You have a wireless capture that includes a WPA2 4-way handshake. You also have the passphrase. What is the first step to decrypt the data frames in Wireshark?

Decrypt the handshake frames first to obtain the GTK.

Configure Wireshark with the passphrase and SSID in the IEEE 802.11 decryption settings.

Extract the PTK from the handshake and load it into Wireshark.

Use aircrack-ng to recover the PMK from the handshake.

GIAC Network Forensic Analyst

Domain 4Objective 2

Wireless Network Analysis GNFA Practice Questions (Page 3)

Part of the Advanced Analysis Techniques domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

9concepts

Questions 11–15

11application · medium
You have a wireless capture that includes a WPA2 4-way handshake. You also have the passphrase. What is the first step to decrypt the data frames in Wireshark?
Select an answer first
12foundation · easy
Which artifact in a wireless capture provides the exact time a frame was captured, useful for reconstructing an activity timeline?
Select an answer first
13foundation · easy
Which wireless adapter mode is required to capture all 802.11 management and control frames on a channel?
Select an answer first
14foundation · easy
Which metric in a wireless capture is used to approximate the distance of a client from an access point?
Select an answer first
15foundation · easy
Which type of 802.11 frame is sent by a client to discover nearby access points before associating?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.

Wireless Network Analysis GNFA Practice Questions (Page 3)

Questions 11–15

You have a wireless capture that includes a WPA2 4-way handshake. You also have the passphrase. What is the first step to decrypt the data frames in Wireshark?

Which artifact in a wireless capture provides the exact time a frame was captured, useful for reconstructing an activity timeline?

Which wireless adapter mode is required to capture all 802.11 management and control frames on a channel?

Which metric in a wireless capture is used to approximate the distance of a client from an access point?

Which type of 802.11 frame is sent by a client to discover nearby access points before associating?

Keep studying — Advanced Analysis Techniques