City IT wants to mitigate evil-twin MITM against the staff enterprise SSID used in civic offices. Which combination best aligns with recommended mitigations?
Select an answer to reveal the explanation.
Short Explanation
Fight the doppelgänger three ways: WIPS to smack rogue radios, training so people pause on weird portals, and 802.1X that actually checks the server cert. Hiding the SSID or sharing passwords on posters helps the attacker more than you.
Full Explanation
When city IT wants to mitigate evil-twin MITM against the staff enterprise SSID used in civic offices, the combination that best aligns with recommended mitigations is WIPS containment, user training, and 802.1X with validated EAP server certificates on clients. WIPS detects and can contain impostor BSSIDs; training reduces credential entry into twins; 802.1X with proper server-certificate validation stops clients from authenticating to impostors lacking the real EAP server identity. Broadcasting the staff PSK on signage so users can verify they joined the right network exposes the key and does not validate network authenticity. Disabling certificate validation on EAP clients to speed roaming invites twins to succeed. Relying solely on hiding the SSID without WIPS or 802.1X validation is ineffective security through obscurity. Civic offices with public lobbies need this layered approach because physical proximity to attackers is routine. Exam caveat: all three layers matter—sensors, people, and mutual authentication—rather than any single control in isolation. Operational check: enable WIPS twin detection/containment for the staff SSID, verify clients reject EAP servers without the trusted CA/hostname, train staff on unexpected Wi-Fi credential prompts, and periodically test with a controlled rogue in a lab before relying on production defenses.