712-50 Question 306
Select 2Identify vulnerability and attacks associated with wireless networks and manage different wireless network security toolsA global enterprise has deployed WPA2-Enterprise wireless access across its headquarters using 802.1X with a RADIUS server. During a security review, the CISO learns that employees frequently connect to a nearby SSID that closely matches the corporate wireless name when signal strength is stronger near public areas. Several users report certificate warnings during connection, but many click through them to gain access. The security team wants to reduce the risk of credential theft from evil twin and rogue access point attacks without replacing all wireless infrastructure this quarter. Which TWO actions should the CISO prioritize to most effectively address this risk?
- A
Configure client devices to validate the RADIUS server certificate and reject connections when the certificate is untrusted or the expected server name does not match
- B
Enable a wireless intrusion detection/prevention capability to detect and locate rogue access points and evil twin activity around corporate sites
- C
Hide the corporate SSID so attackers cannot clone it and employees will no longer see fraudulent networks
- D
Increase access point transmit power so the legitimate SSID is always the strongest signal in nearby public areas
- E
Migrate users from WPA2-Enterprise to WPA2-Personal with a complex pre-shared key that is rotated quarterly
Show answer and explanation
Correct answers: A, B
Explanation
The scenario describes a classic evil twin/rogue access point problem against an enterprise wireless deployment. The highest-value actions are to harden client-side 802.1X validation and to deploy wireless monitoring capable of detecting rogue infrastructure. In WPA2-Enterprise networks, many credential theft attacks succeed because users accept invalid or unexpected RADIUS server certificates during PEAP/EAP-based authentication. Best practice is to enforce certificate validation, trust the correct CA, and where possible verify the expected authentication server name. In parallel, organizations should use wireless IDS/IPS or managed wireless monitoring to identify rogue APs, unauthorized SSIDs, and impersonation attempts. Guidance from sources such as NIST SP 800-153 on securing WLANs emphasizes strong enterprise authentication configuration, certificate validation, and continuous monitoring over weak measures like hidden SSIDs. Similarly, operational wireless security programs commonly include rogue AP detection, site surveys, and user awareness to address lookalike SSIDs and social engineering around certificate warnings.
- A. Correct.
Correct. In WPA2-Enterprise/802.1X environments, proper server certificate validation on supplicants is one of the most important defenses against evil twin attacks designed to harvest user credentials. If users are allowed to ignore certificate warnings, they can be tricked into authenticating to a malicious access point relaying or impersonating the enterprise authentication flow. Enforcing trust of the correct CA and expected RADIUS server name materially reduces this risk.
- B. Correct.
Correct. Wireless IDS/IPS or equivalent monitoring tools are specifically used to identify rogue access points, evil twin behavior, unauthorized radios, and suspicious wireless activity in and around enterprise facilities. This gives the organization visibility and response capability, which is essential when attackers set up lookalike SSIDs near corporate offices. It is a practical control that can often be added without a full infrastructure replacement.
- C. Incorrect.
Incorrect. Hiding or disabling SSID broadcast is not an effective defense against rogue AP or evil twin attacks. SSIDs are easily discovered through normal wireless traffic, and attackers can still mimic a hidden network name. This option reflects a common misconception that obscuring the SSID meaningfully improves security; modern guidance treats it as negligible protection.
- D. Incorrect.
Incorrect. Raising transmit power may create coverage and interference issues and does not prevent users from connecting to a malicious AP. Attackers can also use stronger signals or position themselves advantageously. Signal strength alone is not a trustworthy security control, especially against evil twin attacks that rely on user trust and authentication misconfiguration rather than only RF proximity.
- E. Incorrect.
Incorrect. Moving from WPA2-Enterprise to WPA2-Personal would generally reduce security in an enterprise setting. A shared pre-shared key lacks per-user accountability, is harder to manage securely at scale, and does not solve evil twin risk in the same way as properly validated 802.1X/EAP server authentication. This distractor targets the misconception that a strong PSK is inherently safer than enterprise authentication.