An analyst uses tshark to extract certificate fields from an Enterprise municipal capture. What analysis purpose does that serve?
Select an answer to reveal the explanation.
Short Explanation
Pulling cert fields from an Enterprise capture is about trust clues—what the client was told to believe—not a PSK shortcut or a RoE waiver.
Full Explanation
Using tshark to extract certificate fields from an Enterprise municipal capture serves packet-analysis goals: EAP-TLS and related methods expose certificate metadata that helps assessors understand trust anchors, subject names, and evil-twin or trust-abuse themes. That analysis informs Enterprise wireless risk without pretending certificates somehow encode a Personal PSK. Saying certificate metadata extraction proves PSK length without any EAP exchange fails by concept: certificates relate to Enterprise TLS trust, not PSK length proofs. Claiming tshark certificate filters permanently enable WPS on the AP fails by concept: passive analysis does not reconfigure WPS. Asserting cert extraction replaces RoE when the SSID is marked Staff fails by concept: Staff labeling never waives authorization. Exam caveat: certificate fields may contain organizational names—handle them as sensitive civic identity data in reports. Operational check: filter the authorized Enterprise capture for TLS/EAP certificate handshakes, extract subject/issuer fields with tshark, map them to the city’s expected PKI, and note discrepancies that could enable spoofing narratives under RoE. In civic practice, write the decision and the verification command into the engagement notes so another assessor can repeat the check on the next shift without rediscovering the same pitfall under time pressure.