In a man-in-the-middle attack, which of the following is true?

• A. An evil twin must have a stronger signal than the legitimate AP
• B. An evil twin sends own attacks, impersonating the victim
• C. Neither A nor B
• D. Both A and B

Answer: (D)

In a wireless man-in-the-middle scenario, an evil twin is a rogue access point that imitates the legitimate one to lure clients into connecting. Once a device associates with the evil twin, the attacker sits between the client and the real network, able to forward, inspect, and potentially modify traffic.

Having a stronger or at least highly convincing signal helps the attacker attract devices away from the legitimate AP, increasing the chance that clients connect to the rogue AP instead. At the same time, the attacker impersonates the legitimate endpoint, so traffic goes through the evil twin. This allows the attacker to relay communications, observe sensitive data, and inject or alter content as needed. Because both luring devices with convincing transmission conditions and impersonating the real endpoint are common traits of an evil-twin MITM, the option that combines these ideas reflects how this attack works in practice.