312-50 Question 389
Single answer▪ Wireless Attack CountermeasuresA company discovers that employees are repeatedly connecting to a rogue wireless access point set up in the parking lot with an SSID nearly identical to the corporate Wi-Fi name. During the assessment, you confirm the attack is an evil twin designed to capture credentials and force users onto an unauthorized network. The company wants the most effective countermeasure to reduce the likelihood of clients automatically joining the rogue AP and to improve protection of authentication traffic. Which action should the security team implement first?
- A
Replace WPA2-Enterprise with WPA2-Personal using a long pre-shared key so users no longer submit credentials during wireless authentication
- B
Disable automatic connection to preferred networks on client devices and deploy WPA3-Enterprise or WPA2-Enterprise with Protected Management Frames where supported, along with server certificate validation
- C
Hide the corporate SSID so employees cannot distinguish the rogue AP from the legitimate network during scans
- D
Increase the transmit power of the legitimate access points so client devices will always prefer the stronger internal signal
- E
Filter connections by MAC address and publish the approved AP MAC addresses to employees
Show answer and explanation
Correct answer: B
Explanation
The best first step is to reduce automatic association behavior and harden enterprise authentication rather than rely on weak administrative controls. Evil twin attacks exploit client trust in SSIDs, weak user validation of authentication prompts, and the lack of certificate checking in 802.1X deployments. Best practice is to use enterprise wireless authentication with strict server certificate validation, preferably WPA3-Enterprise where available, and to enable Protected Management Frames as supported to mitigate certain spoofing and deauthentication-related attacks. Disabling auto-join for nonessential preferred networks also reduces the chance that devices will attach to a rogue AP advertising a familiar SSID. Guidance from Wi-Fi Alliance security recommendations and enterprise wireless best practices consistently discourages relying on hidden SSIDs, MAC filtering, or signal strength adjustments as primary defenses.
- A. Incorrect.
This is incorrect. Moving from WPA2-Enterprise to WPA2-Personal weakens enterprise access control and key management. A shared PSK does not solve evil twin risk and can create additional exposure if the key is disclosed. Enterprise authentication with proper certificate validation is a stronger control against credential harvesting.
- B. Correct.
This is correct. Evil twin attacks often succeed because clients auto-join remembered SSIDs and users fail to validate the authentication server. Disabling auto-connect reduces opportunistic roaming to rogue APs. Using WPA3-Enterprise, or WPA2-Enterprise with 802.1X/EAP plus Protected Management Frames (802.11w) where supported, improves resistance to spoofing and management-frame abuse. Most importantly, enforcing server certificate validation on clients helps prevent users from submitting credentials to a rogue RADIUS-backed AP.
- C. Incorrect.
This is incorrect. Hiding an SSID does not provide meaningful security and can actually increase probe traffic from clients searching for known networks, which may aid attackers. Hidden SSIDs are easily discovered through wireless sniffing and do not stop evil twin attacks.
- D. Incorrect.
This is incorrect. Stronger signal strength does not guarantee clients will select the legitimate AP, especially if they have cached profiles, permissive roaming behavior, or are closer to the rogue device. This may improve coverage but is not an effective primary countermeasure for evil twin credential capture.
- E. Incorrect.
This is incorrect. MAC filtering is easy to bypass because MAC addresses can be observed over the air and spoofed. Publishing approved AP MAC addresses to employees is not a practical or reliable defense and does not address credential theft through fraudulent authentication prompts.