ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 66 - SY0-601 discussion

Report
Export

A security analyst reports a company policy violation in a case in which a large amount of sensitive data is being downloaded after hours from various mobile devices to an external site. Upon further investigation, the analyst notices that successful login attempts are being conducted with impossible travel times during the same time periods when the unauthorized downloads are occurring. The analyst also discovers a couple of WAPs are using the same SSID, but they have non-standard DHCP configurations and an overlapping channel. Which of the following attacks is being conducted?

A.
Evil twin
Answers
A.
Evil twin
B.
Jamming
Answers
B.
Jamming
C.
DNS poisoning
Answers
C.
DNS poisoning
D.
Bluesnarfing
Answers
D.
Bluesnarfing
E.
DDoS
Answers
E.
DDoS
Suggested answer: A

Explanation:

The attack being conducted is an Evil twin attack. An Evil twin attack involves creating a rogue wireless access point (WAP) with the same Service Set Identifier (SSID) as a legitimate WAP to trick users into connecting to it. Once connected, the attacker can intercept traffic or steal login credentials. The successful login attempts with impossible travel times suggest that an attacker is using a stolen or compromised credential to access the external site to which the sensitive data is being downloaded. The non-standard DHCP configurations and overlapping channels of the WAPs suggest that the attacker is using a rogue WAP to intercept traffic. Reference: CompTIA Security+ Certification Exam Objectives, Exam Domain 1.0: Attacks, Threats, and Vulnerabilities, 1.4 Compare and contrast types of attacks, p. 8

asked 02/10/2024
Lyndon Kumire
28 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first