hardMultiple ChoiceObjective-mapped
220-1202 Practice Question: A network administrator is investigating a…
A network administrator is investigating a security incident where an attacker captured the 4-way handshake of a WPA2-PSK network and successfully cracked the passphrase. Which protocol change would most effectively prevent this type of attack in the future?
⚠ Common exam trap
The 220-1202 exam often tests the misconception that simply strengthening WPA2-PSK (e.g., longer passphrase) or adding MAC filtering is sufficient, when the core vulnerability is the offline-crackable 4-way handshake itself, which only WPA3-SAE fundamentally addresses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Upgrade to WPA3-SAE.
WPA3-SAE (Simultaneous Authentication of Equals) replaces the WPA2-PSK 4-way handshake with a protocol that uses a Diffie-Hellman key exchange, making it resistant to offline dictionary attacks. Even if an attacker captures the SAE handshake, they cannot crack the passphrase offline because the key exchange provides forward secrecy and prevents brute-force attempts without interacting with the network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Switch to WPA2-Enterprise with 802.1X and a RADIUS server.
Why it's wrong here
Switching to WPA2-Enterprise with 802.1X and a RADIUS server, while generally more secure for authentication management, does not eliminate the fundamental vulnerability to offline dictionary attacks. The 4-way handshake, which establishes the session keys, can still be captured by an attacker. Although the attacker would need to crack individual user credentials instead of a pre-shared key, this process can still be performed offline against the captured handshake if weak user passwords exist, making it susceptible to the same type of attack.
- ✗
Increase the WPA2-PSK passphrase length to 63 characters.
Why it's wrong here
Increasing the WPA2-PSK passphrase length to its maximum of 63 characters certainly enhances the difficulty of a brute-force or dictionary attack. However, it does not prevent the initial capture of the 4-way handshake. An attacker can still capture this handshake and perform an offline dictionary attack against it, merely requiring more computational power and time to crack a longer, more complex passphrase. The underlying vulnerability of the captured handshake to offline processing remains.
- ✓
Upgrade to WPA3-SAE.
Why this is correct
Upgrading to WPA3-SAE (Simultaneous Authentication of Equals) directly addresses and eliminates the possibility of offline dictionary attacks against the Wi-Fi passphrase. WPA3-SAE utilizes a robust key exchange protocol, often referred to as 'Dragonfly,' which ensures that each authentication attempt is unique and interactive. This design prevents an attacker from capturing a handshake and performing precomputed, offline brute-force or dictionary attacks, even if the password is weak, by making each guess an interactive process that cannot be precomputed.
- ✗
Enable MAC address filtering on the access point.
Why it's wrong here
Enabling MAC address filtering on the access point is a weak security measure that does not enhance the encryption or authentication strength of the Wi-Fi network. MAC addresses are easily spoofed by an attacker who can simply observe legitimate network traffic and configure their device to mimic an allowed MAC address. This method only controls which devices are permitted to associate, offering no protection against handshake capture or cryptographic attacks on the Wi-Fi encryption itself.
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.