The answer is an evil twin attack. This is correct because the attacker has deployed a rogue access point broadcasting the same SSID 'CorpNet' as the legitimate network, but on a different channel (11) with an open security setting and a strong signal, which is designed to trick users into connecting to the fraudulent AP and exposing their credentials or traffic. On the CompTIA Network+ N10-009 exam, this scenario tests your ability to distinguish between an evil twin and a standard rogue AP—the key differentiator here is the open security and different channel, which actively lures victims away from the encrypted corporate AP. A common trap is confusing this with a rogue AP, but remember: a rogue AP may simply be unauthorized without actively spoofing the SSID or using an open configuration to hijack connections. Memory tip: think “Twin” for two of the same name, but one is “evil” because it’s open and on a different channel.
N10-009 Network Security Practice Question
This N10-009 practice question tests your understanding of network security. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst is investigating a user's complaint that their wireless connection keeps disconnecting. The analyst uses a wireless scanning tool and discovers two access points broadcasting the same SSID 'CorpNet' with different BSSIDs. One is the legitimate company AP on channel 1, and the other is on channel 11 with a strong signal and security set to 'Open'. Which of the following attacks is most likely occurring?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Why wrong: War driving is the act of mapping wireless access points, not actively attacking users by impersonating an AP.
B
Rogue access point
Why wrong: While a rogue AP is an unauthorized AP, the scenario specifically describes an AP that is spoofing the legitimate SSID with open security, which is an evil twin attack. 'Evil twin' is more precise.
C
Evil twin
The presence of two APs with the same SSID, one with strong signal and open security, strongly indicates an evil twin attack designed to capture credentials and traffic.
D
Bluesnarfing
Why wrong: Bluesnarfing is an attack on Bluetooth devices, not on Wi-Fi networks.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Evil twin
The presence of two access points broadcasting the same SSID 'CorpNet' with different BSSIDs, where the second AP is on channel 11 with a strong signal and security set to 'Open', is characteristic of an evil twin attack. The attacker sets up a fraudulent AP with the same SSID as the legitimate network but without encryption, tricking users into connecting to it and exposing their credentials or traffic. This differs from a rogue AP, which typically mimics the corporate network but may not necessarily use an open security setting or a different channel to lure victims.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
War driving
Why it's wrong here
War driving is the act of mapping wireless access points, not actively attacking users by impersonating an AP.
✗
Rogue access point
Why it's wrong here
While a rogue AP is an unauthorized AP, the scenario specifically describes an AP that is spoofing the legitimate SSID with open security, which is an evil twin attack. 'Evil twin' is more precise.
✓
Evil twin
Why this is correct
The presence of two APs with the same SSID, one with strong signal and open security, strongly indicates an evil twin attack designed to capture credentials and traffic.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Bluesnarfing
Why it's wrong here
Bluesnarfing is an attack on Bluetooth devices, not on Wi-Fi networks.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the distinction between a rogue AP (an unauthorized device plugged into the wired network) and an evil twin (a standalone malicious AP that mimics the SSID without being connected to the corporate infrastructure), so candidates must remember that the key differentiator is the open security and different channel used to lure clients away from the legitimate AP.
Trap categories for this question
Scenario analysis trap
While a rogue AP is an unauthorized AP, the scenario specifically describes an AP that is spoofing the legitimate SSID with open security, which is an evil twin attack. 'Evil twin' is more precise.
Detailed technical explanation
How to think about this question
In an evil twin attack, the attacker typically uses a tool like airbase-ng to create a cloned AP with the same SSID but a different BSSID, often on a non-overlapping channel (e.g., channel 11 vs. channel 1) to maximize interference and force clients to roam. Clients may automatically connect to the stronger signal if they are configured to prefer signal strength over security, especially if the legitimate AP's signal is weaker. The attack exploits the lack of mutual authentication in WPA2-PSK or open networks, allowing the attacker to capture handshakes or plaintext traffic.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A network engineer segments a warehouse floor into three subnets: 20 scanners, 5 printers, and 2 management hosts. Picking the wrong mask wastes addresses or leaves too few usable hosts. Exam questions test whether you can apply CIDR notation, calculate block size, and identify the correct usable-host range for a given prefix.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this N10-009 question in full detail.
Network Security — This question tests Network Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Evil twin — The presence of two access points broadcasting the same SSID 'CorpNet' with different BSSIDs, where the second AP is on channel 11 with a strong signal and security set to 'Open', is characteristic of an evil twin attack. The attacker sets up a fraudulent AP with the same SSID as the legitimate network but without encryption, tricking users into connecting to it and exposing their credentials or traffic. This differs from a rogue AP, which typically mimics the corporate network but may not necessarily use an open security setting or a different channel to lure victims.
What should I do if I get this N10-009 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.