A city WLAN team sees WIPS alerts, RADIUS rejects, and switchport flapping but they live in separate consoles. Which monitoring approach best correlates those events centrally?
Select an answer to reveal the explanation.
Short Explanation
Separate consoles are like three city radios that never talk to dispatch. SIEM is the shared desk that lines WIPS RF alerts up with RADIUS and switchport clues. Without that correlation, you chase ghosts in three different windows.
Full Explanation
When WIPS alerts, RADIUS rejects, and switchport flapping live in separate consoles, analysts cannot efficiently correlate RF threats with identity and wired attachment events across the city WLAN. Feeding those log sources into a SIEM provides a central correlation point so municipal responders see RF, AAA, and switch context together and can open actionable tickets. Relying only on each AP’s local LED status lights ignores RADIUS and switch evidence and does not scale. Disabling WIPS alerting and waiting for end-user outage tickets sacrifices proactive detection. Replacing SIEM with a shared guest PSK so authentication failures never appear removes visibility and weakens authentication rather than improving monitoring. Exam caveat: SIEM correlation complements—not replaces—WIPS sensors; centralized monitoring is a CWSP network-monitoring objective that still depends on quality of source feeds and tuned use cases. Operational check: confirm WIPS, RADIUS, and switch syslog/CEF feeds reach the SIEM, build a correlation rule for concurrent rogue-like RF events plus port flaps, and test with a controlled authorized event that a municipal analyst can see end-to-end. Document the data sources in the city monitoring runbook so weekend on-call staff know where to pivot.