AP Cybersecurity — Unit 1, Topic 1.3

Skills 1.A, 1.B, 1.D ~40–50 min • 4 Specimens • 24 pts

Your Role: Threat Analyst

6 pts

A college student arrives at a coffee shop and connects to “CafeNova_WiFi” (the real network is “CafeNova-Guest”). The student logs into their university email and their streaming service. Twenty minutes later they are locked out of both accounts. Another patron notices a laptop in a corner with a portable router and unusual software running.

Attack type:

-- Select -- Evil twin attack — rogue WAP with a deceptive SSID in proximity to the legitimate network Jamming attack — EM interference preventing wireless communication War driving — passive scanning of wireless networks while mobile Standard DoS — flooding the coffee shop’s internet router

Adversary skill level:

-- Select -- Low-skilled — used a portable router and pre-built evil twin software; no zero-day exploitation required High-skilled — created a novel attack tool to compromise the coffee shop’s WAP

Primary impact (what was stolen or disrupted):

-- Select -- Credential theft — email and streaming credentials captured via MITM between device and internet Denial of service — the student was prevented from using the network Reconnaissance — the adversary mapped the coffee shop’s wireless infrastructure Malware installation — malicious software was placed on the student’s device

Control that would have prevented the harm:

-- Select -- VPN — encrypts device traffic before reaching the evil twin; intercepted data is unreadable ciphertext A stronger password for the email and streaming accounts Forcing HTTPS on all pages visited A personal firewall on the student’s device Check Specimen 1

6 pts

During a hospital’s emergency response drill, all wireless devices in the east wing stop functioning simultaneously for 90 minutes. Nurses cannot communicate via wireless pagers, the wireless medication dispensing system goes offline, and patient monitoring devices lose their wireless connection. When security investigates, they find a device in a maintenance closet emitting EM signals in the 2.4 GHz frequency band. No patient data was accessed or stolen.

Attack type:

-- Select -- Jamming attack — EM signal flooding causing DoS for all wireless devices in the east wing Evil twin attack — rogue WAP capturing hospital device traffic War driving — someone scanned the hospital’s wireless networks from outside Credential stuffing attack against hospital employee accounts

Adversary skill level:

-- Select -- Low-skilled — used a pre-built jamming device available commercially; exploited no zero-day vulnerabilities High-skilled — created a custom EM disruption tool targeting the hospital’s specific wireless frequencies

Primary impact (what was stolen or disrupted):

-- Select -- Denial of service — wireless made unavailable to authorized users; no data stolen or accessed Credential theft — hospital employee credentials were captured during the disruption MITM interception — patient data was intercepted as it passed through the jammer Both DoS and data theft occurred simultaneously

Control that would have prevented the harm:

-- Select -- Wired backup for critical systems (immune to jamming) + RF shielding + spectrum monitoring Enable VPN on all hospital wireless devices Use stronger wireless encryption (WPA3) on all hospital networks Segment the hospital’s wireless network into more VLANs Check Specimen 2

6 pts

A threat intelligence team identifies a pattern: over three weeks, the same vehicle was observed parked outside six financial services firms with a wireless scanning device running. Two weeks later, three of those firms reported employees connecting to evil twins in their parking structures. The evil twins used SSIDs identical to each firm’s legitimate guest network, broadcast from devices physically placed inside the parking structures. Employee credentials and session tokens were captured.

Attack type:

-- Select -- War driving (recon) + evil twin (active) — two-stage: passive SSID mapping then targeted rogue AP Evil twin attack only — war driving was not involved Jamming attack followed by evil twin attack War driving only — the evil twins were a separate unrelated incident

Adversary skill level:

-- Select -- Low-skilled for both stages — pre-built tools for both; no zero-day exploitation required High-skilled — the attack required creating custom reconnaissance and evil twin tools High-skilled for war driving, low-skilled for evil twin High-skilled because zero-day vulnerabilities were used

Primary impact (what was stolen or disrupted):

-- Select -- Both credential + session token theft via MITM — account takeover without knowing the password Denial of service only — employees were prevented from connecting Reconnaissance only — war driving phase Malware installation on employee devices

Control that would have prevented the harm:

-- Select -- VPN (blocks MITM) + SSID verification with IT + disable auto-connect on non-corporate Wi-Fi Require stronger employee passwords for corporate accounts Upgrade all corporate guest networks to WPA3 encryption Deploy perimeter firewalls to detect evil twin traffic Check Specimen 3

6 pts

A security researcher hired to assess a hospital campus discovers: (1) the hospital’s internal clinical network signal is detectable from the adjacent public park, (2) the hospital’s SSID is being broadcast by two devices in the park (not the hospital’s own WAPs), and (3) three employees had recently connected to what they thought was the hospital’s guest network from the park during lunch. Their session tokens for the clinical records system were later used to access records from an IP outside the hospital. The attack involved both passive reconnaissance and active exploitation.

Attack type:

-- Select -- War driving (signal leakage + SSID found) + evil twin — two-stage attack on physical gap and behavior Evil twin attack only — the signal leakage finding is unrelated Jamming attack followed by evil twin attack War driving only — the data breach resulted from the reconnaissance phase alone

Adversary skill level:

-- Select -- Low-skilled — pre-built tools only; no zero-day; relied on signal leakage and employee behavior High-skilled — required creating custom tools and exploiting a zero-day in the hospital’s WAP

Primary impact (what was stolen or disrupted):

-- Select -- Session token theft — unauthorized PHI access; HIPAA violation with regulatory and financial consequences Credential theft only — employee passwords were captured Denial of service — hospital wireless was disrupted Reconnaissance only — no active exploitation occurred

Control that would have prevented the harm:

-- Select -- 3-layer: (1) Reduce WAP power; (2) Mandatory VPN; (3) Disable auto-connect + verify SSID with IT VPN alone — sufficient to prevent all stages of this attack Reduce WAP power only — this single control prevents all stages Require longer passwords for the clinical records system Check Specimen 4

0 / 24 pts

✎ AP Exam Tip