- What CWSP Actually Is
- Who Issues It and How It Fits the CWNP Ladder
- CWSP-208 Exam Format at a Glance
- The Four Domains and Where the Points Are
- Technical Topics You Must Master
- Registration, Vouchers, and Remote Proctoring
- Validity and Renewal
- Who Benefits From the Credential
- A Domain-Weighted Prep Sequence
- Frequently Asked Questions
- CWSP means Certified Wireless Security Professional, issued by CWNP, and the current exam is CWSP-208.
- WLAN Security Design and Architecture carries 50% of the exam; Vulnerabilities, Threats, and Attacks carries 30%.
- The exam has 60 single-answer multiple-choice questions, 90 minutes, and a 70% passing score.
- A current, valid CWNA is required before you can earn CWSP.
What CWSP Actually Is
CWSP stands for Certified Wireless Security Professional. It is a professional-level, vendor-neutral credential that validates your ability to secure enterprise Wi-Fi networks: designing authentication and encryption architectures, recognizing and mitigating wireless attacks, writing and enforcing security policy, and managing the security lifecycle of a WLAN over time.
The acronym is shared by other, unrelated credentials in the wider IT world. This article is exclusively about the wireless security certification from CWNP. If you want the shorter definitional versions of this topic, see What Is CWSP?, What Does CWSP Stand For?, and CWSP Meaning. For the full certification overview page, visit CWSP Certification.
The defining characteristic of this credential is its architectural bent. Rather than asking you to recite a list of cipher names, it presents scenarios: a hospital needs fast roaming for handheld devices without weakening authentication; a campus wants guest access that is isolated and still encrypted; an audit finds a legacy PSK network sitting next to an 802.1X network. You choose the design or the mitigation that fits.
Who Issues It and How It Fits the CWNP Ladder
CWSP is issued by CWNP (Certified Wireless Network Professional), the organization behind a vendor-neutral wireless certification program. CWSP sits at the professional level of that program, alongside other professional-level specializations, and it builds on the foundation-level CWNA credential.
That dependency matters. You must hold a current, valid CWNA to earn CWSP. Instructor-led training is optional; CWNP does not require you to attend a course before sitting the exam. If you are mapping your path, the details are covered in CWSP Requirements 2026: Eligibility, Prerequisites & How to Qualify.
CWSP-208 Exam Format at a Glance
The current version is CWSP-208, built on the 2025 exam objectives. CWSP-207 ended December 31, 2025. CWNP's own pages differ slightly on whether CWSP-208 released in November or December 2025, but both identify it as the current exam and schedule the next version for 2028. Always confirm timing with CWNP directly when you plan your attempt; our CWSP Exam Dates 2026 guide tracks the scheduling picture.
| Item | CWSP-208 Detail |
|---|---|
| Issuer | CWNP |
| Language | English |
| Question count | 60 |
| Question type | Multiple choice, single correct answer |
| Time limit | 90 minutes |
| Passing score | 70% (80% for instructors) |
| Delivery | CWNP remote proctoring only |
| Voucher price | USD $349.99, one attempt |
| Retake wait | 10 days, including weekends |
Ninety minutes for sixty questions gives you roughly a minute and a half each. That is generous for definition-style items but tight for the long scenario questions that dominate the architecture domain, so practice reading dense stems quickly. For a deeper look at the cut score and how to interpret it, see CWSP Passing Score 2026, and for the difficulty picture, How Hard Is the CWSP Exam?
The Four Domains and Where the Points Are
The CWSP-208 objectives divide the exam into four weighted domains. The weighting is the single most useful planning fact you have.
| Domain | Weight |
|---|---|
| Domain 1: Security Policy | 10% |
| Domain 2: Vulnerabilities, Threats, and Attacks | 30% |
| Domain 3: WLAN Security Design and Architecture | 50% |
| Domain 4: Security Lifecycle Management | 10% |
Half the exam sits in a single domain. Candidates who spread their time evenly across all four areas under-prepare for the part that decides the outcome. The full breakdown lives in CWSP Exam Domains 2026: Complete Guide to All 4 Content Areas; here is the short version of what each one asks of you.
Domain 1: Security Policy (10%)
Policy is the smallest slice, but the questions are about connecting requirements to technical controls rather than reciting definitions.
