Workers near city hall associate to a fake access point that advertises the corporate municipal SSID and presents a look-alike login to harvest credentials. Which attack pattern best describes this?
Select an answer to reveal the explanation.
Short Explanation
The fake AP is a doppelgänger wearing the city’s name badge. Clients trust the familiar SSID, then hand secrets to the wrong radio—that is evil-twin MITM territory. Noise jamming alone does not harvest logins.
Full Explanation
Workers near city hall who associate to a fake access point advertising the corporate municipal SSID and presenting a look-alike login to harvest credentials are experiencing an evil-twin man-in-the-middle that impersonates a trusted SSID to intercept or phish users. The attacker copies the trusted name, attracts associations, and captures credentials or session data. Spectrum jamming that only raises noise floor without impersonating an SSID is a pure availability attack and does not present a look-alike login. A captive-portal certificate pin update pushed from the legitimate controller is a normal management action, not an attack pattern matching this stem. A scheduled Fast BSS Transition failure causing brief VoWLAN blips is a roaming performance issue, not credential harvesting via a fake AP. Civic offices with high foot traffic are frequent evil-twin targets and need both technical detection and user skepticism of unexpected credential prompts. Exam caveat: evil-twin MITM combines SSID impersonation with user deception; defenses include WIPS, 802.1X with validated server certificates, and awareness—not RF power alone. Operational check: hunt for unknown BSSIDs advertising the city SSID, enable WIPS rogue classification, verify clients validate EAP server certificates, train staff to report unexpected Wi-Fi logins near city hall, and contain confirmed twins.