Examkin

Question

Difficulty: EasyNetwork and Wireless Attack Indicators

A network administrator suspects an attacker is performing an Evil Twin attack combined with a disassociation attack to intercept wireless client traffic. Which TWO technical indicators directly point to this specific wireless attack scenario? (Select TWO.)

  1. A sudden burst of 802.11 management frames containing deauthentication requests directed at connected clientsAnswer
  2. An unauthorized access point broadcasting an identical SSID as the corporate network but utilizing a different BSSID (MAC address)Answer
  3. C
    A high volume of ICMP Echo Request packets scanning sequential IP addresses across the local subnet
  4. D
    Unsolicited ARP response packets mapping the default gateway IP address to an unknown host MAC address on a wired switch

Answer

The correct indicators are a sudden burst of 802.11 deauthentication management frames and an unauthorized access point broadcasting an identical SSID with a different BSSID.
In an Evil Twin and disassociation attack scenario, the attacker first sends 802.11 management frames (deauthentication packets) to disconnect legitimate users from their authorized access point. Once disconnected, the user devices automatically attempt to reconnect to the strongest access point broadcasting their saved network name (SSID), leading them to connect to the attacker's rogue AP which advertises the exact same SSID but uses a different BSSID (MAC address).

Step-by-Step Solution

1
Analyze the mechanics of a wireless disassociation attack
Identify that attackers broadcast 802.11 deauthentication or disassociation management frames to force clients off a legitimate access point.
Disconnecting target devices is the initial step required to trick them into reconnecting to the attacker's rogue equipment.
2
Analyze the characteristics of an Evil Twin access point
Identify that the rogue access point clones the legitimate network's SSID but operates with its own distinct BSSID (MAC address).
Clients automatically attempt to reconnect to preferred wireless network names (SSID), making them vulnerable to rogue APs advertising the same name.
3
Differentiate wireless indicators from wired network and reconnaissance anomalies
Rule out ICMP ping sweeps (network scanning) and unsolicited ARP replies (wired ARP poisoning).
Network layer host discovery and Address Resolution Protocol manipulation operate on layer 2/3 wired infrastructure rather than 802.11 radio management frames.

Key Concept

Wireless Disassociation and Evil Twin Attack Indicators
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic