CISSP Communication and Network Security Practice Question
After a recent security audit, a network administrator discovers that an attacker has been intercepting traffic by associating with a legitimate access point's MAC address and broadcasting a stronger signal. Which type of attack has occurred?
⚠ Common exam trap
Many exam-takers confuse 'rogue access point' (any unauthorized AP) with 'evil twin' (a specific impersonation of a legitimate AP), but the key differentiator is the active spoofing of the legitimate AP's MAC address and signal strength to intercept traffic, not just the presence of an unauthorized device.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Evil twin attack
Evil twin attack. This attack involves an attacker setting up a rogue access point that mimics a legitimate access point by spoofing its MAC address (BSSID) and broadcasting a stronger signal, causing clients to associate with the attacker's device instead of the legitimate AP. The key distinction is the active impersonation of a specific legitimate AP, not just the presence of an unauthorized AP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rogue access point
Why it's wrong here
A rogue access point is any unauthorized wireless access point connected to a network, whether intentionally or inadvertently. While it poses a significant security risk by providing an unmonitored entry point, it does not inherently involve impersonating a specific legitimate AP or actively luring users with a stronger signal. The term is broader and encompasses scenarios where an AP is simply present without authorization, lacking the specific deceptive intent of an evil twin.
- ✗
Karma attack
Why it's wrong here
A Karma attack exploits the behavior of wireless devices that broadcast probe requests for previously known networks. The attacker's access point responds to any such probe request, regardless of the requested SSID, effectively tricking the client into connecting to the attacker's network. This method does not require cloning the SSID or MAC address of a specific legitimate access point, making it distinct from an evil twin, as it relies on the client's indiscriminate connection attempts.
- ✓
Evil twin attack
Why this is correct
An evil twin attack involves an attacker setting up a malicious access point that precisely mimics a legitimate Wi-Fi network, typically by using the same Service Set Identifier (SSID) and often the same MAC address. The attacker then broadcasts this imposter network with a stronger signal than the legitimate one, luring unsuspecting users to connect to it instead. Once connected, the attacker can intercept all network traffic, harvest credentials, or inject malware, making it a highly effective man-in-the-middle attack.
- ✗
ARP spoofing
Why it's wrong here
ARP spoofing is a Layer 2 (Data Link Layer) attack where an attacker sends forged Address Resolution Protocol (ARP) messages over a local area network. This tricks devices into associating the attacker's MAC address with the IP address of a legitimate network device, such as the default gateway or another host. Consequently, traffic intended for the legitimate device is redirected through the attacker's machine, enabling man-in-the-middle attacks, but it operates at a different network layer and does not involve wireless access point impersonation.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
MAC
MAC (Media Access Control) is a unique hardware identifier assigned to network interfaces for communication on a local network segment.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.