312-50 Question 372
Single answer▪ Wireless EncryptionDuring an authorized wireless assessment, you capture a WPA2-Personal 4-way handshake from a branch office SSID. The organization uses a complex pre-shared key, and a dictionary attack does not recover it. The client asks which change would most effectively reduce the risk of offline password-cracking attacks against future captures while still using modern Wi-Fi security for employee devices. Which option is the BEST recommendation?
- A
Migrate the SSID to WPA3-Personal using SAE instead of a pre-shared key–based WPA2-Personal configuration
- B
Keep WPA2-Personal but hide the SSID so attackers cannot capture a usable handshake
- C
Downgrade to WEP with frequent key rotation to make captured traffic harder to analyze over time
- D
Continue using WPA2-Personal and disable DHCP so attackers cannot join the network after cracking the key
Show answer and explanation
Correct answer: A
Explanation
The key issue in the scenario is the ability to perform offline password-cracking attacks after capturing a WPA2-Personal 4-way handshake. In WPA2-Personal, security depends heavily on the strength of the passphrase because the handshake can be used to validate guessed passwords offline. The best mitigation, while keeping a password-based modern Wi-Fi model for users, is to adopt WPA3-Personal with SAE. SAE provides better protection against offline dictionary attacks and is a major improvement over WPA2-PSK in this specific threat model. Hiding the SSID and disabling DHCP are administrative or obscurity measures that do not address the cryptographic weakness of password-based offline verification in WPA2-Personal. WEP is deprecated and insecure. This aligns with Wi-Fi Alliance guidance on WPA3 and industry best practices favoring WPA3 over legacy protocols where device support allows.
- A. Correct.
Correct. WPA3-Personal replaces WPA2-Personal's PSK-based authentication with SAE (Simultaneous Authentication of Equals), which is designed to resist offline dictionary attacks from captured authentication exchanges. In a WPA2-Personal environment, an attacker who captures the 4-way handshake can attempt offline guesses against the passphrase. SAE significantly improves this by requiring active interaction for guessing attempts rather than allowing efficient offline cracking from a captured handshake alone.
- B. Incorrect.
Incorrect. Hiding the SSID does not provide meaningful encryption security and does not prevent a determined attacker from discovering the network name through probe requests, association traffic, or other management frames. Once the SSID is known and a handshake is captured, WPA2-Personal remains vulnerable to offline password guessing. This option reflects the common misconception that disabling SSID broadcast materially strengthens wireless encryption.
- C. Incorrect.
Incorrect. WEP is obsolete and cryptographically broken. Its weaknesses are far more severe than WPA2-Personal's susceptibility to offline passphrase attacks, and frequent key rotation does not fix WEP's design flaws. Recommending WEP would reduce security substantially and would not align with modern wireless security best practices.
- D. Incorrect.
Incorrect. Disabling DHCP does not mitigate the core risk described in the scenario. If an attacker cracks the WPA2 pre-shared key, they can still manually configure IP settings and access the network. DHCP is a convenience service, not a control that prevents compromise of wireless encryption.