During a recent site survey. an analyst discovered a rogue wireless access point on the network. Which of the following actions should be taken first to protect the network while preserving evidence?

Question

Options

• ARun a packet sniffer to monitor traffic to and from the access point.
• BConnect to the access point and examine its log files.
• CIdentify who is connected to the access point and attempt to find the attacker.
• DDisconnect the access point from the network

• A
  20% (4)
• B
  5% (1)
• C
  5% (1)
• D
  70% (14)

Explanation

A rogue access point is a wireless access point that has been installed on a network without the authorization or knowledge of the network administrator. A rogue access point can pose a serious security risk, as it can allow unauthorized users to access the network, intercept network traffic, or launch attacks against the network or its devices. The first action that should be taken to protect the network while preserving evidence is to disconnect the rogue access point from the network. This will prevent any further damage or compromise of the network by blocking the access point from communicating with other devices or users. Disconnecting the rogue access point will also preserve its state and configuration, which can be useful for forensic analysis and investigation. Disconnecting the rogue access point can be done physically by unplugging it from the network port or wirelessly by disabling its radio frequency.

No community discussion yet for this question.