To capture a WPA/WPA2 handshake during a wireless assessment, which sequence of steps is appropriate?

• A. Use aireplay-ng to send deauthentication frames and capture the handshake with airodump-ng.
• B. Use airodump-ng to deauthenticate clients and capture a handshake with aireplay-ng.
• C. Use aireplay-ng to spoof MAC addresses only and do not capture a handshake.
• D. Use airodump-ng to crack the handshake without capturing it.

Answer: (A)

Capturing a WPA/WPA2 handshake hinges on forcing a client to reauthenticate with the access point, so the 4-way handshake can be observed in the traffic. To do this, run airodump-ng in monitor mode to identify the target AP’s BSSID and a connected client. Then use aireplay-ng to send deauthentication frames toward that client (or the AP) using the target BSSID and the client’s MAC. When the client reconnects, the 4-way handshake is exchanged, and airodump-ng records it in the capture file. This sequence is correct because you must trigger reauthentication to generate the handshake and capture it; merely listening won’t guarantee a handshake, and you can’t crack something you haven’t captured. The other options misstate tool roles or skip the need to capture the handshake in order to crack it.