312-50 Question 377
Single answer▪ Wireless ThreatsDuring an authorized wireless assessment of a corporate office, you discover a rogue access point in a conference room broadcasting the same SSID as the company’s legitimate WPA2-Enterprise network. Several employees report intermittent disconnects followed by repeated credential prompts. When you capture traffic, you observe 802.11 deauthentication frames being sent to nearby clients, after which some devices automatically reconnect to the stronger rogue signal. Which attack is MOST likely being performed?
- A
Evil twin attack combined with deauthentication to force client reassociation
- B
WPS PIN brute-force attack against the legitimate access point
- C
ARP spoofing attack on the wired network segment
- D
Bluejacking attack against employee mobile phones
Show answer and explanation
Correct answer: A
Explanation
The strongest answer is an evil twin attack supported by deauthentication activity. In real-world wireless attacks, an adversary may clone the organization’s SSID and position a rogue AP with a stronger signal so clients preferentially connect to it. Because 802.11 management frames such as deauthentication were historically unauthenticated in many deployments, attackers could spoof them to disconnect users from the legitimate AP and increase the chance of reassociation to the rogue AP. This technique is a classic wireless threat covered in CEH and aligns with practical defensive guidance: use WPA2/WPA3-Enterprise with server certificate validation, deploy wireless intrusion detection/prevention systems (WIDS/WIPS), monitor for rogue APs and duplicate SSIDs, and enable Protected Management Frames where supported (802.11w/PMF) to reduce deauthentication abuse. Relevant best-practice references include IEEE 802.11 management frame protection guidance and enterprise wireless security recommendations from vendors and NIST wireless security publications.
- A. Correct.
Correct. This scenario matches an evil twin attack: the attacker sets up a rogue AP using the same SSID as the legitimate network to impersonate it. The observed 802.11 deauthentication frames are commonly used to disconnect clients from the real AP so they reassociate with the attacker-controlled AP, especially if the rogue signal is stronger. The repeated credential prompts are also consistent with a credential-harvesting objective against enterprise wireless users.
- B. Incorrect.
Incorrect. A WPS PIN brute-force attack targets Wi-Fi Protected Setup on access points that have WPS enabled, typically on WPA/WPA2-Personal networks, not a WPA2-Enterprise environment using 802.1X authentication. It also does not primarily explain cloned SSIDs, rogue AP behavior, or deauthentication-driven client migration to a fake AP.
- C. Incorrect.
Incorrect. ARP spoofing occurs at Layer 2 on an already connected network segment and is used to intercept or manipulate traffic between hosts. It does not explain the presence of a rogue wireless AP broadcasting the same SSID or the use of 802.11 deauthentication frames to push clients off the legitimate AP.
- D. Incorrect.
Incorrect. Bluejacking is a Bluetooth-based attack involving unsolicited messages sent to Bluetooth-enabled devices. It is unrelated to Wi-Fi SSIDs, 802.11 management frames, or forced reassociation of wireless clients.