Municipal WIPS alerts on an access point advertising the corporate city SSID with an unknown BSSID and fingerprint not in the authorized inventory. What should analysts conclude they have detected?
Select an answer to reveal the explanation.
Short Explanation
Same name on the door, wrong serial number underneath—that is how WIPS spots an evil twin. Unknown BSSID/fingerprint against the corporate SSID is a classic rogue alert. A coffee shop with a totally different SSID would not match that signature.
Full Explanation
Detection of rogue and evil-twin APs commonly relies on WIPS/WIDS comparing advertised SSIDs to authorized BSSID inventories and device fingerprints. An unknown radio cloning a trusted SSID is a high-priority WLAN attack indicator. Analysts should escalate containment and location rather than treating the event as a routine friendly neighbor.