In an authorized city lab, analysts must decrypt a WLAN capture to inspect upper-layer failures after association. Which statement best reflects expert practice?
Select an answer to reveal the explanation.
Short Explanation
In a blessed lab, decryption is just unlocking a suitcase you already own the combination to — PSK plus handshake, or the right enterprise keys, then read the frames. It's for authorized troubleshooting, not snooping the public lobby Wi-Fi for fun.
Full Explanation
In an authorized city lab, decrypting a WLAN capture to inspect upper-layer failures after association requires proper authorization plus the known PSK (with captured handshake) or relevant enterprise session keys/PMK material per analyzer procedures. Only then do encrypted data frames become readable for troubleshooting. Expert practice pairs legal/ethical authorization with correct key material—never casual production snooping without consent.
Claiming PSK captures can never be decrypted even with the known passphrase and complete handshake is false for lab troubleshooting. Saying enterprise 802.1X captures never require keys because all payloads are clear on the air ignores encryption after the 4-way handshake. Claiming decryption is only ethical on production guest networks without consent inverts ethics: unauthorized production decryption is the problem; authorized lab work is the method.
Exam caveat: decryption is a controlled civic-lab technique, not a shortcut around privacy policy. Operational check: obtain written authorization, supply PSK or session keys to the analyzer per tool docs, verify data frames decode, then inspect the upper-layer failure—and purge keys from shared tickets when done.