An authorized evil-twin lab against a municipal PEAP deployment captures MSCHAPv2 challenge/response material. How should that material be classified?
Select an answer to reveal the explanation.
Short Explanation
MSCHAPv2 challenge/response from an authorized twin lab is offline-crackable credential material when weak passwords sit behind PEAP—not SAE commits, WEP IV dumps, or forest names in beacons.
Full Explanation
MSCHAPv2 challenge and response material captured during an authorized evil-twin lab against a municipal PEAP deployment should be classified as credential material that can be amenable to offline cracking classes when weak methods are used. It is not proof that SAE commit messages were recovered from a WPA3-Personal handshake. It is not a complete WEP IV dump ready for statistical key recovery without further work. It is not evidence that the AP beacon interval alone discloses the Active Directory forest name. Exam caveat: handle such material as sensitive; possession in an authorized lab is not license to reuse it against systems outside scope. Operational check: store captures in encrypted civic evidence lockers, label them as PEAP or MSCHAPv2-class artifacts, and destroy them per retention policy when the engagement closes. For municipal and campus engagements, keep the finding language tied to authorized scope, name the building or SSID class affected, and state the residual risk to residents or staff if the rejected option had been chosen. Re-validate after the next change window that the selected control still matches inventory, monitoring, and RoE abort criteria used by the city wireless program.