CEH Practice Question: Advanced Topics: Wireless, Cloud, IoT, Cryptography

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Implementing client-side certificate validation for network authentication

  Why this is correct

  Implementing client-side certificate validation for network authentication is a robust countermeasure because it mandates that the client verify the identity of the access point (AP) using a pre-installed, trusted digital certificate. If a rogue AP, such as an evil twin, attempts to impersonate the legitimate network, it will lack the correct certificate, causing the client to reject the connection and preventing users from inadvertently connecting to the malicious network.

• ✓

  Using WPA3-Enterprise with 802.1X authentication

  Why this is correct

  Using WPA3-Enterprise with 802.1X authentication provides strong protection by establishing mutual authentication between the client and an authentication server (typically RADIUS) via Extensible Authentication Protocol (EAP). This setup ensures that both the client verifies the server's certificate and the server verifies the client's credentials, making it exceedingly difficult for an attacker to impersonate the legitimate AP or intercept authentication traffic without possessing valid cryptographic keys.

• ✗

  Enabling MAC address filtering on the AP

  Why it's wrong here

  Enabling MAC address filtering on the AP is an ineffective countermeasure against evil twin attacks because MAC addresses are easily spoofed. An attacker can simply sniff the MAC address of a legitimate client or the legitimate AP itself from unencrypted wireless traffic and then configure their rogue AP or client device to use that same MAC address, completely bypassing this superficial access control mechanism.

• ✗

  Disabling SSID broadcast on the legitimate AP

  Why it's wrong here

  Disabling SSID broadcast on the legitimate AP is a weak security measure that does not prevent evil twin attacks. While it hides the network name from casual scanners, the SSID is still transmitted in probe requests, probe responses, and association frames. Attackers can easily discover the 'hidden' SSID using readily available tools, then broadcast it from their rogue AP to trick users into connecting.

• ✓

  Using a VPN over the wireless connection

  Why this is correct

  Using a VPN over the wireless connection is an effective countermeasure because it establishes an encrypted tunnel between the client and a trusted VPN server, regardless of the underlying Wi-Fi network's security. Even if a user inadvertently connects to an evil twin AP, all data transmitted through the VPN tunnel remains encrypted and protected from interception or manipulation by the rogue AP, ensuring confidentiality and integrity.

Go deeper

Related to this question