In an 802.11 network secured with WPA2, the Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) is used for encryption. CCMP encrypts the payload of the data frame, which is referred to as the Frame Body. This Frame Body contains the MAC Service Data Unit (MSDU), which encapsulates the upper-layer data, including the Logical Link Control Protocol Data Unit (LLC PDU). The MAC Header is intentionally left unencrypted (in cleartext) to allow network infrastructure devices, such as access points, to read critical addressing and control information for frame processing and forwarding. The Frame Check Sequence (FCS) is also not encrypted; it is recalculated after the payload has been encrypted.

A. The MAC Header is not encrypted; it must remain in cleartext for network devices to read addressing and control information.

B. Excluding the LLC PDU would mean the actual user data is not protected, which defeats the entire purpose of encryption.

D. The whole MPDU is not encrypted because the MAC Header is transmitted in cleartext, and the FCS is recalculated post-encryption.

1. IEEE Std 802.11™-2020, "IEEE Standard for Information Technology—Telecommunications and Information Exchange between Systems Local and Metropolitan Area Networks—Specific Requirements Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications."

Section 12.5.3.3, "CCMP MPDU format" and Figure 12-16: This section explicitly illustrates the CCMP-encrypted MPDU. The figure shows the MAC Header is not part of the encrypted portion. The encryption is applied to the original plaintext data (the MSDU, which forms the frame body) and the Message Integrity Code (MIC).

2. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Chapter 7, Section 7.3.4, "802.11 Security": This section describes the principles of 802.11i (the standard that WPA2 implements). It clarifies that encryption services are provided for the data payload of the frame, while the MAC header fields such as addresses and sequence numbers are sent in the clear.