The city’s SIEM correlates repeated RADIUS rejects from one wireless MAC with physical door-badge misuse events for the same employee badge ID. What detection capability does this illustrate?
Select an answer to reveal the explanation.
Short Explanation
Wi-Fi saying “no” over and over while the badge reader also screams is the SIEM connecting dots humans might miss. That cross-signal view catches credential abuse better than RF noise alone. Turning accounting off would blind you.
Full Explanation
SIEM and centralized monitoring detect WLAN attacks by correlating AAA/RADIUS failures, anomalous MACs, and non-wireless signals such as physical access misuse. Credential-stuffing or stolen-badge scenarios may not produce dramatic RF signatures, so multi-source correlation is a Domain 2 detection method. Isolating spectrum tools alone would miss this pattern.