An executive is unable to log in to their bank account from a hotel lobby.

This scenario is best described as an on-path attack. In an on-path attack, a malicious actor positions themselves between the user and the intended destination, allowing them to intercept, inspect, redirect, or modify traffic. The clue is that the banking web page looks different when the user is not using the VPN, but appears correctly and allows login when the VPN is enabled. A VPN encrypts traffic between the user’s device and the VPN endpoint, which helps prevent local network attackers from altering or reading the traffic.

The CompTIA Network+ N10-009 objectives include common network attacks such as on-path attacks, ARP poisoning, rogue access points, and evil twin attacks. ARP spoofing and ARP poisoning are techniques that can be used to create an on-path position on a local network, but the question describes the broader attack outcome rather than specifically proving ARP manipulation. An evil twin is a fake wireless access point that impersonates a legitimate one, but the question does not directly state that the user connected to a fake SSID. Therefore, on-path attack is the best answer.