A library WLAN team compares Protected Management Frames (PMF / 802.11w) set to optional versus required. What is PMF's main purpose?
Select an answer to reveal the explanation.
Short Explanation
Deauth spoofing is the fake 'fire drill' announcement that kicks everyone outside. PMF is the signed PA system — when it's required, random strangers can't as easily shout forged management commands over the air.
Full Explanation
Protected Management Frames (802.11w / PMF) cryptographically protect certain management frames so attackers cannot trivially forge them. When set to required, PMF strengthens resistance to classes of deauthentication and disassociation spoofing compared with optional or disabled settings on library WLANs. PMF complements data confidentiality mechanisms; it does not revive WEP or replace captive-portal cosmetics, and optional mode may still leave legacy clients on weaker paths. Saying PMF replaces WPA2 data encryption with cleartext management-only mode reverses its purpose. Calling PMF a captive-portal branding option for splash colors confuses Layer-2 management protection with portal UX. Claiming PMF forces every SSID to use WEP shared-key authentication is false. Exam caveat: Deauth-based handshake forcing may fail or be constrained when PMF is required—plan alternate observation strategies under RoE. Operational check: Compare optional versus required PMF on a lab library SSID, attempt only RoE-approved management-frame tests, and document whether forged deauth classes still succeed. In civic WLAN stewardship, keep authorization boundaries explicit, prefer the least disruptive technique class allowed by RoE, and record BSSID, channel, band, and security mode beside every conclusion so another assessor can reproduce the observation.