A municipal CISO asks what SAE changes versus classic WPA2-PSK handshake assumptions. Which statement is most accurate?
Select an answer to reveal the explanation.
Short Explanation
With classic PSK, grabbing a handshake is like photocopying the lock so you can try keys at home. SAE changes that game — WPA3-Personal is built to shrug off those offline password-guessing picnics.
Full Explanation
Simultaneous Authentication of Equals (SAE) in WPA3-Personal changes the password-authenticated key exchange so that classic offline dictionary attacks against a captured WPA2-PSK four-way handshake are not the same practical threat. Municipal CISOs should understand SAE as a direct response to PSK handshake cracking workflows that dominate WPA2-Personal assessments. Passphrase quality still matters, but the attack economics differ. Saying SAE removes all encryption and relies only on MAC allow lists contradicts WPA3-Personal goals. Calling SAE identical to WEP shared-key authentication with longer IVs is historically and technically wrong. Claiming SAE only applies to Enterprise RADIUS and cannot protect personal SSIDs denies WPA3-Personal’s purpose. Exam caveat: Transition Mode may still permit WPA2-PSK attack paths—verify whether pure SAE is enforced. Operational check: Confirm the staff or IoT SSID advertises SAE-only AKM, attempt to note absence of classic WPA2 pairwise handshake cracking targets under RoE, and document remaining transition exceptions. In civic WLAN stewardship, keep authorization boundaries explicit, prefer the least disruptive technique class allowed by RoE, and record BSSID, channel, band, and security mode beside every conclusion so another assessor can reproduce the observation.