Examkin

Question

Difficulty: Very hardNetwork and Wireless Attack Indicators

A security analyst reviews packet capture logs from a corporate wireless network following reports of sudden connectivity drops. The capture reveals a high volume of unencrypted IEEE 802.11 management frames containing Reason Code 7 (Class 3 frame received from nonassociated STA) broadcast from an unverified MAC address. Immediately following these frames, several client stations transmit EAPOL-Key 4-way handshake messages toward a secondary access point that is broadcasting an identical SSID on the same channel but exhibiting a significantly higher RSSI and a different BSSID. Which of the following best diagnoses the ongoing attack vector and its primary operational objective?

  1. A wireless deauthentication/disassociation attack paired with an Evil Twin access point to force client re-association and intercept sensitive traffic.Answer
  2. B
    An initialization vector (IV) reuse attack against WPA2-Enterprise paired with a radio frequency (RF) jamming attack to degrade signal quality.
  3. C
    An ARP poisoning attack executed over the air to perform rogue DHCP assignment and reroute local VLAN traffic through a compromised gateway.
  4. D
    A MAC spoofing attack intended to bypass 802.1X port-based Network Access Control (NAC) combined with a captive portal credential harvesting campaign.

Answer

A wireless disassociation attack combined with an Evil Twin access point deployment.
The presence of IEEE 802.11 management frames carrying Reason Code 7 indicates an active disassociation attack designed to break established wireless connections. The subsequent EAPOL-Key 4-way handshake messages directed toward an unauthorized BSSID broadcasting an identical SSID with a stronger RSSI confirm the presence of an Evil Twin access point positioned to perform on-path eavesdropping.

Step-by-Step Solution

1
Analyze the 802.11 management frame capture.
Identified broadcast 802.11 management frames with Reason Code 7, which explicitly command client stations to disassociate from their current Access Point.
Attackers send spoofed deauthentication or disassociation management frames because unencrypted 802.11 management frames (without 802.11w Protected Management Frames) can be easily forged.
2
Analyze client station behavior post-disassociation.
Observed client stations initiating EAPOL-Key 4-way handshakes with a secondary BSSID sharing the corporate SSID and displaying higher RSSI.
Wireless clients naturally attempt to reconnect to the access point offering the strongest signal strength (RSSI) for a known SSID.
3
Synthesize indicators to determine the combined attack strategy.
Confirmed a forced disassociation attack coupled with an Evil Twin AP deployed to execute on-path (MitM) eavesdropping or credential harvesting.
The deauthentication frame provides the trigger forcing clients to disconnect, while the Evil Twin AP provides the target trap for reconnection.

Key Concept

Wireless Deauthentication & Evil Twin Attack Indicators
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic