AP Cybersecurity Drill 3: Public Wi-Fi and Targeted Smishing

Question 1. Which of the two visible networks poses the greater risk, and why?

• A) Tindel-Guest, because a counter-posted password is something nearby strangers might also misuse
• B) Both networks are equally safe to use, since the two of them share the same coffee shop's name
• C) Neither of the two networks poses any meaningful risk to her as long as she is only using a phone under this attack scenario
• D) Tindel Free WiFi, because an open look-alike network may be a rogue access point set up to intercept ✓

Explanation: Choice D is correct. An open network using a look-alike name may be a rogue access point an attacker set up to intercept traffic, which makes the open Tindel Free WiFi the greater risk. Choice A is incorrect. A posted password on the staffed guest network is normal practice and is more protected than the open network. Choice B is incorrect. Sharing the shop's name does not make a network safe; attackers copy real names on purpose. Choice C is incorrect. Using a phone does not remove the risk of joining an attacker-controlled network.

Question 2. The polished wording, use of Priya's first name, and the exact shop name are most consistent with which description of the text message?

• A) A harmless automated purchase receipt that the coffee shop itself sent to her phone
• B) A targeted smishing message that AI tools can make more polished and personalized ✓
• C) A routine network-outage notification sent to her by her own mobile phone carrier
• D) A legitimate bank fraud alert that she should simply approve by replying YES to it

Explanation: Choice B is correct. A scam text aimed at a specific person is smishing, and AI tools can make such messages more polished and personalized, which fits the tailored wording here. Choice A is incorrect. The message demands action on a charge through an outside link, which is not a harmless receipt. Choice C is incorrect. It concerns a card charge, not a network outage, so it is not a carrier notice. Choice D is incorrect. Replying YES to an unverified text is exactly the trap; a real alert can be confirmed through the bank directly.

Question 3. What is the safest immediate way for Priya to handle the text message?

• A) Ignore the text's link and call the bank using the number printed on the back of her card ✓
• B) Reply YES to the text so that the bank will go ahead and cancel the suspicious card charge
• C) Tap the link in the message to read more details about the charge before she decides anything
• D) Forward the text to the coffee shop's staff so that they can confirm the card charge for her

Explanation: Choice A is correct. Even if a charge alert could be real, the safe path is to ignore the message's link and reply path and contact the bank through the number on the card, a channel she knows is genuine. Choice B is incorrect. Replying YES acts on the attacker's instructions and can confirm her number is active. Choice C is incorrect. Tapping the link can lead to a credential-harvesting or malicious page. Choice D is incorrect. Coffee shop staff cannot verify her bank account, so forwarding the text does not help.

Question 4. If Priya connects to the open look-alike network and logs into a site over an unencrypted connection, what is the main risk?

• A) The connection on that network will simply run a little slower than the shop's official network
• B) Her device will then be permanently barred from ever rejoining the real network in the future
• C) An attacker running the network could capture the data she sends, including her login information ✓
• D) Her recent browsing history would be automatically published in public to all the other shop customers

Explanation: Choice C is correct. On an attacker-controlled network, traffic sent without encryption can be read by whoever runs the network, so her login information and other data could be captured. Choice A is incorrect. Slower speed is a performance issue, not the security risk that matters here. Choice B is incorrect. Joining a rogue network does not permanently ban her device from the real one. Choice D is incorrect. The risk is interception by the attacker, not automatic public posting of her history.

Question 5. Which habit would best reduce Priya's risk the next time she works on public Wi-Fi?

• A) Always connect to whichever available network happens to be showing the strongest wireless signal
• B) Trust any password-protected network as long as the network's name happens to include the coffee shop's name
• C) Confirm the official network name with staff and use a VPN or cellular data for any sensitive tasks ✓
• D) Trust any open network whose name includes the shop's name without first checking with the staff

Explanation: Choice C is correct. Verifying the correct network name with staff and using a VPN or cellular data for sensitive work protects her even on networks she cannot fully trust. Choice A is incorrect. Signal strength says nothing about whether a network is safe; a rogue network can have a strong signal. Choice B is incorrect. A matching name and a password do not prove a network is the shop's, since names can be copied. Choice D is incorrect. Trusting a network just because the name matches is what the rogue access point relies on.