- Translating organizational and regulatory requirements into WLAN security requirements
- Differentiating policy types and what each should govern
- Recognizing how policy drives authentication, encryption, and guest-access decisions
Domain 2: Vulnerabilities, Threats, and Attacks (30%)
This domain tests whether you can recognize an attack from its symptoms and select the right countermeasure.
- Identifying weaknesses in legacy protections versus modern ones
- Understanding attack classes against authentication, key exchange, and management traffic
- Matching detection and mitigation approaches to specific threats
Domain 3: WLAN Security Design and Architecture (50%)
The heart of the exam. Expect multi-layered scenarios where several correct-sounding options exist and only one fits all the constraints.
- Selecting authentication and encryption designs for enterprise, guest, and mixed-device environments
- Designing 802.1X/RADIUS infrastructure and choosing among EAP methods
- Understanding key hierarchies, handshakes, and fast roaming implications
- Applying WPA3 and related mechanisms appropriately
Domain 4: Security Lifecycle Management (10%)
Security is treated as a continuing process, not a one-time configuration.
- Maintaining, monitoring, and auditing a WLAN security posture over time
- Handling change and ongoing validation of controls
Technical Topics You Must Master
Because the exam is architecture-heavy, the technical core clusters around a handful of interlocking subjects. Understanding how they relate to each other is worth more than memorizing each in isolation.
802.1X, RADIUS, and the EAP Family
Enterprise Wi-Fi security revolves around the 802.1X framework: a supplicant, an authenticator, and an authentication server, typically RADIUS. You need to be comfortable with what each role does, what travels between them, and where keying material comes from.
The EAP method choice is a recurring scenario theme. EAP-TLS uses certificates on both sides and depends on a working PKI. EAP-TTLS and PEAP establish a server-authenticated TLS tunnel and carry an inner authentication method inside it. Questions probe the tradeoffs: certificate management burden, client credential type, resistance to specific attacks, and what happens when a client fails to validate the server certificate. PKI fundamentals (certificate chains, trust anchors, validation behavior, revocation) are not a side topic here; they underpin the whole method comparison.
WPA3 and RSN Override
WPA3 changes the authentication and protection picture, and the exam expects you to keep its pieces distinct. One common source of error: OWE (Opportunistic Wireless Encryption) provides encryption for open networks and is a separate mechanism from the WPA3 authentication modes. Do not blur them together in your head. Treat OWE as a way to encrypt an otherwise unauthenticated association, and treat the WPA3 authentication modes as the ways stations prove identity or knowledge of a credential.
RSN Override is another topic to study deliberately rather than skim, because it concerns how robust security network information is signaled and handled and why that matters for mixed or transitional deployments.
Key Hierarchies, Handshakes, and Fast Roaming
You should be able to reason about where keys originate, how they are derived, and what the four-way handshake accomplishes. Fast roaming makes this harder: reducing the delay of re-authentication means reusing or pre-distributing key material, and each approach has security and compatibility implications. Scenario questions often ask which roaming method suits a latency-sensitive deployment without sacrificing the intended trust model.
Secure Guest Access
Guest networks are a classic design problem because the requirements pull in different directions: easy onboarding, isolation from internal resources, and still some level of protection against eavesdropping. Expect questions that ask you to weigh captive portals, encryption options for otherwise open networks, segmentation, and policy enforcement.
Registration, Vouchers, and Remote Proctoring
CWSP-208 is delivered exclusively through CWNP remote proctoring. It is not available at Prometric or Pearson VUE test centers, which surprises candidates used to other vendors' scheduling.
- Voucher: USD $349.99 for a single attempt, valid for two years from purchase or until the exam version ends, whichever comes first. A retake requires another voucher.
- Retake wait: 10 days, weekends included.
- Identification: matching, unexpired government-issued photo ID.
- Equipment: working camera and microphone, and one monitor.
- Environment: no notes, outside assistance, external devices, or unrelated applications.
- Platform: Google Meet in combination with the CWNP Learning Center.
- Breaks: approved breaks are possible, but the timer keeps running.
Because the voucher expires with the exam version, do not buy it long before you are ready if you are close to a version transition. CWSP-208 is scheduled to be succeeded in 2028, which leaves a comfortable window, but the "whichever is earlier" language is worth respecting. A full cost walkthrough, including the cost of a failed attempt, is in CWSP Certification Cost 2026.
Key Takeaway
Run a full technical check of your camera, microphone, single-monitor setup, and ID well before exam day, and clear your desk of anything that could be read as a prohibited resource. Because the timer continues during approved breaks, treat the 90 minutes as continuous.
