A city SOC plans to correlate wireless recon results with DHCP logs after a campus survey. What is the primary benefit of that multi-source approach?
Select an answer to reveal the explanation.
Short Explanation
RF eyes see the air; DHCP sees who got an address on the wire. Put both lists together and the city's inventory stops guessing which laptop belongs to which AP. One source alone leaves holes.
Full Explanation
Correlating wireless recon results with DHCP logs after a campus survey primarily improves accuracy of the municipal wireless inventory: RF data shows BSSIDs, SSIDs, and on-air clients, while DHCP logs show which addresses and hostnames actually obtained leases on city networks. Multi-source correlation reduces blind spots neither source covers alone. Saying DHCP logs replace the need for any RF survey fails by concept: DHCP misses RF-only details such as neighboring SSIDs, channels, and crypto advertisements. Claiming correlation proves every neighboring SSID belongs to the city and is in scope fails by concept: logs do not expand ownership of foreign SSIDs. Asserting DHCP exports contain complete EAPOL handshakes for offline PSK testing fails by concept: lease tables are not 4-way handshake captures. Exam caveat: DHCP logs hold personal identifiers—handle them under civic privacy rules when joining tables to MAC/probe data. Operational check: export authorized DHCP leases for the survey window, join on MAC where possible to RF station lists, reconcile unknown wireless devices, and update the municipal inventory with both RF and lease evidence. In civic practice, write the decision and the verification command into the engagement notes so another assessor can repeat the check on the next shift without rediscovering the same pitfall under time pressure.