During a city council livestream, attendees report a suspected wireless man-in-the-middle near the chambers. What incident-response approach is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
Suspected MitM calls for the wireless IR playbook—validate, contain, preserve, talk to stakeholders—not panic wipes or tweet-a-deauth. Coordinate WIPS and SOC like grown-ups.
Full Explanation
During a city council livestream, attendees reporting a suspected wireless man-in-the-middle near the chambers should trigger a wireless IR runbook: validate with WIPS/SOC, contain affected SSIDs/clients, preserve evidence, and communicate with stakeholders. Public meetings are high-visibility; chaotic responses become the story. Structured IR protects both constituents’ devices and the city’s investigative options.
Immediately wiping all council laptops without capturing wireless evidence destroys forensics. Announcing the attacker MAC on social media and asking citizens to deauth it crowdsources unsafe action. Powering off the entire municipal fiber backbone until RF clears is disproportionate collateral damage.
Exam caveat: communication templates should avoid speculative blame while the SOC validates lookalike BSSIDs/SSIDs. Operational check: tabletop the chambers MitM scenario, confirm WIPS evidence capture steps, identify containment options that spare unrelated city services, and name the public-information contact. In municipal WLAN programs, capture the decision in the wireless standard and re-check it at change review so the next project inherits the same control bar instead of rediscovering the failure during an outage.