[ch3rn0byl]

If he wants to sniff the network so yes he will need the WPA/WPA2 key, you're right.
If he wants to do an MITM attack he will also need the WPA/WPA2 key to connect to it to do his MITM attack, you're right too.

The thing that made me think he is confusing about MITM and Evil Twin is that he wants to create a fake AP with the same ESSID that will allow him to sniff the victime

You can do an "Evil Twin" AP and MITM attack in the same "hack". The two are not mutually exclusive.

MITM is a technique used on a network to get between the victim and his destination. How that victim connects to the network is irrelevant. If you deauth someone and youve got an Evil Twin with a stronger signal that they auto-connect to with no passphrase then you can perform a MITM.

the OP's confusion is about the evil twin... how the victim would connect if the fake AP had a passphrase... but in reality this is irrelevant. the device will often connect automatically to any network it can with a strong signal.

So let's say I have everything set up, they're connected, and they are surfing the web...attempting mitm always...from my testing, kills the connection. I only tried a few tools like dsniff, ettercap, and arpspoof. With arpspoof though, from my testing, you can only spoof one way, and forget about sslstrip haha..it's dead. The connection always comes back up when those commands are terminated. I'm gonna try ferret and hamster and see if that'll work. Have you had that?