CEH Pre-Shared Key (PSK) Practice Question
During a penetration test, an ethical hacker captures a WPA2 handshake and successfully cracks the PSK. Which additional action must be taken to decrypt previously captured traffic?
⚠ Common exam trap
Do not confuse the PMKID attack with decryption. The PMKID is useful for checking a candidate PSK without a full handshake, but after a handshake is captured and the PSK is cracked, the nonces from the handshake—not the PMKID—are needed to derive the PTK and decrypt traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Capture the nonce values from the access point.
Once the PSK is cracked, the PMK is derived from the PSK and SSID. To decrypt captured WPA2 traffic, the Pairwise Transient Key (PTK) must be derived from the PMK, the AP and client MAC addresses, and the nonces (ANonce and SNonce) from the 4-way handshake. Therefore, the additional required step is to obtain/use the nonce values from the captured handshake; computing the PMKID is not necessary for decrypting captured traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Compute the Pairwise Master Key Identifier (PMKID) from the PSK and AP MAC.
Why it's wrong here
Incorrect. The PMKID is not required to decrypt captured traffic. It is used in a PMKID attack to verify a candidate PSK, but decryption requires deriving the PTK from the handshake nonces.
- ✓
Capture the nonce values from the access point.
Why this is correct
Correct. The PTK used to decrypt unicast WPA2 traffic is derived from the PMK, the AP/client MAC addresses, and the ANonce and SNonce. These nonce values are obtained from the captured handshake.
- ✗
Use the PSK directly to compute the Michael Integrity Check (MIC).
Why it's wrong here
Incorrect. The PSK is not used directly to compute the MIC. The MIC is computed using the Michael key derived from the PTK.
- ✗
Obtain the Group Temporal Key (GTK) from the access point.
Why it's wrong here
Incorrect. The GTK is used for broadcast/multicast traffic and can be decrypted from the handshake after deriving the PTK; it does not need to be obtained separately from the access point.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.