to All 6 Content Areas, which maps every domain's weight and content focus.

Core Security Concepts You Must Own

Before you can correctly answer scenario-based security questions, you need a solid conceptual foundation in how WLAN security is structured. The CWNA exam tests candidates on the three pillars of wireless security: authentication (verifying who or what is connecting), encryption (protecting data in transit), and integrity (ensuring data hasn't been altered).

One concept that trips many candidates is the distinction between the authentication method and the encryption protocol. WPA2-Enterprise uses 802.1X for authentication and CCMP/AES for encryption - these are separate mechanisms that work together. The exam will present scenarios where you must identify which component is failing or which should be configured.

Authentication Frameworks: 802.1X, EAP, and RADIUS

This is the densest area in Domain 5 and likely the source of most of the exam questions it generates. The IEEE 802.1X standard defines port-based access control and is the backbone of enterprise WLAN security. Understanding its three-party architecture - supplicant (client), authenticator (AP or controller), and authentication server (RADIUS) - is mandatory.

EAP Types You Must Know by Name and Behavior

The exam does not just ask you to recognize EAP types - it asks you to differentiate them based on security characteristics, certificate requirements, and deployment scenarios. Study each of these with precision:

RADIUS and the Authenticator Role

Candidates must also understand RADIUS server operation, including how the AP (or wireless LAN controller) acts as a RADIUS client - not the wireless endpoint. This distinction matters on scenario questions. The wireless client is the supplicant; the AP passes EAP messages encapsulated in RADIUS to the authentication server. Know the port numbers (UDP 1812 for authentication, UDP 1813 for accounting) and the concept of RADIUS shared secrets.

Encryption Protocols: WEP, TKIP, CCMP, and GCMP

The evolution of WLAN encryption is a direct narrative of security failures and the standards responses to them. The CWNA exam tests this timeline and expects you to know why each protocol was created, what vulnerabilities it addressed, and what replaced it.

WPA3 introduces two major security improvements the exam covers directly: SAE (Simultaneous Authentication of Equals), which replaces the PSK handshake and eliminates offline dictionary attacks, and mandatory PMF (Protected Management Frames) via 802.11w. Candidates who only studied WPA2 for previous exams need to spend deliberate time on WPA3 specifics for the CWNA-109.

WLAN Threat Landscape and Attack Vectors

Domain 5 is not purely about building secure networks - it also tests your ability to recognize attacks and understand how defensive tools work. The exam presents scenarios describing network behavior and asks candidates to identify the attack type or the appropriate mitigation.

High-Priority Threats for the Exam

• Rogue Access Points: Unauthorized APs connected to the wired network. Differ from evil twin APs, which mimic legitimate SSIDs without a wired connection. Know both types and how each is detected.
• Evil Twin (Honeypot AP): An attacker-controlled AP broadcasting a legitimate SSID to intercept client traffic. Clients associate based on signal strength or preference, bypassing security controls.
• Deauthentication (Deauth) Attacks: Management frame spoofing that forces clients to disconnect. 802.11w/PMF mitigates this by encrypting and authenticating management frames.
• Man-in-the-Middle (MitM): Often facilitated by evil twin attacks. The attacker positions between the client and legitimate AP to intercept or modify traffic.
• Dictionary and Brute-Force Attacks Against PSK: WPA2-PSK is vulnerable because the 4-way handshake can be captured and attacked offline. SAE in WPA3 eliminates this vulnerability.
• Krack Attack: Key Reinstallation Attack targeting the WPA2 4-way handshake nonce reuse. Patched by firmware updates but appears on exams as a known WPA2 vulnerability.

Security Policy Design and Network Segmentation

Beyond knowing individual security mechanisms, Domain 5 tests whether candidates can make appropriate design decisions. This includes selecting the right security mode for a given environment, segmenting traffic using VLANs, and implementing guest network isolation.

Security Mode Selection by Environment

Small offices or home environments typically use WPA3-Personal (SAE) or WPA2-Personal (PSK) because deploying a RADIUS infrastructure is impractical. Enterprise environments should use WPA3-Enterprise or WPA2-Enterprise with 802.1X/EAP to provide per-user authentication and centralized access control. The exam will describe organizational contexts and expect you to match the appropriate security mode.

Guest Network Architecture

Guest networks must be isolated from corporate resources. The correct architecture involves a separate SSID mapped to a dedicated VLAN that routes directly to the internet without access to internal network segments. Captive portals can be layered on top for acceptance of terms and optional user registration. Know the difference between client isolation (preventing client-to-client communication within the same SSID) and complete network segmentation.

These architecture decisions connect directly to concepts in Domain 4: WLAN Network Architecture and Design Concepts, which covers controller-based deployments, VLAN design, and roaming architecture in greater depth.

How Domain 5 Questions Are Written and What Trips Candidates

The CWNA exam uses multiple-choice and multiple-answer formats across all domains. Domain 5 questions tend to be scenario-based, presenting a network environment with a security problem and asking candidates to diagnose the issue or recommend a solution. Multiple-answer questions in this domain often list four or five EAP types and ask which two are appropriate for a specific deployment constraint.

The most common traps in Domain 5 questions:

1. Confusing EAP type with WPA version: EAP-TLS can run under WPA2-Enterprise or WPA3-Enterprise. The EAP type and the WPA generation are separate choices.
2. Choosing TKIP for a modern deployment: TKIP is deprecated. Any scenario describing a new deployment should never include TKIP in the correct answer.
3. Mixing up WIDS and WIPS capabilities: If a question asks which system can actively disconnect rogue APs, the answer is WIPS, not WIDS.
4. Treating SAE as optional in WPA3-Personal: SAE is not optional in WPA3-Personal - it is the defining feature that replaces PSK.

Practicing with realistic scenario questions is the most effective preparation method for Domain 5. The Best CWNA Practice Questions 2026: What to Expect on the Exam guide covers the formats and question types you'll encounter across all domains, with specific guidance on eliminating distractors in security questions. You can also test your current knowledge directly at our CWNA practice exam platform.

If you want a broader view of what makes the overall exam challenging, How Hard Is the CWNA Exam? Complete Difficulty Guide 2026 provides domain-by-domain difficulty analysis that places Domain 5 in proper context against heavier-weighted areas like RF Technologies and WLAN Protocols.

A Two-Week Security Domain Study Plan

Because Domain 5 is 10% of the exam, it should not dominate your overall study calendar. For a full six-domain study plan with time allocation guidance proportional to each domain's weight, the CWNA Study Guide 2026: How to Pass on Your First Attempt provides a structured roadmap that balances all content areas appropriately.

Also review the CWNA Exam Day Tips: 15 Strategies to Maximize Your Score for guidance on managing the 90-minute time limit across all 60 questions, including how to pace yourself on multi-answer security questions that require more analysis time.

Frequently Asked Questions