Validity and Renewal
A standard CWSP credential is valid for three years. To renew by testing, you need a current CWNA and a pass on the then-current CWSP exam; passing it also renews your CWNA for another three years, which is an efficient bundling effect.
There is also an optional professional continuing education (CE) route. Key points:
- You must elect it within one year of certification.
- It requires eight approved, documented CE hours each year plus annual renewal.
- The linked guidelines specify that two of those hours must come from passing the annual certification CE eLearning.
- Once elected, you cannot revert to the three-year testing cycle.
- CE renewal does not itself renew your CWNA.
CWNP's published materials are inconsistent on a few details. The live CE page lists an annual fee of USD $115, while the linked guidelines list $125. The live page says the current exam is required after expiration, while the guidelines describe a 30-day reinstatement window to complete the original CE and fee requirements before an exam becomes necessary. Treat both as items to confirm directly with CWNP before you commit to the CE path.
Who Benefits From the Credential
CWSP targets professionals whose work touches enterprise wireless security: wireless network engineers, network and security architects, security analysts responsible for Wi-Fi environments, consultants who design or assess WLAN deployments, and instructors in the CWNP ecosystem. Organizations with large campuses, healthcare facilities, education networks, retail and logistics operations, and managed service providers are natural employers of this skill set.
Be careful with hard numbers here. Public salary and pass-rate figures specific to this exact wireless security credential are thin, and we do not quote figures we cannot support. For a qualitative treatment of the labor-market picture, read CWSP Jobs, CWSP Salary Guide 2026, and Is the CWSP Certification Worth It? And if you are weighing difficulty, CWSP Pass Rate 2026: What the Data Shows explains what can and cannot be concluded from public data. Note the important distinction between the passing score (70%, the threshold on your attempt) and a pass rate (the share of candidates who succeed), which are not the same thing.
A Domain-Weighted Prep Sequence
Rather than a generic schedule, sequence your preparation around the exam's weighting and the way the topics depend on each other. This example assumes you hold a current CWNA and can study for about six weeks.
Authentication Infrastructure First
- 802.1X roles, RADIUS flow, and EAP-TLS, EAP-TTLS, and PEAP comparisons
- PKI basics, since certificate behavior drives method selection
- Why first: Domain 3 is half the exam and these topics feed everything else
Keys, Roaming, and WPA3
- Key hierarchies and handshakes, then fast roaming tradeoffs
- WPA3 modes, OWE as a separate mechanism, and RSN Override
- Secure guest access design scenarios
Threats and Attacks
- Attack recognition and matching mitigations (Domain 2, 30%)
- Revisit design choices from the attacker's perspective
Policy, Lifecycle, and Timed Practice
- Domains 1 and 4, which are small but quick to secure
- Timed sets of original CWSP-208 style questions at about a minute and a half each
For deeper material, work through the CWSP Study Guide 2026, keep the CWSP Cheat Sheet for last-minute review, and see CWSP Training if you are weighing instructor-led options (which are optional). Be selective about question banks: prefer a CWSP-208 practice test aligned to the 2025 objectives over unreviewed CWSP-207 or earlier question collections, which may reflect superseded content. Original, scenario-style practice questions beat memorized dumps because the real exam rewards reasoning about constraints.
Frequently Asked Questions
CWSP stands for Certified Wireless Security Professional, a professional-level wireless security credential issued by CWNP. For related definitions, see What Is CWSP Certification? and What Does CWSP Mean?.
Yes. A current, valid CWNA is required to earn CWSP. Instructor-led training is not required, though it is available if you want structured instruction.
The exam has 60 multiple-choice questions, each with a single correct answer, and a 90-minute time limit. The passing score is 70%, or 80% for instructors.
No. CWSP-208 is delivered exclusively through CWNP remote proctoring, not Prometric or Pearson VUE. You need matching government-issued photo ID, a working camera and microphone, and one monitor.
Standard validity is three years. You can renew by holding a current CWNA and passing the current CWSP exam, which also renews your CWNA, or by electing the optional CE route within one year of certification. Because CWNP's published fee and reinstatement details conflict in places, confirm current terms with CWNP before choosing.
Ready to test your readiness against the real thing? Try a scenario-based CWSP-208 practice test to see how you handle the architecture-heavy questions that make up the bulk of the exam.