Municipal WIPS alerts on an access point advertising the corporate city SSID with an unknown BSSID and fingerprint not in the authorized inventory. What should analysts conclude they have detected?
Select an answer to reveal the explanation.
Short Explanation
Same name on the door, wrong serial number underneath—that is how WIPS spots an evil twin. Unknown BSSID/fingerprint against the corporate SSID is a classic rogue alert. A coffee shop with a totally different SSID would not match that signature.
Full Explanation
When municipal WIPS alerts on an access point advertising the corporate city SSID with an unknown BSSID and fingerprint not in the authorized inventory, analysts should conclude they have detected a likely rogue or evil-twin AP impersonating the trusted SSID based on SSID-BSSID anomaly monitoring. Trusted SSID names with unauthorized BSSIDs are a classic twin indicator. A normal RF neighbor from a co-located coffee shop using a different SSID only does not match same-SSID unknown-BSSID alerts. Proof that all clients have disabled probing and cannot be lured is not established by this alert. A successful FT roam event that always uses the same BSSID citywide misunderstands roaming and does not explain an unknown BSSID. Civic WIPS programs depend on accurate authorized inventories so same-SSID anomalies stand out quickly around city facilities. Exam caveat: classify and locate before auto-containing in sensitive areas, but do not dismiss same-SSID unknown BSSIDs as benign neighbors. Operational check: compare the BSSID/fingerprint to the authorized AP inventory, locate the device on the floor map, contain or remove if confirmed malicious, update inventory if it is a missing sanctioned AP, and review client association logs for users who joined the impostor.