A county SOC notices bursts of failed 802.1X authentications against the city RADIUS cluster. Why should authentication-failure logging be prioritized?
Select an answer to reveal the explanation.
Short Explanation
A pile of Access-Rejects is not background noise—it can be someone stuffing passwords at the door. Keep the AAA failure trail in the SIEM. Throwing it away or calling it DFS will not catch the spray.
Full Explanation
Bursts of failed 802.1X authentications against the city RADIUS cluster should prioritize authentication-failure logging because aggregated AAA failure logs help detect credential stuffing or password spraying against the WLAN identity store. Wireless is an attractive password-guessing surface when PEAP or password methods exist. Civic SOCs that discard Access-Reject noise may miss an active attack on staff identities.
Treating failed EAP exchanges as proof of DFS radar events confuses AAA with spectrum management. Discarding auth failures to save SIEM license cost removes a high-value detection source. Mirroring RADIUS Access-Rejects only to guest captive portals for marketing is nonsensical.
Exam caveat: tune for volume—aggregate and threshold rather than alerting on every single reject from fat-fingered users. Operational check: generate controlled failed logins against a test account, confirm SIEM correlation alerts on spray-like patterns, and verify SOC runbooks include wireless AAA failure spikes. In municipal WLAN programs, capture the decision in the wireless standard and re-check it at change review so the next project inherits the same control bar instead of rediscovering the failure during an outage. In municipal WLAN programs, capture the decision in the wireless standard and re-check it at change review so the next project inherits the same control bar instead of rediscovering the failure during an outage.