CWAP-405, the Certified Wireless Analysis Professional exam from CWNP, is the credential that asks you to prove you can read what a wireless network is actually doing rather than describe what it is supposed to do. Most wireless certifications test design and configuration. The CWAP certification tests interpretation: you are handed frames, spectra and decodes, and you have to say what went wrong. That difference shows in the blueprint, where 802.11 frame exchanges alone account for 30% of the paper and the MAC sublayer takes another 25%. Spectrum analysis, the discipline most candidates assume dominates an analysis exam, is worth only 10%. This article covers what the exam contains, what the CWNA prerequisite really means for your timeline, how the six domains are weighted, whether the CWAP-404 material on your shelf is still useful, and how to build a study plan that matches where the marks actually sit.
What Is the CWAP Certification?
The CWAP certification, earned by passing exam CWAP-405, is CWNP’s professional-level credential for wireless LAN analysis and troubleshooting. It validates that a candidate can capture 802.11 frames correctly, interpret protocol and spectrum data, and work through a wireless fault methodically. The exam runs 60 questions in 90 minutes and requires 70% to pass.
The word analysis is the whole point. A CWNA holder can explain how a wireless network is meant to behave. A CWAP holder is expected to open a capture from a network that is misbehaving and identify why, using frame decodes, retry rates, PHY headers and spectrum views rather than guesswork.
Where it sits in the CWNP track
CWNP runs a professional tier above its administrator credential, with separate exams for analysis, design and security. CWAP is the analysis branch. Holding it while your CWNA remains valid earns the credential outright and counts toward the expert-level CWNE, which is the destination most people on this track are actually aiming at.
The credential itself is valid for three years, so it sits on roughly the same renewal rhythm as the rest of the CWNP programme. Details of the whole programme are on the official CWAP page.
Do You Need CWNA Before Taking CWAP-405?
Yes. CWNP requires a current and valid CWNA credential to earn the CWAP certification. You can sit the CWAP-405 exam, but the credential is not awarded unless your CWNA is live at the time. That makes CWNA a genuine gate rather than a recommendation, and it is the single most common planning mistake candidates make.
The practical consequence is a timeline question. If your CWNA expired eighteen months ago, your CWAP project starts with a CWNA renewal, not with a packet capture. Budget for that before booking anything.
Why the prerequisite is technically justified
CWAP-405 does not re-teach fundamentals. The blueprint assumes you already know channel plans, data rates, roaming behaviour and the basic frame types, then asks you to reason about them under fault conditions. A candidate without that base spends the exam decoding vocabulary instead of decoding frames.
Anyone still working toward the administrator credential should start with the CWNA certification requirements, and this CWNA-109 preparation article covers what that exam involves.
What Is on the CWAP-405 Exam?
CWAP-405 presents 60 questions in 90 minutes, which allows 90 seconds per item, and costs $349.99 USD. The pass mark is 70%, rising to 80% for candidates seeking instructor status. The exam can be taken through a Prometric testing centre or through CWNP’s remote proctoring service.
| Exam detail | Value |
|---|---|
| Exam name | Wireless Analysis Professional |
| Exam number | CWAP-405 |
| Questions | 60 |
| Duration | 90 minutes |
| Passing score | 70%, or 80% for instructors |
| Price | $349.99 USD |
| Prerequisite | Current and valid CWNA credential |
| Delivery | Prometric testing centre or CWNP remote proctored |
Six domains carry the marks, and the distribution is far more lopsided than most candidates expect. Two domains hold 55% of the paper between them.
| Domain | Weight | What it covers |
|---|---|---|
| 802.11 Frame Exchanges | 30% | Frame exchange sequences, control and management behaviour, retries and acknowledgements |
| MAC Sublayer and Functions | 25% | MAC layer frame formats, addressing, aggregation and the functions built on them |
| Protocol Analysis | 15% | Capture devices and locations, monitor mode, filters, decodes, decryption, expert mode, peer maps |
| Spectrum Analysis | 10% | Real-time FFT, waterfall and density views, duty cycle, noise floor, SNR, interference signatures |
| PHY Layers and Technologies | 10% | DSSS, OFDM, ERP, HT, VHT, HE and EHT, PPDU formats, pseudo-headers, MCS index |
| WLAN Medium Access | 10% | Contention, medium access rules and the timing that governs them |
Working through the CWAP-405 sample questions early is worth more here than on most exams, because the phrasing tells you how deeply each domain is probed.
