8. The security team at a company has received reports from employees that the Wi-Fi disconnects intermittently. The team changes the WPA2 passkey and gives it to employees. However, rogue devices are detected on the Wi-Fi network within less than an hour of the passkey change. A security team performs a walkthrough of the office and is unable to find the rogue devices. Which of the following is the most likely root cause of the breach?
Answer: D
Keylogger is the most likely root cause of the breach.
The presence of rogue devices detected shortly after changing the WPA2 passkey suggests that the passkey was compromised prior to the change. A keylogger could have captured the previous passkey, allowing unauthorized devices to connect to the network.
A) Brute force
Brute force attacks involve systematically guessing passwords until the correct one is found. While it is a possible method for compromising a network password, the rapid detection of rogue devices after a passkey change indicates that the old passkey was likely obtained through a more discreet method, making this option less likely.
B) Trojan virus
A Trojan virus can provide unauthorized access to systems and networks; however, it does not specifically target Wi-Fi passkeys. The immediate appearance of rogue devices suggests a more direct method of acquiring the passkey, which a Trojan would not typically facilitate in this scenario.
C) Replay attack
A replay attack involves capturing and retransmitting data packets to gain unauthorized access. While this could potentially allow access to a network, the context indicates that the rogue devices appeared shortly after a passkey change, suggesting that the original passkey was compromised rather than being captured for replay.
D) Keylogger
A keylogger records keystrokes, which could easily capture the WPA2 passkey whenever it is entered. Given that rogue devices appeared so quickly after the passkey change, it is highly plausible that a keylogger was used to obtain the previous passkey, allowing unauthorized access to the network.
Conclusion
The keylogger is the most plausible explanation for the breach, as it directly corresponds with the timing and nature of the incident. Other options such as brute force, Trojan viruses, and replay attacks do not adequately explain how rogue devices could connect so quickly after a passkey change. Thus, the keylogger stands out as the root cause of the security issue.