On an authorized rogue open AP, a fake captive portal prompts staff for a 'Wi-Fi password' field. How should that hybrid technique class be described?
Select an answer to reveal the explanation.
Short Explanation
The AP is open, but the page asks for the 'real Wi-Fi password'—that is social engineering riding on a technical rogue. People type the campus PSK into a form they should not trust. It is not a policy-only essay, a 6 GHz driver myth, or proof that open SSIDs cannot serve web pages.
Full Explanation
On an authorized rogue open AP, a fake captive portal prompting staff for a Wi-Fi password field is a social-technical harvest class: users may be tricked into entering the real PSK into a fake portal. That hybrid technique combines RF attraction with social engineering. Municipal reports should describe both the technical twin and the human prompt risk.
'A mandatory CWSP policy-document rewrite with no technical component' fails because it is not merely a CWSP policy-document rewrite with no technical component. 'A chipset driver bug that only appears on 6 GHz radios' fails because it is not a chipset driver bug that only appears on 6 GHz radios. 'Proof that open SSIDs cannot host any web content' fails because it does not prove open SSIDs cannot host any web content—open twins often host portals.
Exam caveat: harvesting real PSKs via portals is highly sensitive—RoE and data handling must be explicit. Operational check: if authorized, use clearly labeled lab credentials where possible, minimize retention of real secrets, screenshot the password field lure for evidence, and brief staff never to enter corporate Wi-Fi passwords into unexpected portals. Destroy harvested test data per policy. In municipal wireless operations, record the rationale in the engagement notes so future assessors know which control or technique class was chosen and which failure modes the rejected options would create for city services.