CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The channel number is different from the legitimate AP

  Why it's wrong here

  Observing a different channel number from a known legitimate AP is not a definitive indicator of a rogue device. Legitimate access points frequently employ dynamic channel selection (DCS) or automatic channel selection (ACS) algorithms to optimize performance, minimize interference, and adapt to changing RF environments. Therefore, a channel change could simply reflect a normal operational adjustment by a legitimate AP rather than the presence of an unauthorized device.

• ✗

  The SSID is broadcasted with the same name as the corporate network

  Why it's wrong here

  While rogue access points commonly broadcast an SSID identical to the corporate network to trick users into connecting, this factor alone is insufficient for confirmation. Enterprise wireless networks are designed with multiple legitimate access points all broadcasting the same SSID to facilitate seamless roaming and provide ubiquitous coverage. Therefore, a matching SSID is a necessary but not a unique characteristic of a rogue AP, requiring additional corroborating evidence.

• ✓

  The BSSID matches a known manufacturer, but the signal strength is unusually high

  Why this is correct

  This combination is a strong indicator of a rogue AP. The Basic Service Set Identifier (BSSID), which is the MAC address of the AP, contains an Organizationally Unique Identifier (OUI) that identifies the manufacturer. While a rogue AP might spoof an OUI to appear legitimate, an unusually high signal strength for an AP not registered within the network's inventory strongly suggests a physically close, unauthorized device. This discrepancy between a potentially legitimate-looking identifier and an anomalous physical presence is highly suspicious.

• ✗

  The encryption type is WPA2 with CCMP

  Why it's wrong here

  The presence of WPA2 with CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) as the encryption type is not an indicator of a rogue access point. WPA2-CCMP is the current industry standard for robust wireless security, offering strong authentication and encryption. Legitimate corporate networks are expected and encouraged to utilize WPA2-CCMP to protect their wireless communications, making its observation a sign of proper security implementation, not necessarily a threat.

Go deeper

Related to this question