An assessor expands a short municipal base wordlist with rules and masks that append years, seasons, and civic abbreviations. What problem class does that technique address?

Expanding a short municipal base wordlist with rules and masks that append years, seasons, and civic abbreviations addresses variant generation: producing likely passphrase mutations from base words without manually listing every string. Authorized assessments use rules to cover SeasonYear! habits efficiently. Rules do not change the AP's security mode or replace the need for a valid capture.

'Converting WPA2-PSK networks into open authentication without a handshake' fails because rules and masks do not convert WPA2-PSK networks into open authentication without a handshake. 'Forcing AP lockouts so offline dictionaries become unnecessary' fails because they do not force AP lockouts that make offline dictionaries unnecessary. 'Replacing PMK derivation with plaintext beacon passwords advertised by the SSID' fails because they do not replace PMK derivation with plaintext passwords advertised in beacons.

Exam caveat: rules amplify coverage of weak patterns—they do not defeat high-entropy random PSKs by magic. Operational check: enable engagement-approved rule sets against the civic base list, test a known patterned lab PSK, then run production in-scope captures. Document which rules fired if recovery succeeds. In municipal wireless operations, record the rationale in the engagement notes so future assessors know which control or technique class was chosen and which failure modes the rejected options would create for city services.