312-50 Question 376
Single answer▪ Wireless ThreatsDuring an authorized wireless assessment, a company reports that employees are being disconnected from the corporate Wi-Fi and then unknowingly reconnecting to a stronger access point broadcasting the same SSID in the parking lot. The tester confirms that the legitimate WLAN uses WPA2-Enterprise with 802.1X, and the suspicious device is not connected to the corporate wired network. Which attack is most likely being used to force clients off the legitimate AP so they associate with the attacker's rogue AP?
- A
ARP spoofing against wireless clients to poison their gateway entries
- B
Deauthentication/disassociation frame injection to kick clients off the legitimate AP
- C
WPA2 4-way handshake cracking to recover the enterprise pre-shared key
- D
MAC flooding against the wireless controller to exhaust its CAM table
Show answer and explanation
Correct answer: B
Explanation
The most likely attack is deauthentication/disassociation frame injection used as part of an evil twin attack. In 802.11 networks, management frames such as deauth and disassociation were historically unauthenticated, allowing an attacker within radio range to spoof them and force clients off a legitimate AP. Once disconnected, clients may automatically join a stronger rogue AP advertising the same SSID, enabling credential capture or further man-in-the-middle activity. This is especially relevant in assessments involving wireless threats and rogue AP detection. A key mitigation is Protected Management Frames, standardized as IEEE 802.11w and required by WPA3, which helps protect against spoofed deauth/disassociation attacks. WPA2-Enterprise with 802.1X provides strong authentication, but it does not by itself prevent evil twin attempts or management-frame abuse unless additional protections such as PMF are in place. Guidance on these issues is reflected in IEEE 802.11 standards and Wi-Fi Alliance security best practices around PMF and enterprise WLAN deployment.
- A. Incorrect.
Incorrect. ARP spoofing is a Layer 2 attack used after a client is already connected to a network segment. It can enable man-in-the-middle attacks on local traffic, but it does not normally force a Wi-Fi client to disconnect from a legitimate access point and roam to a rogue AP. Candidates may choose this because it is a common wireless attack term, but it does not match the symptom of clients being actively kicked off the WLAN.
- B. Correct.
Correct. In a classic evil twin scenario, an attacker often sends forged 802.11 deauthentication or disassociation management frames to wireless clients or the AP, causing clients to disconnect. If the attacker simultaneously presents a rogue AP with the same SSID and stronger signal, some clients may reconnect to the rogue device. This is a practical and well-documented wireless threat, especially on networks where management frame protection is not enforced.
- C. Incorrect.
Incorrect. WPA2-Enterprise does not use a single shared pre-shared key for all users in the way WPA2-Personal does. While EAP credential attacks and rogue AP credential harvesting are real risks, the question asks specifically what is forcing clients off the legitimate AP. Cracking a 4-way handshake to recover an enterprise PSK is not applicable here because there is no enterprise-wide PSK to recover.
- D. Incorrect.
Incorrect. MAC flooding is a switching attack aimed at overflowing a switch's CAM table so traffic may be flooded out ports. It is not the mechanism used to disconnect wireless clients from an access point. This distractor targets the misconception that any Layer 2 disruption technique applies equally to 802.11 client association behavior.