A county facilities WLAN finishes either PSK or 802.1X authentication for building-inspector tablets. What is the primary purpose of the 4-way handshake that follows?
Select an answer to reveal the explanation.
Short Explanation
Think of the 4-way handshake as the ceremony after you prove who you are—now both sides mint the session keys that actually lock the conversation. PSK or 802.1X got you in the door; the handshake hangs the padlocks on the unicast frames.
Full Explanation
After a county facilities WLAN finishes PSK or 802.1X authentication for building-inspector tablets, the 4-way handshake’s primary purpose is to derive and confirm the pairwise transient keys that will protect unicast traffic for that session. Authentication proved identity or passphrase knowledge and produced master key material; the handshake turns that material into confirmed session keys both peers will use on the air. Without a successful 4-way exchange, inspectors may appear “authenticated” in AAA logs yet still lack usable unicast confidentiality. The handshake does not exist to rename the SSID in beacons so inspectors join a hidden municipal network. It does not negotiate the wired VLAN ID the access switch will assign after RADIUS accounting starts—that is authorization and switch/dynamic VLAN behavior. It also does not upgrade AP firmware channel plans before the first data frame; RF planning is a separate operational track. Exam caveat: group keys are related but distinct—do not treat the 4-way unicast confirmation as automatically explaining every broadcast failure after association. Operational check: on a facilities pilot SSID, capture the 4-way handshake for a known-good tablet and confirm PTK installation in client or controller diagnostics immediately before user-plane traffic begins flowing.