Which frames indicate a WPA2 4-way handshake for decryption?

• A. EAPOL key frames (the four-message handshake)
• B. WPA-PSK frames
• C. TLS handshake frames
• D. HTTP request frames

Answer: (A)

The WPA2 4-way handshake is carried inside EAPOL Key frames. These four EAPOL Key frames exchanged between the access point and the client establish the Pairwise Transient Key (PTK) and confirm the encryption keys needed to decrypt the data frames. When you see the sequence of four EAPOL Key frames following authentication, that indicates the handshake is in progress and the keys will be derived for decryption.

Other frame types don’t indicate this key negotiation: TLS handshake frames belong to TLS sessions, not Wi‑Fi encryption; HTTP requests are application-layer traffic that occurs after decryption; WPA-PSK refers to the authentication method and its frames aren’t the formal four-message handshake that derives the encryption keys.