Wireshark Block 5 Practice Exam

Unlock all questions

This demo includes only 20 questions. Upgrade to access hundreds of questions, flashcards, exam simulations, and disable ads.

Full question bankExam simulationsFlashcards

From $12.50Unlock all

Session length

1 / 20

Which frames indicate a WPA2 4-way handshake for decryption?

EAPOL key frames (the four-message handshake)

The WPA2 4-way handshake is carried inside EAPOL Key frames. These four EAPOL Key frames exchanged between the access point and the client establish the Pairwise Transient Key (PTK) and confirm the encryption keys needed to decrypt the data frames. When you see the sequence of four EAPOL Key frames following authentication, that indicates the handshake is in progress and the keys will be derived for decryption.

Other frame types don’t indicate this key negotiation: TLS handshake frames belong to TLS sessions, not Wi‑Fi encryption; HTTP requests are application-layer traffic that occurs after decryption; WPA-PSK refers to the authentication method and its frames aren’t the formal four-message handshake that derives the encryption keys.

WPA-PSK frames

TLS handshake frames

HTTP request frames