A SOC analyst asks what RSN information in 802.11 beacons roughly communicates about a municipal BSS. Which answer is best?
Select an answer to reveal the explanation.
Short Explanation
The RSN IE is the AP's menu board: 'we speak these ciphers and these authentication methods.' It doesn't hand out the kitchen keys — it just lists what security dishes are on offer.
Full Explanation
Robust Security Network (RSN) information elements in beacons advertise which pairwise and group cipher suites and which Authentication and Key Management (AKM) suites a municipal BSS supports—for example CCMP with PSK versus 802.1X, or WPA3-related AKMs. SOC analysts use that advertisement to classify attack surfaces and expected client behavior without needing the passphrase itself. Saying RSN only conveys AP uptime and DHCP pool size confuses security IEs with operations metrics. Claiming RSN carries the exact plaintext WPA2 passphrase from the controller would be a catastrophic design failure and is not what beacons do. Asserting RSN publishes GPS coordinates of every client invents tracking fields unrelated to cipher/AKM ads. Exam caveat: Always read RSN/WPA IEs before choosing handshake capture, PMKID themes, or Enterprise evil-twin discussions. Operational check: Decode a beacon for the target civic BSS and record pairwise cipher and AKM suite values on the worksheet beside the SSID/BSSID. In civic WLAN stewardship, keep authorization boundaries explicit, prefer the least disruptive technique class allowed by RoE, and record BSSID, channel, band, and security mode beside every conclusion so another assessor can reproduce the observation.