Examkin

Question

Difficulty: MediumTroubleshooting Mobile OS Security and Connectivity Issues

A mobile user working remotely at an airport lounge reports that their corporate smartphone automatically connected to an unencrypted Wi-Fi network named "Enterprise-WiFi", which matches the SSID of their company's main office network. Shortly afterward, the user begins receiving security warnings about invalid SSL/TLS certificates when attempting to open internal enterprise applications. Which of the following represents the MOST likely root cause of this security incident?

  1. A rogue access point (Evil Twin) is broadcasting a duplicate corporate SSID to intercept client traffic.Answer
  2. B
    The corporate Mobile Device Management (MDM) enrollment profile expired, forcing authentication back to public cellular towers.
  3. C
    The mobile device automatically negotiated a fallback from WPA3-Enterprise to WPA2-Personal due to weak signal strength.
  4. D
    A malicious sideloaded application modified local permissions to bypass corporate VPN domain name resolution.

Answer

A rogue access point (Evil Twin) is broadcasting a duplicate corporate SSID to intercept client traffic.
The scenario describes an Evil Twin attack where an attacker sets up a rogue wireless access point with an SSID matching a known legitimate network ('Enterprise-WiFi'). Because the mobile device previously saved this network name, it automatically connects to the attacker's unencrypted AP. When the attacker attempts to intercept HTTPS traffic via Man-in-the-Middle (MitM), the invalid SSL/TLS certificate warnings are triggered.

Step-by-Step Solution

1
Analyze the reported symptoms
The device automatically connected to an unencrypted Wi-Fi network sharing an identical SSID with the enterprise network, followed by SSL/TLS certificate errors.
Devices save known SSIDs and auto-connect when in range; attackers exploit this by setting up open rogue APs with matching names.
2
Identify the attack mechanism
The rogue AP presents untrusted self-signed or proxy certificates during HTTPS sessions to inspect encrypted traffic, triggering browser/app security warnings.
Man-in-the-middle (MitM) positioning via an Evil Twin causes certificate validation failures.
3
Select the correct root cause
Recognize that an Evil Twin rogue access point is actively impersonating the legitimate network.
This matches both the automatic SSID association and the subsequent invalid certificate warnings.

Key Concept

Rogue Access Point / Evil Twin Detection and Symptoms
Rate this question

Topics

Troubleshooting Mobile OS Security and Connectivity Issues

More questions from this topic