350-401 Question 280
Single answerAn enterprise network uses WPA3-Enterprise for wireless authentication. During a packet capture, you observe the 4-way EAPOL handshake process between a supplicant (client) and an authenticator (access point). At which stage of the handshake does the Pairwise Transient Key (PTK) get derived on both the client and the access point?
- A
After the first EAPOL message is sent from the authenticator to the supplicant
- B
After the second EAPOL message is sent from the supplicant to the authenticator
- C
After the third EAPOL message is sent from the authenticator to the supplicant
- D
After the fourth EAPOL message is sent from the supplicant to the authenticator
Show answer and explanation
Correct answer: B
Explanation
The 4-way EAPOL handshake is used to establish secure communication between a client and an access point in WPA/WPA2/WPA3 networks. The PTK is derived after the exchange of nonces (ANonce and SNonce) and the PMK, which occurs during the second EAPOL message. This key derivation ensures that both the client and access point can securely communicate using the same encryption keys.
- A. Incorrect.
Incorrect. The first EAPOL message contains the ANonce (Authenticator Nonce), which is used later to derive the PTK, but the PTK is not derived at this stage.
- B. Correct.
Correct. After the second EAPOL message is sent, the supplicant and authenticator have exchanged the SNonce and ANonce, along with the PMK (Pairwise Master Key). These inputs are used to derive the PTK on both sides.
- C. Incorrect.
Incorrect. The third EAPOL message is used to confirm the PTK and install the encryption keys, but the PTK is already derived at this point.
- D. Incorrect.
Incorrect. The fourth EAPOL message is an acknowledgment of the handshake completion, but the PTK is derived earlier in the process.