After suspicious Wi-Fi logins at city hall, investigators need evidence of who authenticated, when, and from which session. Which AAA function best supplies that telemetry?
Select an answer to reveal the explanation.
Short Explanation
Accounting is the AAA diary—who got on, when, and how long. That trail is what incident responders reach for after odd city-hall logins. Louder radios and nightly SSID renames do not build an audit trail.
Full Explanation
In municipal WLAN environments such as city hall, maintaining a robust audit trail of user authentication events is critical for security investigations and compliance. The AAA (Authentication, Authorization, and Accounting) framework plays a pivotal role in this context. Specifically, the accounting function within AAA is designed to record detailed telemetry about user sessions, including who authenticated, the exact timestamps of authentication, session duration, and associated device identifiers. These accounting records are typically stored on centralized AAA servers, such as RADIUS servers, which aggregate logs from multiple access points. This centralized logging enables investigators to reconstruct user activity accurately, correlate events across different network segments, and identify potential unauthorized access or suspicious behavior. Simply increasing the transmit power of access points citywide does not enhance logging or forensic capabilities; instead, it may exacerbate radio interference and degrade overall network performance without providing any audit data. Disabling RADIUS and allowing access points to make local authentication decisions removes centralized control and logging, severely limiting visibility into user sessions and hindering forensic investigations. This decentralization undermines the ability to generate comprehensive accounting records necessary for incident response. Renaming the SSID frequently is a superficial security measure that does not affect the underlying authentication or logging mechanisms; it neither prevents unauthorized access nor produces audit trails, making it ineffective for forensic purposes. It is essential to configure AAA accounting properly, ensuring that detailed session logs are securely collected and retained with integrity safeguards to prevent tampering or loss. Operationally, administrators should verify that AAA servers log all relevant session data, including user identities, authentication timestamps, session start and stop events, and device MAC addresses. These logs must be accessible and correlatable during incident response to provide a clear timeline and attribution of suspicious Wi-Fi logins at critical municipal facilities like city hall.