On city hall guest Wi-Fi, several browsers suddenly warn about unexpected certificates and session contents appear altered mid-transfer. Which attack indicator does this describe?

On-path (man-in-the-middle) attackers position themselves between wireless clients and legitimate destinations so they can observe or alter session contents. Unexpected certificate warnings plus mid-transfer alteration on city hall guest Wi-Fi strongly indicate interception: browsers see certificates that do not match what endpoints expect when an attacker proxies or re-encrypts traffic. Open municipal guest networks without strong client isolation are recurring venues for this class of attack against visitors and staff who mistakenly use guest SSIDs for sensitive work.

A logic bomb waiting for a timed trigger on a file server is delayed conditional code execution on a host; it does not produce wireless certificate warnings or altered session contents. Worm self-propagation that never touches TLS handshakes explains spread without addressing certificate anomalies or session tampering. Backup-tape encryption leaving the records vault is a confidentiality control for media in transit, not an attack indicator on guest Wi-Fi.

Exam caveat: certificate warnings on open Wi-Fi are a common exam cue for on-path interception; do not dismiss them as “just a misconfigured AP” when the stem also mentions altered contents. On-path is the updated term for man-in-the-middle in CompTIA materials.

Operational check: move sensitive municipal work off guest Wi-Fi onto curated enterprise SSIDs or VPN, enable HTTPS-only and HSTS where possible, educate staff to stop through certificate warnings, consider wireless IPS and client isolation, and investigate rogue APs or evil-twin SSIDs near city hall.