A RADIUS shared secret between a municipal wireless controller and the AAA server is trivial to guess. What infrastructure hardening issue should be raised?
Select an answer to reveal the explanation.
Short Explanation
Modern AES on the air will not save you if the controller-to-RADIUS secret is 'password1.' That backend trust link still needs a strong shared secret.
Full Explanation
A trivial RADIUS shared secret between a municipal wireless controller and the AAA server is an infrastructure hardening issue because weak RADIUS shared secrets threaten backend trust even when air encryption looks modern. Weak secrets do not only affect guest captive portals; they can touch staff Enterprise paths that rely on the same authenticator-to-AAA channel. Weak secrets do not automatically upgrade all clients to EAP-TLS machine certificates. Weak secrets are not required for Protected Management Frames to negotiate successfully. Exam caveat: rotate and lengthen secrets, restrict RADIUS clients by IP, and protect management planes that can display secrets. Operational check: inventory civic RADIUS clients and secrets, replace trivial values, verify APs still authenticate users, and ensure secrets are not pasted into tickets or public wikis. For municipal and campus engagements, keep the finding language tied to authorized scope, name the building or SSID class affected, and state the residual risk to residents or staff if the rejected option had been chosen. Re-validate after the next change window that the selected control still matches inventory, monitoring, and RoE abort criteria used by the city wireless program.