312-50 Question 369
Single answer▪ Wireless ConceptsDuring an authorized wireless assessment, you discover a client network using WPA2-PSK on several access points. Management asks whether the pre-shared key can be evaluated without disrupting users or forcing clients to reconnect. Which action is the most appropriate first step for the tester?
- A
Capture the 4-way handshake from a client associating to the access point and perform an offline password attack against the capture
- B
Send continuous deauthentication frames to all connected clients until enough handshakes are captured for cracking
- C
Exploit WPS by default because WPA2-PSK networks can always be bypassed through WPS PIN attacks
- D
Attempt to derive the WPA2-PSK directly from beacon frames because the key material is broadcast in encrypted form
Show answer and explanation
Correct answer: A
Explanation
For WPA2-PSK networks, the practical and non-disruptive first step is to passively capture a legitimate 4-way handshake and then perform offline analysis to test password strength. This is a standard wireless assessment technique and is consistent with IEEE 802.11i/WPA2 operations: the handshake proves possession of the PSK-derived keying material but does not expose the PSK itself. If no clients naturally reconnect, a tester might request a maintenance window or explicit approval for active techniques, but that would not be the least disruptive first step. WPS should only be evaluated if it is actually enabled, and beacon frames do not disclose PSKs. Best practice references include Wi-Fi Alliance WPA2 guidance and IEEE 802.11 security documentation describing the 4-way handshake and PSK-based authentication behavior.
- A. Correct.
Correct. In a WPA2-PSK assessment, a common and minimally disruptive approach is to capture a valid 4-way handshake when a client naturally connects or reconnects, then test candidate passwords offline. This aligns with real-world wireless assessment practice because it avoids active interference while still allowing verification of weak PSKs. The handshake does not reveal the PSK directly, but it provides enough material to validate password guesses offline.
- B. Incorrect.
Incorrect. Deauthentication can force clients to reconnect and generate handshakes, but the scenario explicitly asks for a method that does not disrupt users or force reconnections. While deauth attacks have historically been used during assessments, using them here would violate the stated requirement and is therefore not the best first step.
- C. Incorrect.
Incorrect. WPS attacks are only relevant if Wi-Fi Protected Setup is enabled and vulnerable. Not all WPA2-PSK networks use WPS, and many enterprise environments disable it specifically because of known risks. Assuming WPS is available by default is a common misconception.
- D. Incorrect.
Incorrect. Beacon frames advertise network parameters such as SSID, supported rates, and security capabilities, but they do not contain the pre-shared key or encrypted key material from which the PSK can be derived. WPA2-PSK requires capturing authentication-related traffic, such as the 4-way handshake, for offline password testing.