A county SOC notices bursts of failed 802.1X authentications against the city RADIUS cluster. Why should authentication-failure logging be prioritized?
Select an answer to reveal the explanation.
Short Explanation
A pile of Access-Rejects is not background noise—it can be someone stuffing passwords at the door. Keep the AAA failure trail in the SIEM. Throwing it away or calling it DFS will not catch the spray.
Full Explanation
Monitoring AAA authentication failures is a key WLAN security-operations control. Patterns of rejects can indicate credential stuffing or password spraying against RADIUS-backed directories. Discarding failures, misattributing them to DFS, or forwarding rejects to marketing portals removes that detection capability.