Certified Incident Handler (CIH) Practice Ecam

What type of security incident involves attackers using an evil twin AP to capture confidential information?

1. Wireless network incident

2. Network eavesdropping

3. Client-side attack

4. Insider threat

The correct answer is: Wireless network incident

The situation described pertains to a wireless network incident where attackers set up an evil twin access point (AP). An evil twin AP is a rogue wireless access point that appears to be legitimate but is actually controlled by an attacker. The primary purpose of this setup is to mimic a trusted network, tricking unsuspecting users into connecting. Once users connect to the evil twin AP, attackers can intercept and capture confidential information such as passwords, emails, and other sensitive data transmitted over the network. The classification as a wireless network incident is accurate because the attack specifically exploits vulnerabilities in wireless communication. Users often may not notice any difference between the legitimate access point and the evil twin, making this type of incident particularly dangerous in public spaces where multiple networks might be available. This scenario emphasizes the importance of security measures like verifying the network name before connecting and employing encryption for sensitive transactions.