Mitigating Evil Twin Attacks in Public Wi-Fi
You are a cybersecurity consultant for a major airport that offers free Wi-Fi to travelers. The management is concerned about the possibility of "Evil Twin" attacks, where a malicious actor sets up a rogue access point that mimics the legitimate one. They are looking for a solution that would not significantly impact the user experience or require travelers to install additional software. What is the most effective security measure you could recommend that fits these constraints, considering the airport's unique operational environment?
Community Votes
56% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests the distinction between encryption (which secures the link but not the SSID identity) and social/educational measures for mitigating phishing-style network attacks like Evil Twins.
This question explores effective countermeasures against Evil Twin attacks in high-traffic public Wi-Fi environments, specifically evaluating options that balance security with user convenience. The correct approach prioritizes user awareness and education over technical controls that are either ineffective or intrusive.
Candidates often select WPA3 encryption (C), mistakenly believing that stronger encryption prevents an attacker from broadcasting a rogue SSID. However, WPA3 does not authenticate the legitimacy of the access point itself, leaving users vulnerable to connecting to a malicious hotspot.
Community Discussion (11 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Displaying a captive portal warning (D) is the most practical solution because it leverages user vigilance without requiring software installation or degrading the connection experience. Since Evil Twin attacks rely on deceiving users into connecting to a fraudulent AP, educating them via a clear warning page directly addresses the human element of the attack vector. This method ensures that travelers are aware of the risk before they transmit sensitive data.Why the Other Options Are Wrong
Changing the SSID regularly (A) would severely impact user experience by causing frequent disconnections and confusion. MAC address filtering (B) is unscalable for a major airport with thousands of transient devices and breaks when devices use randomized MAC addresses. WPA3 encryption (C) secures the traffic after connection but does not prevent a user from initially connecting to a rogue AP that mimics the legitimate SSID; as one commenter noted, "WPA3 with a open SSID do not protect to 'Evil Twin' attacks".Community Comment Notes
The community was divided, with many recognizing that while WPA3 is best practice for security, it doesn't stop the initial deception. As user 'JustAName' pointed out, WPA3 "only protect the actual airport's wifi and doesn't properly address the issue of possible evil twin attack." Another user clarified that "C doesn't do anything to the evil twin use case," reinforcing that encryption is not an authentication mechanism for the AP's identity.Exam Strategy
When faced with scenarios involving social engineering or deceptive networks (like Evil Twins), prioritize solutions that involve user awareness or detection systems unless the question specifies a technical prevention tool like RADIUS-based EAP-TLS. If 'user experience' and 'no additional software' are constraints, look for educational or monitoring solutions rather than complex cryptographic deployments.
Frequently Asked Questions
Why isn't WPA3 the right answer for preventing Evil Twins?
WPA3 encrypts the data session but does not verify the identity of the Access Point. An attacker can still broadcast the same SSID, and a user might connect before realizing it is fake.
Can MAC filtering stop an Evil Twin?
No. MAC filtering is designed to restrict which devices can connect, not to identify rogue APs. Furthermore, modern devices randomize MAC addresses, making this control ineffective for public Wi-Fi.