A municipal blue team asks how client devices typically choose among duplicate SSIDs when a rogue AP appears nearby. Which theme best explains that preference behavior?
Select an answer to reveal the explanation.
Short Explanation
Phones and laptops are not reading your asset database—they chase loud beacons and remembered networks. Put a stronger lookalike next to the real AP and many devices wander over on autopilot. That preference pattern is exactly what rogue APs lean on.
Full Explanation
When multiple APs advertise the same SSID, client selection commonly favors stronger RSSI and previously trusted/remembered profiles. Rogue and evil-twin assessments exploit that behavior by presenting an attractive lookalike. CMDB age, WPS label checks, or waiting for aircrack-ng are not how ordinary stations choose among duplicates.