Examkin

Question

Difficulty: HardNetwork and Wireless Attack Indicators

A security analyst is investigating network monitoring alerts in a enterprise corporate office. Wireless packet captures and syslog entries show that client laptops are receiving spoofed 802.11 Deauthentication frames originating from a legitimate Access Point's BSSID. Immediately following disassociation, affected clients connect to a rogue access point broadcasting the corporate ESSID and prompting users for authentication via an insecure EAP-GTC protocol with an untrusted RADIUS server certificate. Which of the following statements correctly identify the attack mechanism and the most effective combination of technical controls to mitigate this threat? (Select TWO.)

  1. The observed activity indicates an Evil Twin attack leveraging management frame spoofing to perform credential harvesting via authentication downgrade.Answer
  2. Enforcing IEEE 802.11w Protected Management Frames (PMF) on access points and configuring client 802.1X supplicants to strictly validate server certificates will mitigate the attack.Answer
  3. C
    The log signatures demonstrate an RF Jamming attack designed to degrade the physical signal-to-noise ratio across all 2.4 GHz channels.
  4. D
    Deploying inline network-layer access control lists (ACLs) on corporate switch trunks to drop unsolicited broadcast ARP replies will prevent client disconnections.

Answer

The incident represents an Evil Twin attack combined with wireless deauthentication spoofing. The required mitigations are enforcing 802.11w Protected Management Frames (PMF) to encrypt management frames and configuring strict RADIUS server certificate validation on client supplicants.
The scenario describes a classic Evil Twin deployment facilitated by a wireless deauthentication attack. Attackers send spoofed 802.11 disassociation/deauthentication management frames using the real access point's BSSID to disconnect target clients. Once disconnected, client devices automatically reconnect to the strongest signal for their configured ESSID, attaching to the attacker's rogue access point. The rogue AP attempts to harvest credentials via EAP-GTC downgrade and a self-signed RADIUS certificate. To counter this, organizations must deploy IEEE 802.11w Protected Management Frames (PMF) to cryptographically authenticate management frames (preventing spoofed deauth packets) and enforce strict server certificate validation in the client 802.1X supplicant configuration so devices refuse connection to unverified RADIUS servers.

Step-by-Step Solution

1
Analyze the observed attack indicators in the packet capture.
Unauthenticated 802.11 Deauthentication frames coupled with a rogue AP broadcasting the legitimate ESSID and offering EAP-GTC with an untrusted certificate point to an Evil Twin credential harvesting attack.
Deauthentication frames disconnect clients from the legitimate AP, while the rogue AP (Evil Twin) tricks client supplicants into connecting and offering credentials over a downgraded protocol.
2
Evaluate technical controls at Layer 2 (802.11 wireless) and Layer 7 / Authentication.
IEEE 802.11w (PMF) encrypts and authenticates 802.11 management frames (preventing spoofed deauth packets), and enforcing certificate pinning/validation prevents clients from trusting the rogue RADIUS server.
Combining PMF and mandatory RADIUS certificate validation mitigates both the disassociation vector and the rogue AP association vector.

Key Concept

Wireless Attack Indicators (Evil Twin, Deauthentication) and Mitigations (802.11w PMF, RADIUS Certificate Validation)
Estimated Time:2m 0s
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic