WPA3 SAE Dragonfly Key Exchange Explained
Short answer
C Debry Inc. implemented WPA3, whose SAE (Dragonfly key exchange) password-authenticated handshake replaces the PSK model and resists offline dictionary and key-recovery attacks.
Question
Key Takeaways
The question tests recognition of the SAE/Dragonfly handshake as the defining feature of WPA3; the trap is picking WPA2, since most learners associate Wi-Fi hardening with the AES-CCMP upgrade WPA2 already provides.
Debry Inc. is deploying WPA3, the Wi-Fi standard that replaces the pre-shared key (PSK) handshake with the Simultaneous Authentication of Equals (SAE) or Dragonfly key exchange. The page establishes that SAE's forward secrecy andCommitment-based handshake are what make WPA3 resistant to offline dictionary and key-recovery attacks that defeat WPA/WPA2.
Common mistake: No learner votes for it, but the most plausible distractor is D (WPA2), because WPA2 already introduced AES encryption and is the most widely deployed standard — yet WPA2-PSK still relies on the four-way 4-Way Handshake over a PBKDF2-derived PSK, which remains vulnerable to offline dictionary and KRACK-style attacks.
Expert Analysis
Why the Answer Is Correct
WPA3 is the only standard listed that uses Simultaneous Authentication of Equals (SAE), the Dragonfly key exchange, in place of the legacy PSK-derived session keys. SAE is a password-authenticated key exchange (PAKE) that negotiates a fresh session key through an exchange of commit and confirm messages using elliptic-curve cryptography, so an eavesdropper capturing the full handshake gains no usable password material for an offline dictionary attack. This directly addresses the threat model named in the question — dictionary attacks and key recovery attacks — and WPA3 additionally mandates 192-bit and 256-bit GCMP-256 cryptographic suites, as the CEH Module 16 text notes. The question explicitly states the technology "replaces the PSK concept," which only WPA3 does.
Why the Other Options Are Wrong
WEP (B) is a broken RC4-based scheme with 24-bit IVs and CRC-32 integrity, fully defeated by tools like aircrack-ng within minutes — it has no SAE and no modern key establishment at all. WPA (A) was only an interim TKIP patch over RC4, retained for backward compatibility with WEP-era hardware, and still authenticates with a static PSK via the same handshake vulnerable to dictionary capture. WPA2 (D) is the most tempting wrong choice because it introduced AES-CCMP, but its Pre-Shared Key mode derives keys from the passphrase with PBKDF2 and authenticates through the 4-Way Handshake, so a captured EAPOL exchange can still be brute-forced offline; it has no SAE/Dragonfly. Only WPA3 replaces that model.
Community Comment Notes
The community is unanimous on C, and the reasoning cited is sound: insaniunt points out that "also known as dragonfly key exchange = wpa3", and ethacker2 quotes CEH v12 Module 16 p.2392, describing WPA3 as "resistant to offline dictionary attacks and key recovery attacks" through SAE. LordXander echoes the same identification. qtygbapjpesdayazko's request for professional verification is worth honoring: the vendor-cited module text and the Wi-Fi Alliance WPA3 specification both confirm SAE is the WPA3-Personal authentication mechanism, so the consensus is correct here.
Official Reference
https://www.wi-fi.org/discover-wi-fi/security
This link opens the official vendor documentation in a new tab.
Exam Strategy
On CEH wireless questions, treat keyword-to-standard matching as decisive: SAE, Dragonfly, GCMP-256, and Forward Secrecy all point to WPA3, while TKIP points to WPA and CCMP-AES points to WPA2. Read which mechanism the scenario says is being replaced — if the PSK handshake itself is replaced, the answer is WPA3, not an incremental hardening of WPA2.
Frequently Asked Questions
Why doesn't WPA2 with AES stop the dictionary attacks mentioned in this question?
What makes SAE/Dragonfly resistant to key recovery when WPA2's handshake is not?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
insaniunt 👍 2 Answered Calso known as dragonfly key exchange = wpa3
-
ethacker2 👍 1 Answered CC. WPA3 CEHv12 Book Module 16 p.2392 WPA3 is an advanced implementation of WPA2 providing trailblazing protocols and uses the AES-GCMP 256 encryption algorithm.It is mainly used to deliver password-based authentication using the SAE protocol, also known as Dragonfly Key Exchange. It is resistant to offline dictionary attacks and key recovery attacks.
-
qtygbapjpesdayazko 👍 1CEH professionals can you verify this procedure
-
LordXander 👍 1 Answered CDarong fly = WPA 3
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.