Why Do Frame Exchanges Carry Almost a Third of the Exam?
802.11 frame exchanges account for 30% of CWAP-405 because a frame exchange is where a wireless problem becomes visible. Association failures, roaming delays, power-save misbehaviour and throughput collapse all show up as a sequence of frames that did not complete as expected, and reading that sequence is the core skill the credential certifies.
The domain is not a memory test on frame types. It asks what should have happened next. When a client sends a request and the expected response never arrives, the diagnostic value sits in knowing what the standard requires at that moment, which is why the exam leans on sequence knowledge rather than field-by-field recall.
What to practise
- Capture a full association and reassociation, then trace every frame in order and name its role.
- Capture a roam between two access points and measure the gap the client experienced.
- Force a retry storm on a busy channel and watch how the retry bit and acknowledgement pattern change.
- Compare a clean exchange with a broken one side by side rather than studying either alone.
The IEEE 802.11 standard is the underlying reference for all of it, and while nobody reads it end to end, knowing which clause governs a behaviour settles arguments quickly.
What Does the MAC Sublayer Domain Actually Test?
The MAC sublayer domain is 25% of CWAP-405 and covers frame formats, addressing, aggregation and the functions layered on top of them. It is the structural companion to the frame-exchange domain: exchanges tell you what happened in sequence, while MAC content tells you what each frame was carrying and how it was built.
Aggregation is where candidates most often lose marks. Modern Wi-Fi moves data in aggregated units rather than single frames, and a capture of an efficient network looks nothing like the textbook diagrams most people learned from. Understanding what an aggregate contains, and how an analyser presents it, changes how you read throughput problems.
Addressing is not optional detail
Four-address frames, distribution system flags and the difference between the transmitter and the source turn up constantly in real captures, particularly in mesh and bridged deployments. If you can look at a frame and immediately say which device sent it and which device originated the payload, this domain becomes straightforward. If you cannot, it becomes a guessing exercise worth a quarter of the exam.
How Much Spectrum and PHY Knowledge Does CWAP-405 Require?
Less than most candidates assume. Spectrum analysis, PHY layers and technologies, and WLAN medium access each carry 10% of CWAP-405, so all three together are worth 30%, exactly the same as the frame exchange domain on its own. The material still has to be covered, but it does not deserve the majority of your study time.
Spectrum analysis
The spectrum objectives are practical rather than theoretical. You need to work a real-time FFT, a waterfall or swept spectrogram, a density view and utilisation and duty cycle readouts, then use them to identify a noise floor, calculate signal to noise ratio, and recognise the signature of a non-Wi-Fi transmitter. Microwave ovens, video devices, cordless phones, frequency hopping devices and jammers all have distinct shapes, and recognising them on sight is the examinable skill.
PHY layers and technologies
The PHY domain spans the full generational sweep from DSSS and HR/DSSS through OFDM and ERP to HT, VHT, HE and EHT. What matters for the exam is the pseudo-header: Radiotap and PPI headers are where an analyser surfaces guard intervals, resource unit allocation, PPDU format, signal strength, noise and MCS index. Knowing what those fields mean turns a capture into evidence.
Medium access rounds it out with contention and timing, which is the mechanism that explains why a lightly loaded channel can still deliver poor throughput.
Is Your Old CWAP-404 Material Still Usable?
Partly. CWAP-405 is the current version of the exam, and CWAP-404 material still explains capture technique, spectrum views and protocol analysis workflow accurately. What it does not carry is the newer PHY generations and the current objective structure, so treating it as a complete preparation plan will leave gaps in exactly the domains that have moved.
The safest way to use older material is as background. Read it for the methodology, which has not changed, and then work the current objectives to find what it never mentioned. The earlier CWAP-404 guide is useful context for what carried over.
What has moved on
- EHT and the newest PHY generation, which older material predates entirely.
- Resource unit allocation and the OFDMA-era fields exposed in pseudo-headers.
- Current analyser feature sets, including centralised monitoring and client experience tooling.
