The city’s SIEM correlates repeated RADIUS rejects from one wireless MAC with physical door-badge misuse events for the same employee badge ID. What detection capability does this illustrate?
Select an answer to reveal the explanation.
Short Explanation
Wi-Fi saying “no” over and over while the badge reader also screams is the SIEM connecting dots humans might miss. That cross-signal view catches credential abuse better than RF noise alone. Turning accounting off would blind you.
Full Explanation
When the city’s SIEM correlates repeated RADIUS rejects from one wireless MAC with physical door-badge misuse events for the same employee badge ID, the detection capability illustrated is centralized monitoring that correlates AAA failures with other events to detect WLAN credential abuse. Cross-domain correlation elevates what might look like routine wireless auth noise into a coherent insider or stolen-credential investigation. Standalone spectrum analysis without any log correlation cannot link badge misuse to RADIUS rejects. Relying only on end-user verbal reports of slow downloads misses systematic abuse signals. Disabling AAA accounting to reduce SIEM license cost removes the telemetry required for this detection. Municipal environments that join physical access control and WLAN AAA in one SOC workflow gain earlier warning of credential misuse across buildings. Exam caveat: correlation quality depends on reliable identity keys (MAC, username, badge ID) and time synchronization across wireless and physical systems. Operational check: verify RADIUS accounting reaches the SIEM, normalize badge and wireless usernames, build or tune a correlation rule for repeated wireless rejects plus badge anomalies, and tabletop the escalation path with physical security for courthouse or city-facility incidents.