A parks department insists CCMP is enabled on their Personal SSID, yet auditors still crack the network after capturing a handshake because the passphrase is “Parks2024!”. What AKM lesson should the security lead draw?
Select an answer to reveal the explanation.
Short Explanation
Fancy deadbolts on a screen door don’t help if everyone knows the spare key under the mat. CCMP can be solid crypto and still lose if the Personal PSK is guessable. Cipher suite ≠ AKM strength.
Full Explanation
When parks department auditors still crack a Personal SSID after capturing a handshake despite CCMP being enabled—because the passphrase is weak—the AKM lesson is that strong pairwise ciphers do not remediate a weak shared PSK. Personal-mode security still depends on passphrase entropy and PSK exposure. CCMP can correctly protect frames once keys exist and still lose the broader battle if offline guessing recovers the shared secret that feeds those keys. CCMP does not automatically stretch any eight-character PSK into an Enterprise PMK bound to Active Directory. Selecting CCMP does not make offline dictionary attacks against Personal handshakes mathematically impossible. Weak PSKs are not relevant only to management-frame protection; they undermine the confidentiality model for unicast data as well once the PSK community is compromised. Exam caveat: WPA3-Personal SAE raises the bar against classic offline PSK attacks, but operational passphrase discipline and avoiding public posting remain mandatory for parks crews. Operational check: test candidate passphrases against organizational complexity policy, prefer SAE on parks Personal SSIDs, and verify that break-room postings or shared password managers are not leaking the live PSK to unauthorized staff.