Wireshark Block 5 Practice Exam

Which frames indicate a WPA2 4-way handshake for decryption?

EAPOL key frames (the four-message handshake) WPA-PSK frames TLS handshake frames HTTP request frames

Correct Answer:

EAPOL key frames (the four-message handshake)

Explanation:

The WPA2 4-way handshake is carried inside EAPOL Key frames. These four EAPOL Key frames exchanged between the access point and the client establish the Pairwise Transient Key (PTK) and confirm the encryption keys needed to decrypt the data frames. When you see the sequence of four EAPOL Key frames following authentication, that indicates the handshake is in progress and the keys will be derived for decryption. Other frame types don’t indicate this key negotiation: TLS handshake frames belong to TLS sessions, not Wi→Fi encryption; HTTP requests are application-layer traffic that occurs after decryption; WPA-PSK refers to the authentication method and its frames aren’t the formal four-message handshake that derives the encryption keys.

Access more questions from this quiz

Continue to Wireshark Block 5 Practice Exam for more practice questions and the full quiz experience.

Access More Questions