CompTIA Network+ (N10-009)Network SecurityEasy
An attacker sets up a wireless access point in a coffee shop using the same SSID as the legitimate shop Wi-Fi, hoping customers will connect to it instead. Which attack is being described?
- ARogue access point
- BARP spoofing
- CVLAN hopping
- DEvil twin
Show answer & explanationAnswer & explanation
Correct answer: D. Evil twin
An evil twin attack specifically mimics a legitimate SSID to trick users into connecting, allowing the attacker to intercept traffic. A generic rogue AP may not impersonate an existing network.
Why the other options are wrong
- A. A rogue AP is any unauthorized AP but doesn't necessarily impersonate the legitimate SSID.
- B. ARP spoofing manipulates MAC-to-IP mappings on a local network, unrelated to SSID impersonation.
- C. VLAN hopping is a wired-network attack exploiting trunking, not wireless SSIDs.
Evil Twin
A malicious wireless access point configured to mimic a legitimate network's SSID in order to intercept user traffic or credentials.
- Uses same or similar SSID as trusted network
- Often paired with a stronger signal to lure clients
- Can capture credentials via fake captive portals
Memory trick: Twins look alike — evil twin copies the real Wi-Fi name.