712-50 Question 307
Single answerIdentify vulnerability and attacks associated with wireless networks and manage different wireless network security toolsA global enterprise has completed a rapid migration from WPA2-Enterprise to WPA3-Enterprise across its headquarters and branch offices. Two weeks later, the SOC reports repeated wireless incidents near the headquarters lobby: employee devices are intermittently disconnecting and then reconnecting to a nearby access point broadcasting the same SSID as the corporate WLAN. EDR telemetry shows several users were presented with captive-portal-like prompts, although the corporate wireless network does not use a captive portal. The CISO wants the fastest control that will both improve detection of this attack pattern and support ongoing validation that branch offices are not experiencing the same issue. Which action should be prioritized?
- A
Deploy or enable a wireless intrusion detection/prevention capability to detect and contain rogue or evil twin access points impersonating the corporate SSID
- B
Disable SSID broadcasting on all corporate access points so attackers cannot discover the network name and imitate it
- C
Replace WPA3-Enterprise with WPA2-PSK temporarily because pre-shared keys simplify wireless roaming and reduce disconnections
- D
Increase DHCP lease times on the corporate WLAN to prevent clients from being redirected to fraudulent captive portals
- E
Rely on periodic vulnerability scans of wireless controllers and access points because they will identify impersonation attacks against users
Show answer and explanation
Correct answer: A
Explanation
This scenario describes a classic evil twin attack, a wireless threat in which an attacker deploys an unauthorized access point advertising the same SSID as the legitimate corporate network to lure users into connecting. Once connected, victims may be shown fraudulent captive portal pages or other prompts to steal credentials, install malware, or intercept traffic. From a CCISO perspective, the key is selecting a control that is operationally effective, scalable, and aligned with enterprise monitoring and assurance needs.
A wireless intrusion detection/prevention system is the best priority action because it is purpose-built to identify rogue APs, evil twins, unauthorized clients, suspicious associations, and RF anomalies across distributed environments. Unlike a conventional vulnerability scanner, WIDS/WIPS analyzes the wireless environment itself. This supports both immediate incident response at headquarters and ongoing visibility at branch offices.
Best practices from Wi-Fi security guidance and enterprise wireless architecture emphasize strong authentication such as WPA3-Enterprise with 802.1X, certificate-based EAP methods where feasible, continuous wireless monitoring, rogue AP detection, and user awareness against suspicious captive portals or certificate prompts. Hiding SSIDs and similar obscurity-based measures are not considered effective defenses. In practice, organizations should combine WPA3-Enterprise, certificate validation, NAC/802.1X policy enforcement, centralized WIDS/WIPS, and incident response playbooks for rogue wireless threats.
- A. Correct.
Correct. The scenario strongly indicates an evil twin or rogue access point attack: an attacker is broadcasting the same SSID, attracting client devices, and presenting fake captive-portal-style prompts to harvest credentials or redirect users. A wireless IDS/IPS or modern WIPS capability is specifically designed to monitor the RF environment, identify rogue APs, evil twins, unauthorized associations, and containment needs, and can be centrally managed to validate conditions across headquarters and branches. This directly addresses both immediate detection and broader assurance requirements.
- B. Incorrect.
Incorrect. Disabling SSID broadcast does not meaningfully protect a WLAN from impersonation. Hidden SSIDs are still easily discoverable through wireless management traffic such as probe requests and association activity. Attackers can still create an evil twin using the same SSID once observed. This is a common misconception based on 'security through obscurity' rather than effective wireless security controls.
- C. Incorrect.
Incorrect. Downgrading from WPA3-Enterprise to WPA2-PSK would materially weaken security and does not address the core problem of SSID impersonation. PSK networks increase credential-sharing risk, complicate revocation, and are generally less appropriate for enterprise environments than 802.1X-based authentication. Roaming behavior is not the relevant issue here; the problem is client attraction to a fraudulent AP.
- D. Incorrect.
Incorrect. DHCP lease duration has no meaningful relationship to evil twin detection or prevention. A fake captive portal prompt presented after a client associates to a malicious AP is not solved by extending IP leases on the legitimate network. This option confuses IP address management with wireless-layer attack detection.
- E. Incorrect.
Incorrect. Traditional vulnerability scans of controllers and AP management interfaces may identify missing patches, weak configurations, or exposed services, but they generally do not monitor live RF conditions or detect active evil twin attacks targeting users. Wireless impersonation attacks require spectrum and association-aware monitoring, which is the role of WIDS/WIPS rather than standard network vulnerability scanning.