Mitigating Evil Twin Attacks in Public Wi-Fi

312-50v12 By islever Editorial Last updated

Hacking Wireless Networks

Short answer

D Display a captive portal page that warns users about the possibility of Evil Twin attacks.

Question

You are a cybersecurity consultant for a major airport that offers free Wi-Fi to travelers. The management is concerned about the possibility of "Evil Twin" attacks, where a malicious actor sets up a rogue access point that mimics the legitimate one. They are looking for a solution that would not significantly impact the user experience or require travelers to install additional software. What is the most effective security measure you could recommend that fits these constraints, considering the airport's unique operational environment?
  1. Regularly change the SSID of the airport's Wi-Fi network
  2. Use MAC address filtering on the airport's Wi-Fi network
  3. Implement WPA3 encryption for the airport's Wi-Fi network
  4. Display a captive portal page that warns users about the possibility of Evil Twin attacks Correct Answer

Key Takeaways

The exam tests the distinction between encryption (which secures the link but not the SSID identity) and social/educational measures for mitigating phishing-style network attacks like Evil Twins.

This question explores effective countermeasures against Evil Twin attacks in high-traffic public Wi-Fi environments, specifically evaluating options that balance security with user convenience. The correct approach prioritizes user awareness and education over technical controls that are either ineffective or intrusive.

Common mistake: Candidates often select WPA3 encryption (C), mistakenly believing that stronger encryption prevents an attacker from broadcasting a rogue SSID. However, WPA3 does not authenticate the legitimacy of the access point itself, leaving users vulnerable to connecting to a malicious hotspot.

Expert Analysis

Why the Answer Is Correct

Displaying a captive portal warning (D) is the most practical solution because it leverages user vigilance without requiring software installation or degrading the connection experience. Since Evil Twin attacks rely on deceiving users into connecting to a fraudulent AP, educating them via a clear warning page directly addresses the human element of the attack vector. This method ensures that travelers are aware of the risk before they transmit sensitive data.

Why the Other Options Are Wrong

Changing the SSID regularly (A) would severely impact user experience by causing frequent disconnections and confusion. MAC address filtering (B) is unscalable for a major airport with thousands of transient devices and breaks when devices use randomized MAC addresses. WPA3 encryption (C) secures the traffic after connection but does not prevent a user from initially connecting to a rogue AP that mimics the legitimate SSID; as one commenter noted, "WPA3 with a open SSID do not protect to 'Evil Twin' attacks".

Community Comment Notes

The community was divided, with many recognizing that while WPA3 is best practice for security, it doesn't stop the initial deception. As user 'JustAName' pointed out, WPA3 "only protect the actual airport's wifi and doesn't properly address the issue of possible evil twin attack." Another user clarified that "C doesn't do anything to the evil twin use case," reinforcing that encryption is not an authentication mechanism for the AP's identity.

Exam Strategy

When faced with scenarios involving social engineering or deceptive networks (like Evil Twins), prioritize solutions that involve user awareness or detection systems unless the question specifies a technical prevention tool like RADIUS-based EAP-TLS. If 'user experience' and 'no additional software' are constraints, look for educational or monitoring solutions rather than complex cryptographic deployments.

Frequently Asked Questions

Why isn't WPA3 the right answer for preventing Evil Twins?

WPA3 encrypts the data session but does not verify the identity of the Access Point. An attacker can still broadcast the same SSID, and a user might connect before realizing it is fake.

Can MAC filtering stop an Evil Twin?

No. MAC filtering is designed to restrict which devices can connect, not to identify rogue APs. Furthermore, modern devices randomize MAC addresses, making this control ineffective for public Wi-Fi.

More 312-50v12 FAQ →

Community Votes

D
56%
C
44%

56% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. JustAName 👍 5 Answered D
    I'd go with D, while implementing WPA3 encryption is always good to strengthen the security of the wifi. But it only protect the actual airport's wifi and doesn't properly address the issue of possible evil twin attack. So D is the best answer available in my opinion.
  2. qwerty100 👍 4 Answered C
    C. Implement WPA3 encryption for the airport's Wi-Fi network An evil twin can Display a captive portal page that warns users about the possibility of Evil Twin attacks
  3. anarchyeagle 👍 3 Answered C
    Chat GPT Response: The most effective and practical solution that fits the given constraints is Option C: Implement WPA3 encryption for the airport's Wi-Fi network. This approach enhances security without significantly impacting the user experience or requiring the installation of additional software. It directly addresses the vulnerability to "Evil Twin" attacks by ensuring that the connection between the user's device and the Wi-Fi network is securely encrypted, making it much more difficult for attackers to mimic or intercept communications.
  4. [Removed] 👍 2
    Hey team can we double-check this response
  5. blehbleh 👍 1 Answered D
    I have seen several stupid questions in this dump. This is one of them. I am assuming they want you to select C because WPA3 it talked about helping prevent evil twins. But in reality it can't protect against an evil twin, it can make your connection more secure if you are connected to a WPA3 connection but it can't negate or stop you from connecting to an evil twin which is why the real answer here should be D, but on the test I would probably answer C because if you do any research about WPA3 and its benefits compared to previous versions preventing evil twins in mentioned but it really doesn't do anything against an evil twin. I'm pretty sure I read about it in a SANS book as well about how WPA3 helps protect against evil twins.
Show 5 more comments
  1. Spam_Protection 👍 1 Answered C
    WPA3 will keep people from being disconnected and possibly connected to Evil Twin. WPA3 focus on encryption not authentication(no open network provides auth). You still need to deploy rogue-AP detection or wireless intrusion prevention/detection systems to prevent wireless attacks.
  2. qtygbapjpesdayazko 👍 1 Answered D
    Is D, WPA3 with a open SSID do not protect to "Evil Twin" attacks, https://security.stackexchange.com/questions/188707/does-wpa3-owe-mean-the-return-of-evil-twins
  3. pboniface 👍 1 Answered D
    Answer is D, If you use WPA3, how does it prevent an attacker from creating thesame SSID and broadcasting it in the airport...
  4. yicx1 👍 1 Answered D
    C doesn't do anything to the evil twin use case
  5. pboniface 👍 1 Answered D
    D is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide