Exam SY0-601 topic 1 question 473 discussion

The user is most likely experiencing an Evil Twin attack. In this type of attack, an attacker creates a fake access point with the same name as the legitimate access point to which the user is trying to connect. The attacker can then intercept and eavesdrop on the user's network traffic, potentially stealing sensitive information. The user's laptop may be disconnecting and reconnecting to the fake access point, causing the inability to access shared folders or other network resources.

Given that the laptop reconnects without human intervention, the scenario assumes that the device has already saved the network profile of the legitimate network. The evil twin, by definition, has an SSID and credentials identical to a legitimate AP, which makes it possible for a device to automatically connect to a fake AP, if it is within the detection range. This won't happen with rogue APs that don't exactly mimic existing, legitimate networks.

Evil twin - disconnects from the Wi-Fi network---->disassociation packets being sent

D. Evil twin

Option D. Here is why "A rogue access point is an illegitimate access point plugged into a network to create a bypass from outside into the legitimate network. By contrast, an evil twin is a copy of a legitimate access point."

In this case, the user's laptop is able to connect to the internet but cannot access shared folders or other network resources because it is actually connected to the attacker's evil twin network. The attacker is likely intercepting the user's network traffic and preventing them from accessing certain resources.

There's a disassociation attack and a second AP. Evil Twin. That's what differentiates this from the rogue AP option.

mouettespaghetti, kmummy & ITSheWolf are wrong for choosing C. Rogue Access Point. For those who have confusion between C & D: Rogue Access Point (RAP) is where an unauthorised access point is connected to the network, likely via the switch of the network. The main point of a RAP is for malicious actors to have access into the network, which is not the case as stated in the question. Evil twin: A AP that mimics the SSID and for more sophisticated attacker, spoofed mac address of a legitimate AP. this is not connected to the network and hence users who are lured into connecting to them will NOT have access to the network, but have access to the internet.

Don't know why the answer is shown C. The answer is clearly D because the user is connected to the internet again (meaning the user has connected to the same wifi). Evil twin is a specific type of rogue access point mimicking the exact wireless network. That is why the user cannot see the shared network resources because the mimicked Wireless Network is not a part of the corporate network.

C The most common Rogue AP is an ilegitimate AP that is plugged in a network to create a bypass from outside into the legitime network. An Evil Twin is a copy of a legitimate AP. The target is different. It tries to hook clients to connect to the fake network to steal information, but is a kind of Rogue AP too. A lot of people is wrong about this. They think an Evil Twin is not a Rogue AP but it is too. Look at the definition on Wikipedia: Rogue AP. You can read there "... it is tagged as rogue access point of the second kind, which is often called an Evil Twin". The Evil Twin has too "good" or "positive" usage. It can be used during a pentesting over a corporate network to measure the "security education" or better said, the user's security awareness. To see how many bite the lure.

An Evil Twin is a Wi-Fi access point set up to mimic a network A.P. It is connected to the internet but not to the company network. The intent of the evil twin is to intercept traffic from devices that are connected to it. The devices cannot access network files or folders because the evil twin is not connected to the organization's network.

i know evil twing is a type of rougue acces point so in this case what we should choose and why?

C) Rogue Access Point ...because (D) Evil twin is not part of the network

IMO, it's Evil Twin. Bluejacking is a type of Bluetooth attack that involves sending unsolicited messages to nearby Bluetooth devices, but it is not related to Wi-Fi connectivity or network resource access. Jamming is a type of attack in which an attacker floods the Wi-Fi frequency with noise or other signals to disrupt communications, but this would not result in the specific symptoms described in the scenario. A rogue access point is a malicious Wi-Fi access point set up by an attacker to mimic a legitimate one, but it is unlikely to cause the connectivity and access issues described in the scenario. An evil twin attack is similar to a rogue access point attack, but the attacker creates an access point with the same name and security credentials as a legitimate one in order to trick users into connecting to it. Again, this is unlikely to cause the specific symptoms described in the scenario.

According to Messer it sound like an Evil Twin.

>>>>>>>>>D<<<<<<<<<>>>>> Evil Twin <<<<<<<<<<<< The user is most likely experiencing an "Evil twin" attack. An evil twin attack is a type of Wi-Fi attack where an attacker sets up a fake wireless access point that looks like a legitimate one. When a user connects to the fake access point, the attacker can intercept and monitor their network traffic, steal sensitive information, or launch other attacks. In this scenario, the user's laptop is likely connecting to the fake access point, which is causing the disconnection from the legitimate network and preventing access to shared folders and other resources.

-C is correct Based on the information provided, the user is most likely experiencing a rogue access point attack, as shown in option C. A rogue access point is an unauthorized access point that is connected to a network without the network administrator's knowledge or consent. Rogue access points can be set up by attackers to intercept network traffic, steal sensitive information, or launch other types of attacks. In this scenario, the user's laptop is constantly disconnecting from the Wi-Fi network, which could be an indication that there is a rogue access point interfering with the network. Once the laptop reconnects to the network, the user can reach the internet, but cannot access shared folders or other network resources. This is a common symptom of a rogue access point attack, as the rogue access point may not be configured to allow access to these resources.