A draft municipal report states 'WPA2 is broken' after offline recovery of a weak guest passphrase. How should the finding be reframed?
Select an answer to reveal the explanation.
Short Explanation
You beat a sticky-note password, not the AES engine under the hood. Say the passphrase was weak and recoverable. Do not write the headline as if WPA2's cipher suite collapsed.
Full Explanation
A draft municipal report stating WPA2 is broken after offline recovery of a weak guest passphrase should be reframed: state that the guest passphrase was weak and recoverable—not that AES-CCMP itself was cryptanalyzed. Professional civic reporting separates credential quality failures from claims that the cipher suite collapsed. Stakeholders remediate passphrase policy or migrate modes; they should not hear false cryptanalysis.
'Claim the entire 802.11 standard failed because one guest SSID used a short dictionary word' fails because one short dictionary guest SSID does not mean the entire 802.11 standard failed. 'Assert that recovering any PSK proves monitor mode is a cryptographic vulnerability' fails because recovering a PSK does not prove monitor mode is itself a cryptographic vulnerability. 'Replace the finding with a note that WPA2-Personal cannot use dictionaries under any circumstance' fails because WPA2-Personal absolutely can be tested with dictionaries—do not replace the finding with the opposite myth.
Exam caveat: precise wording prevents executives from funding the wrong remediation. Operational check: rewrite the city finding as weak shared PSK enabling offline recovery under authorized testing, attach wordlist methodology, and recommend strong random secrets or Enterprise/SAE migration. Remove any AES-is-broken language from the draft. In municipal wireless operations, record the rationale in the engagement notes so future assessors know which control or technique class was chosen and which failure modes the rejected options would create for city services.