A city library asks whether a wireless recon survey alone can prove that its staff Wi-Fi passphrase is weak. What should the assessor explain?
Select an answer to reveal the explanation.
Short Explanation
Surveys tell you who is on the air and how they lock the door—they do not open the lock. To show a weak passphrase, you still need handshake-class material and an offline guess against that material. Recon maps the target; it does not finish the proof.
Full Explanation
A wireless recon survey alone cannot prove that a library staff Wi-Fi passphrase is weak. Recon identifies targets, channels, and crypto modes; proving a weak PSK typically requires usable handshake (or equivalent) material plus authorized offline testing that actually guesses candidates. Civic stakeholders need that staged explanation so survey screenshots are not mistaken for cracked credentials. Saying recon alone hashes the PSK from beacons without further work fails by concept: beacons do not yield the PSK hash for offline proof by themselves in the way claimed. Listing SSID and channel as enough to declare the passphrase cracked fails by concept: inventory is not key recovery. Claiming vendor OUI values automatically confirm dictionary-guessable passphrases fails by concept: OUIs identify vendors, not passphrase entropy. Exam caveat: even after offline success, report passphrase weakness as a controlled finding—do not reuse the PSK beyond authorized validation steps. Operational check: complete recon, obtain RoE approval for handshake capture and offline testing, recover or fail against the staff SSID with documented wordlists, and only then state passphrase strength conclusions in the library report.