Courseiva
Communication and Network SecuritymediumMultiple ChoiceObjective-mapped

CISSP Communication and Network Security Practice Question

After a recent security audit, a network administrator discovers that an attacker has been intercepting traffic by associating with a legitimate access point's MAC address and broadcasting a stronger signal. Which type of attack has occurred?

⚠ Common exam trap

Many exam-takers confuse 'rogue access point' (any unauthorized AP) with 'evil twin' (a specific impersonation of a legitimate AP), but the key differentiator is the active spoofing of the legitimate AP's MAC address and signal strength to intercept traffic, not just the presence of an unauthorized device.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Evil twin attack

Evil twin attack. This attack involves an attacker setting up a rogue access point that mimics a legitimate access point by spoofing its MAC address (BSSID) and broadcasting a stronger signal, causing clients to associate with the attacker's device instead of the legitimate AP. The key distinction is the active impersonation of a specific legitimate AP, not just the presence of an unauthorized AP.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Rogue access point

    Why it's wrong here

    A rogue access point is any unauthorized wireless access point connected to a network, whether intentionally or inadvertently. While it poses a significant security risk by providing an unmonitored entry point, it does not inherently involve impersonating a specific legitimate AP or actively luring users with a stronger signal. The term is broader and encompasses scenarios where an AP is simply present without authorization, lacking the specific deceptive intent of an evil twin.

  • Karma attack

    Why it's wrong here

    A Karma attack exploits the behavior of wireless devices that broadcast probe requests for previously known networks. The attacker's access point responds to any such probe request, regardless of the requested SSID, effectively tricking the client into connecting to the attacker's network. This method does not require cloning the SSID or MAC address of a specific legitimate access point, making it distinct from an evil twin, as it relies on the client's indiscriminate connection attempts.

  • Evil twin attack

    Why this is correct

    An evil twin attack involves an attacker setting up a malicious access point that precisely mimics a legitimate Wi-Fi network, typically by using the same Service Set Identifier (SSID) and often the same MAC address. The attacker then broadcasts this imposter network with a stronger signal than the legitimate one, luring unsuspecting users to connect to it instead. Once connected, the attacker can intercept all network traffic, harvest credentials, or inject malware, making it a highly effective man-in-the-middle attack.

  • ARP spoofing

    Why it's wrong here

    ARP spoofing is a Layer 2 (Data Link Layer) attack where an attacker sends forged Address Resolution Protocol (ARP) messages over a local area network. This tricks devices into associating the attacker's MAC address with the IP address of a legitimate network device, such as the default gateway or another host. Consequently, traffic intended for the legitimate device is redirected through the attacker's machine, enabling man-in-the-middle attacks, but it operates at a different network layer and does not involve wireless access point impersonation.

Quick reference

Access Control Model Comparison

ModelAcronymWho Controls Access?Best For
Discretionary Access ControlDACResource ownerSmall teams, file shares
Mandatory Access ControlMACSystem / security labelsClassified govt / military
Role-Based Access ControlRBACAdministrator (via roles)Enterprise environments
Attribute-Based Access ControlABACPolicy engine (user + resource attributes)Fine-grained, dynamic policies
Rule-Based Access ControlRuBACSystem rules / ACLsFirewall rules, network ACLs

About these practice questions

One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.