nerdexam
GIAC

GSLC · Question #396

You have detected what appears to be an unauthorized wireless access point on your network. However this access point has the same MAC address as one of your real access points and is broadcasting wit

The correct answer is C. The evil twin attack. An evil twin attack is a wireless threat where a rogue access point clones a legitimate AP's MAC address and SSID while broadcasting at higher power to intercept client connections.

Security Operations & Incident Response Leadership

Question

You have detected what appears to be an unauthorized wireless access point on your network. However this access point has the same MAC address as one of your real access points and is broadcasting with a stronger signal. What is this called?

Options

  • ABuesnarfing
  • BDOS
  • CThe evil twin attack
  • DWAP cloning

How the community answered

(26 responses)
  • A
    4% (1)
  • C
    88% (23)
  • D
    8% (2)

Why each option

An evil twin attack is a wireless threat where a rogue access point clones a legitimate AP's MAC address and SSID while broadcasting at higher power to intercept client connections.

ABuesnarfing

Bluesnarfing is an attack against Bluetooth-enabled devices in which an attacker gains unauthorized access to data such as contacts or messages over a Bluetooth connection - it has no relation to wireless access points.

BDOS

A Denial of Service (DoS) attack focuses on overwhelming a target to disrupt availability of a service, not on impersonating legitimate infrastructure to intercept traffic.

CThe evil twin attackCorrect

The evil twin attack involves a malicious actor setting up a rogue wireless access point that spoofs both the SSID and MAC address of a legitimate AP, then transmitting at a stronger signal strength so that wireless clients automatically associate with the attacker's AP instead. Once clients connect to the evil twin, the attacker can perform man-in-the-middle attacks, capturing or manipulating all traffic. The cloned MAC address is a defining characteristic that distinguishes this attack and makes it harder to detect through simple MAC filtering.

DWAP cloning

WAP cloning is not a recognized or standardized term in wireless security for this specific attack pattern - the correct and widely accepted term for this threat is the evil twin attack.

Concept tested: Evil twin rogue access point wireless attack identification

Source: https://csrc.nist.gov/publications/detail/sp/800-153/final

Topics

#evil twin attack#rogue access point#wireless security#MAC spoofing

Community Discussion

No community discussion yet for this question.

Full GSLC Practice