Question 25

A deauthentication attack is most likely being carried out.

The logs indicating a spike in deauthentication frames not originating from the access point suggest that an attacker is disrupting the connection between the users' devices and the Wi-Fi. This is characteristic behavior of a deauthentication attack.

A) Eavesdropping

Eavesdropping involves intercepting and monitoring communication over a network without the knowledge of the parties involved. While it is a security concern for wireless networks, it does not relate to the disconnection issue described. Therefore, this option is incorrect.

B) Deauthentication attack

A deauthentication attack specifically targets the Wi-Fi connection by sending deauthentication frames to disconnect users from the network. The symptoms described in the scenario, particularly the logs of increased deauthentication frames, directly indicate that this type of attack is occurring, making it the correct choice.

C) Rogue access point

A rogue access point is an unauthorized access point that can be set up to intercept data or facilitate attacks. While it poses a security risk, it does not inherently cause disconnections like the scenario describes. Thus, this option is not correct.

D) War driving

War driving involves driving around to locate and map wireless networks, typically for the purpose of identifying vulnerable networks. This activity does not cause disconnections or generate deauthentication frames, making this option irrelevant to the problem at hand.

Conclusion

The evidence of increased deauthentication frames clearly points to a deauthentication attack as the cause of the users' disconnection issues. Other options, such as eavesdropping, rogue access points, and war driving, do not align with the symptoms observed and can be ruled out. Thus, option B is definitively the correct answer.