312-50 Question 375
Single answer▪ Wireless ThreatsDuring an authorized wireless security assessment, you discover an employee SSID using WPA2-PSK. Several clients are already connected, but you do not know the passphrase. The client wants you to demonstrate the realistic risk of password weakness without disrupting production users more than necessary. Which action is the most appropriate next step to obtain material for an offline password-cracking attempt?
- A
Capture the WPA2 4-way handshake from a client association, optionally triggering a reauthentication of a connected client to collect it faster
- B
Use WEP IV collection techniques until enough packets are gathered to derive the WPA2 pre-shared key
- C
Read the passphrase directly from beacon frames because WPA2-PSK networks advertise it in RSN information elements
- D
Exploit WPS by default because all WPA2-PSK networks expose the PIN in probe responses
Show answer and explanation
Correct answer: A
Explanation
For WPA2-PSK networks, the standard assessment workflow is to capture authentication material such as the 4-way handshake or PMKID and then test the strength of the passphrase offline. This minimizes ongoing interaction with the production network and aligns with common wireless security testing practice. In contrast, WEP packet collection techniques are unrelated to WPA2, and management frames such as beacons do not disclose the PSK. WPS can sometimes offer an alternate attack path, but it is optional and not universally enabled or vulnerable. Best practice guidance from Wi-Fi security literature and vendor documentation consistently recommends strong, high-entropy passphrases, disabling WPS where not needed, and preferring WPA3 or enterprise authentication where possible.
- A. Correct.
Correct. In a WPA2-PSK assessment, the practical way to test passphrase strength is to capture the 4-way handshake or a PMKID and then perform an offline dictionary or rule-based attack. If clients are already connected, a tester may passively wait for a reconnection or, if permitted by scope, send a deauthentication frame to prompt reauthentication and capture the handshake with minimal disruption. This reflects a common real-world attack path against weak PSKs.
- B. Incorrect.
Incorrect. WEP IV collection attacks apply to the obsolete WEP protocol, which is broken due to weaknesses in RC4 key scheduling and IV reuse. WPA2-PSK does not rely on collecting IVs to recover the key in this manner, so this technique would not produce the needed material for cracking a WPA2 passphrase.
- C. Incorrect.
Incorrect. Beacon frames advertise network capabilities such as supported rates, security parameters, and RSN information, but they do not reveal the WPA2 pre-shared passphrase. A common misconception is that management frames leak secret credentials; they do not. The PSK itself is never transmitted in plaintext in normal WPA2 operation.
- D. Incorrect.
Incorrect. WPS is a separate feature and is not enabled on all WPA2-PSK networks. Even when WPS is present, the PIN is not simply exposed in probe responses. Some networks disable WPS entirely, and successful WPS attacks depend on the AP supporting vulnerable WPS behavior. Assuming WPS is universally available is inaccurate.