Citizens report captive-portal lookalikes near a municipal plaza guest network. Which defensive approach best addresses evil-twin / MitM patterns?
Select an answer to reveal the explanation.
Short Explanation
Evil twins wear the city’s SSID like a fake badge at the festival gate. Spot them with wireless IDS/IPS and watchful ops, tell people how the real guest network looks, and harden the real service. Posting secrets on a sandwich board is not a detection strategy.
Full Explanation
Citizen reports of captive-portal lookalikes near a municipal plaza guest network point to evil-twin and man-in-the-middle patterns that erode trust in public Wi-Fi. The sound defensive approach combines WIDS/WIPS detection of spoofed BSSIDs and SSIDs, operational monitoring, user education on official join paths, and hardening of the legitimate guest service. Civic operators need detection plus clear citizen guidance rather than a single slogan or a single technical gadget.
Publishing a PSK on a sidewalk sandwich board does not validate authenticity of an evil twin and may widen credential exposure. Disabling monitoring to avoid festival false positives blinds the city during peak risk periods. Teaching users to install random VPN APKs from unofficial links as the only control introduces malware risk and ignores infrastructure detection.
Exam caveat: user education helps but cannot replace RF monitoring when lookalike SSIDs appear; both layers matter for public venues. Operational check: verify WIPS signatures and alerts for SSID/BSSID spoofing on the plaza, publish the official join instructions on city channels, and run a tabletop on who responds when citizens report a lookalike portal.