Users are reporting that an unsecured network is broadcasting with the same name as the normal wireless network. They are able to access the internet…

This scenario describes a classic "evil twin" attack, which uses a rogue wireless access point. The attacker sets up an AP with the same SSID as a legitimate, trusted network but with weaker or no security. Unsuspecting users connect to it, allowing the attacker to intercept their traffic. The ability to access the internet but not internal corporate resources (like file shares) is a key indicator, as the rogue AP is connected to the internet but not to the secure internal corporate LAN.

A. An unreachable DNS server would typically prevent internet browsing by domain name, which contradicts the scenario where users can access the internet.

B. A VLAN misconfiguration is an internal network setup error and would not explain the appearance of a new, unsecured wireless network.

C. An incorrect IP address is a symptom of connecting to the rogue network (which likely has its own DHCP server), but the root cause is the rogue AP itself.

1. National Institute of Standards and Technology (NIST). (2012). Special Publication 800-153: Guidelines for Securing Wireless Local Area Networks (WLANs). Section 3.1.1, "Rogue Access Points," describes how unauthorized APs can be used to bypass network security and how "evil twins" specifically mimic legitimate APs to steal credentials or launch man-in-the-middle attacks.

2. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. Chapter 8, "Security in Computer Networks," discusses Wi-Fi security threats, including rogue access points used in "evil twin" attacks to trick users into connecting to a malicious network.

3. Stallings, W. (2017). Cryptography and Network Security: Principles and Practice (7th ed.). Pearson. Chapter 17, "Wireless Network Security," details various attacks on wireless networks, including the rogue access point and man-in-the-middle attacks facilitated by mimicking a legitimate SSID.