A SOC asks what happens to confidentiality assumptions if someone already knows the municipal PSK and can capture traffic. What is the sound high-level answer?
Select an answer to reveal the explanation.
Short Explanation
The shared passphrase is the club membership card—if an insider already has it, they can walk in. With the right captures they may also unravel traffic confidentiality you thought was 'encrypted enough.' Shared secrets are shared risk.
Full Explanation
If someone already knows the municipal PSK and can capture traffic, confidentiality assumptions weaken substantially: that knowledge enables network access and, depending on captures and derived session keys, can threaten the confidentiality of traffic protected under that PSK model. SOC answers should not pretend the passphrase is unrelated to CCMP keying in Personal mode. Treat PSK disclosure as both an access and a crypto-operational incident. Saying knowing the PSK never affects confidentiality because CCMP keys are unrelated to the passphrase misunderstands Personal key derivation. Claiming PSK knowledge only affects captive-portal branding and cannot decrypt unicast frames understates impact. Asserting anyone with the PSK is limited to beacon decoding and cannot join is false. Exam caveat: After PSK disclosure, rotate widely and consider Enterprise to reduce blast radius. Operational check: In an authorized lab using a known test PSK, demonstrate association with that secret and discuss key derivation implications in the finding narrative without exposing production secrets. In civic WLAN stewardship, keep authorization boundaries explicit, prefer the least disruptive technique class allowed by RoE, and record BSSID, channel, band, and security mode beside every conclusion so another assessor can reproduce the observation.