Exam SY0-601 topic 1 question 417 discussion

Just passed the exam with a score of 800 on 10/28/23. About 90% of the questions are from here. This question is on the exam.

This question was on the exam. It's C

A. Another customer has configured a rogue access point. (wrong because this could also be technically called an evil twin if it had the same SSID) B. The coffee shop network is using multiple frequencies. (wrong because the user has been connecting before with no issues, so multiple frequency are not new) C. A denial-of-service attack by disassociation is occurring. (correct answer..not the greatest, but the better answer.) D. An evil twin access point is being utilized. (wrong because an evil twin will initially disassociate the user but subsequently succeed and establish a good connection but to an evil twin which in essence is a rogue wap with the same ssid of a legit wap.

There was a 99% similar question in this website and the answer was Evil twin though with 100 % community vote. The discussion was like "the attacker force the user's machine to disconnect so that the user connected to the evil twin. Now I am also confused about the community how quick they changed their mind.

D. An evil twin access point is being utilized. It's most likely that an attacker is forcing the user off the legitimate access point, and then getting them to reconnect to the attacker's Evil Twin access point. It's unlikely that an attack is simply doing this only for the purposes of DoS-ing the user, and no other reason. The more specific reason would be to get them to join the Evil Twin access point, and then to capture sensitive data once they connect to the Evil Twin. A common scenario for an Evil Twin attack occurs in public places with free WiFi. In such places, users typically aren't verifying network authenticity, making it easy for attackers to trick them. An Evil Twin is a deceptive WiFi access point (AP) that mirrors a legitimate one. It shares the same name (SSID) and, often, the same MAC address. This cyber mirage can be used for ethical and unethical purposes.

This question is very tricky in terms of very little clue given, at the same time three possible answers in this option followed by EVIL twin, denial of service attack and The coffee shop network using multiple frequencies. Anyway, I am going with B, because of connection frequency fluctuation from 5GhZ to 2.4 Ghz Given the log entries show that the user's device successfully connects to the network when the frequency is either 5GHz or 2.4GHz but experiences disconnections when transitioning between them. This can be a common issue in crowded or busy Wi-Fi environments where multiple devices are competing for bandwidth, and interference or congestion can disrupt connections, especially on the 5GHz frequency.

Based on the Wi-Fi log, it appears that the user's device is being disconnected and reconnected frequently from the access point. This is indicated by the presence of many "disassociation" and "association" events. This could be caused by interference from another device or network, or it could be due to a malfunctioning Wi-Fi adapter in the user's device. Therefore, it is unlikely that the cause of the issue is a rogue access point, multiple frequencies, or an evil twin access point. Therefore, the best answer is: C. A denial-of-service attack by disassociation is occurring.

C is the most possible

-C is correct The log shows that the user's device is able to connect to the coffee shop's Wi-Fi network but is then quickly disconnected. This is a common behavior of a disassociation attack where an attacker sends forged deauthentication packets to disconnect the victim's device from the Wi-Fi network. The fact that the user is able to connect to the network at different times and frequencies rules out options A, B, and D.