A municipal red team asks whether capturing ever more IVs helps WPA2-PSK the way old WEP myths suggested. What correction applies?
Select an answer to reveal the explanation.
Short Explanation
WEP’s “collect enough IVs” story does not transfer to WPA2-PSK. For Personal WPA2, assessors care about handshake or PMKID-class material, not a growing IV pile. Do not run a WEP myth against a PSK network.
Full Explanation
Municipal red teams sometimes inherit WEP-era myths that collecting ever more IVs eventually yields keys. For WPA2-PSK, the correction is essential: offline attacks center on handshake or PMKID-class material, not WEP-style IV accumulation. Civic assessors who chase IV counts on Personal AES networks waste capture windows and mis-teach juniors. Focus authorized collection on complete EAPOL handshakes or documented PMKID-class approaches against in-scope BSSIDs under rules of engagement.
'Yes—WPA2-PSK still falls once a fixed number of IVs are collected, just like WEP.' fails because recycles the fixed-IV-quota WEP narrative and does not describe modern Personal offline recovery. 'IV accumulation replaces handshake capture for every modern Personal network.' fails because IV hoarding does not replace handshake or PMKID-class capture for WPA2-PSK. 'More IVs automatically convert Personal mode into open authentication.' fails because IV volume cannot convert Personal mode into open authentication.
Exam caveat: a forgotten WEP device is a separate finding class—do not paste WEP IV playbooks onto WPA2-PSK methodology. Operational check: confirm the municipal target's AKM shows PSK, capture handshake or PMKID-class material as appropriate, and remove IV-count success metrics from city WPA2 Personal lab sheets. Brief assessors that more IVs are not progress for PSK offline recovery. In municipal wireless operations, record the rationale in the engagement notes so future assessors know which control or technique class was chosen and which failure modes the rejected options would create for city services.