nerdexam
CompTIA

PT0-001 · Question #222

A MITM attack is being planned. The first step is to get information flowing through a controlled device. Which of the following should be used to accomplish this?

The correct answer is C. Evil twin. An evil twin attack creates a rogue wireless access point that mimics a legitimate one, forcing victim traffic through the attacker's controlled device - the essential first step in a wireless MITM attack.

Attacks and exploits

Question

A MITM attack is being planned. The first step is to get information flowing through a controlled device. Which of the following should be used to accomplish this?

Options

  • ARepeating
  • BWar driving
  • CEvil twin
  • DBluejacking
  • EReplay attack

How the community answered

(27 responses)
  • C
    89% (24)
  • D
    7% (2)
  • E
    4% (1)

Why each option

An evil twin attack creates a rogue wireless access point that mimics a legitimate one, forcing victim traffic through the attacker's controlled device - the essential first step in a wireless MITM attack.

ARepeating

Repeating refers to signal amplification or retransmitting network traffic, not a technique that routes victim traffic through an attacker's controlled device.

BWar driving

War driving is the practice of scanning for wireless networks while in motion, used for passive reconnaissance rather than actively intercepting or redirecting live traffic.

CEvil twinCorrect

An evil twin attack involves deploying a rogue access point that impersonates a legitimate one, causing clients to associate with the attacker's device and route all their traffic through it. This gives the attacker full visibility and control over the data flow, which is the foundational requirement for executing a man-in-the-middle attack. Tools like hostapd or airbase-ng are commonly used to create such rogue access points.

DBluejacking

Bluejacking is a Bluetooth-based attack that sends unsolicited messages to nearby Bluetooth devices and does not establish a controlled conduit for network traffic interception.

EReplay attack

A replay attack captures previously transmitted authentication data and retransmits it to impersonate a user, but does not create an active channel through which live victim traffic flows.

Concept tested: Evil twin rogue access point for MITM

Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-153.pdf

Topics

#evil twin#MITM#rogue AP#wireless attacks

Community Discussion

No community discussion yet for this question.

Full PT0-001 Practice