A municipal blue team asks how client devices typically choose among duplicate SSIDs when a rogue AP appears nearby. Which theme best explains that preference behavior?
Select an answer to reveal the explanation.
Short Explanation
Phones and laptops are not reading your asset database—they chase loud beacons and remembered networks. Put a stronger lookalike next to the real AP and many devices wander over on autopilot. That preference pattern is exactly what rogue APs lean on.
Full Explanation
Client devices typically choose among duplicate SSIDs using themes such as stronger signal or a remembered network profile—behavior rogue APs exploit. Municipal blue teams and assessors should understand preference heuristics at awareness depth. Evil twins succeed when they win the client's selection logic, not when the city's CMDB invents a BSSID order.
'Clients always pick the oldest BSSID recorded in the city's CMDB regardless of signal' fails because clients do not always pick the oldest BSSID recorded in the city's CMDB regardless of signal. 'Clients refuse any SSID that lacks a WPS PIN printed on the AP label' fails because clients do not refuse any SSID that lacks a WPS PIN printed on the AP label. 'Clients ignore signal strength and connect only after an assessor runs aircrack-ng' fails because clients do not ignore signal strength and connect only after an assessor runs aircrack-ng.
Exam caveat: selection behavior varies by OS and saved profiles—teach the theme, not one vendor myth. Operational check: in a civic lab, demonstrate two same-SSID APs with different RSSI under authorization, observe client choice, and document implications for rogue placement. Use findings to improve user awareness and inventory monitoring. In municipal wireless operations, record the rationale in the engagement notes so future assessors know which control or technique class was chosen and which failure modes the rejected options would create for city services.