A security analyst finds a rogue device during a monthly audit of current endpoint assets that are connected to the network. The corporate network utilizes 802.1 X for access control. To be allowed on the network, a device must have a known hardware address, and a valid username and password must be entered in a captive portal. The following is the audit report:

Which of the following is the most likely way a rogue device was allowed to connect?

A. A user performed a MAC cloning attack with a personal device.

B. A DHCP failure caused an incorrect IP address to be distributed

C. An administrator bypassed the security controls for testing.

D. DNS hijacking let an attacker intercept the captive portal traffic.





 

Correct Answer: A

This question is in SY0-601 exam
For getting CompTIA Security+ certificate