712-50 Question 304
Single answerWireless Security (5 questions)A global enterprise has deployed WPA2-Enterprise with 802.1X for employee wireless access across several regional offices. During an internal assessment, the security team discovers that users are successfully connecting to a rogue access point placed in a nearby office suite that is broadcasting the same SSID as the corporate network. Investigation shows that many endpoints are configured to automatically join the preferred SSID, and users are not prompted about certificate issues during connection. As the CCISO, you need to recommend the control that most effectively reduces the risk of credential theft from evil twin attacks while preserving centralized authentication and operational scalability. Which action is the BEST recommendation?
- A
Move the corporate WLAN from WPA2-Enterprise to WPA2-Personal with a long pre-shared key rotated quarterly
- B
Enforce mutual authentication by validating the RADIUS server certificate on clients and using an EAP method that supports server certificate verification
- C
Disable SSID broadcasting on all legitimate access points so client devices cannot find rogue access points with the same network name
- D
Reduce the transmit power of legitimate access points so endpoints are less likely to connect to stronger rogue signals
Show answer and explanation
Correct answer: B
Explanation
The best answer is to enforce server certificate validation and use a secure 802.1X/EAP configuration that supports mutual authentication. In enterprise wireless environments, the most effective defense against evil twin attacks is not obscuring the network or changing radio characteristics, but ensuring clients cryptographically verify they are authenticating to the legitimate infrastructure before sending credentials. This is consistent with widely accepted guidance from NIST wireless security recommendations and vendor enterprise WLAN best practices, which emphasize strong EAP methods, proper PKI deployment, and certificate validation on supplicants. From a CCISO perspective, this recommendation balances security, scalability, centralized identity management, auditability, and operational sustainability across multiple offices.
- A. Incorrect.
This is incorrect. WPA2-Personal uses a shared pre-shared key rather than per-user 802.1X authentication, which weakens identity-based access control, complicates accountability, and does not adequately address evil twin credential harvesting. In many enterprise phishing scenarios, moving to PSK can actually reduce security maturity by removing centralized authentication and increasing key-sharing risk.
- B. Correct.
This is correct. Evil twin attacks against enterprise Wi-Fi often rely on clients trusting a rogue access point and then presenting credentials to a fake authentication infrastructure. Requiring proper validation of the authentication server certificate and using an EAP method designed for secure mutual authentication significantly reduces the likelihood that clients will disclose credentials to a rogue network. This preserves the benefits of centralized authentication, supports scale, and aligns with enterprise wireless security best practices.
- C. Incorrect.
This is incorrect. Disabling SSID broadcast does not provide meaningful protection against determined attackers because the SSID can still be learned through normal wireless traffic analysis. It also does not prevent an attacker from advertising the same SSID. This is a common but outdated misconception that hidden SSIDs materially improve wireless security.
- D. Incorrect.
This is incorrect. Adjusting transmit power may have limited value for coverage tuning and interference management, but it does not address the root cause of evil twin attacks: clients failing to verify the authenticity of the network and authentication server. A rogue access point can still attract clients if certificate validation is not enforced.