A county parks department shares one WPA2-Personal passphrase across maintenance tablets. After a staff laptop is stolen with the passphrase saved, offline cracking of captured handshakes becomes a realistic risk. Which mitigation best reduces that cracking exposure going forward?
Select an answer to reveal the explanation.
Short Explanation
A weak shared Wi-Fi password is like one master key under every parks truck mat—steal one device and the whole lot opens. Lengthen and randomize the PSK, move to SAE/WPA3-Personal when you can, or better yet give each tablet real Enterprise auth so one stolen secret is not the whole kingdom.
Full Explanation
Offline cracking of WPA2-Personal handshakes is practical when a short shared passphrase is already known or guessable, and a stolen parks-department laptop that saved that secret makes capture-and-crack workflows even more realistic. The durable mitigation is to raise passphrase entropy with a long random PSK, prefer WPA3-Personal SAE where clients allow because SAE resists classic offline dictionary attacks against the four-way handshake model, or migrate the maintenance SSID to Enterprise authentication so a single shared passphrase is no longer the trust anchor for every tablet. Shortening the passphrase to eight memorable characters worsens dictionary susceptibility and accelerates offline recovery. Hiding the SSID does not protect captured handshake material; cloaking is not confidentiality and does not stop cracking once frames are recorded. Disabling encryption removes the handshake only by removing confidentiality entirely, which increases exposure of maintenance traffic rather than mitigating credential risk. Exam caveat: long PSK, SAE, and Enterprise are related but not identical controls—SAE improves Personal-mode password authentication, while Enterprise removes shared-PSK operational risk; do not treat SSID cloaking as a crypto control. Operational check: inventory every maintenance tablet and AP profile still holding the old passphrase, deploy a long random secret or SAE/Enterprise profile, force reassociation, and confirm no device authenticates with the compromised string. In municipal parks operations, record the rotation in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for field crews and city assets.