Search results still send a lot of traffic to CWAP-404, and to the retired 403 and 402 versions before it. If a study resource does not name CWAP-405 explicitly, check its objective list against the current one before trusting it.
How Should You Build a CWAP-405 Study Plan?
A CWAP-405 plan should follow the weights, not the objective order, and it should be built around captures rather than reading. Six to ten weeks is realistic for an engineer already holding CWNA and working with wireless daily. The sequence below front-loads the two domains that carry 55% of the marks.
- Confirm your CWNA credential is current before anything else, because the CWAP credential is not awarded without it and a renewal can add weeks to the timeline.
- Build a capture setup you can use repeatedly, installing monitor mode drivers and confirming you can capture on a chosen channel and channel width without dropped frames.
- Spend the largest block of study time on frame exchanges, capturing association, reassociation, roaming and retry behaviour and tracing each sequence in order until the expected next frame is obvious.
- Move to the MAC sublayer, focusing on aggregation and on four-address frames, since those are the two areas where real captures diverge most sharply from textbook diagrams.
- Cover spectrum, PHY and medium access as one shorter block, learning to recognise interference signatures on sight and to read guard interval, MCS index and PPDU format from pseudo-headers.
- Finish with timed practice at 90 seconds per question, reviewing every wrong answer against the objective it came from rather than against the answer key alone.
Tooling
Nearly all of this work can be done with a laptop analyser and a spectrum adapter. The Wireshark project covers the protocol side, and the objectives explicitly name display filters, colorisation, column configuration, decryption and expert mode, all of which it provides. Interoperability context for the generational features sits with the Wi-Fi Alliance.
Frequently Asked Questions
How many questions are on the CWAP-405 exam?
CWAP-405 contains 60 questions and allows 90 minutes, which works out to 90 seconds per item. That is a comfortable pace for recall questions but tight for capture-interpretation items, so practise reading decodes quickly.
What is the passing score for CWAP?
The pass mark is 70% for standard candidates. Anyone seeking CWNP instructor status must reach 80% instead, which is the same exam at a higher bar rather than a different paper.
How much does the CWAP certification cost?
The exam fee is $349.99 USD. Capture hardware, a spectrum adapter and study material are separate costs, so budget for those if you do not already have a working analysis setup.
Do you need CWNA to take CWAP-405?
A current and valid CWNA credential is required to earn the CWAP certification. You can sit the exam without it, but the credential will not be awarded until CWNA is live, so check your expiry date before booking.
Which CWAP-405 domain carries the most weight?
802.11 frame exchanges at 30%, followed by the MAC sublayer at 25%. Those two together are 55% of the paper, while protocol analysis is 15% and the remaining three domains carry 10% each.
How long is the CWAP certification valid?
Three years. Recertification follows the standard CWNP cycle, and holding CWAP alongside a valid CWNA also counts toward the expert-level CWNE credential.
Is CWAP-404 study material still relevant?
Only as background. The capture methodology and analyser workflow carried over, but the newest PHY generation and the current objective structure did not, so verify any resource against the CWAP-405 objectives before relying on it.
Where can you take the CWAP-405 exam?
At a Prometric testing centre in person, or through CWNP’s remote proctored exam service. Both deliver the same 60 question paper under the same 90 minute limit.
How much spectrum analysis does the exam test?
Spectrum analysis is 10% of the paper. It is genuinely practical content covering FFT and waterfall views, duty cycle, noise floor, SNR and interference signatures, but it should not dominate your preparation.
Is CWAP harder than CWSP or CWDP?
They are different rather than ranked. CWAP is the most capture-driven of the three, so engineers who work with analysers regularly often find it the most approachable, while those who have never captured frames find it the hardest.
Conclusion
CWAP-405 rewards people who open captures rather than people who read about them. The blueprint says so without ambiguity: frame exchanges and the MAC sublayer are 55% of the marks, and the spectrum content that candidates most often fixate on is worth a tenth of the paper.
The plan follows from that. Confirm your CWNA is live, build a capture setup you trust, and spend most of your time tracing real exchanges until the expected next frame is obvious before you look. Treat CWAP-404 material as background rather than a syllabus, and finish with timed questions so 90 seconds per item stops being a constraint. From there the credential is a matter of practice, not memory.
