In the context of wireless security, which statement is true regarding an evil twin attack?

• A. The evil twin must have a stronger signal than the legitimate AP
• B. The evil twin impersonates the victim and conducts attacks
• C. Both of the above
• D. Neither

Answer: (C)

An evil twin attack happens when a attacker sets up a rogue wireless access point that copies the legitimate AP’s identity (the same SSID) so that users connect to it, allowing the attacker to monitor or tamper with the traffic in between the user and the network. The deception is the core idea: the attacker impersonates the legitimate network to fool clients into joining the rogue as if it were the real one. Once connected, the attacker can capture credentials, inject content, or perform a man-in-the-middle attack.

To succeed in practice, the rogue often needs to be positioned so its signal is competitive with the legitimate AP. When devices see multiple APs with the same SSID, they tend to connect to the one with the stronger signal, so having a stronger (or at least equal) signal makes the evil twin more likely to be chosen by the client. This combination—impersonating the legitimate network and ensuring the rogue offers a strong enough signal to draw connections—describes the typical behavior of an evil twin attack. To stay safe, use trusted networks only, verify the exact network you connect to, use protections like VPNs and strong encryption, and disable automatic connections to open or unfamiliar networks.