On Monday, all company employees report being unable to connect to the corporate wireless network, which uses 802.1x with PEAP. A technician verifies that no configuration changes were made to the…

Account lockouts from excessive failed login attempts would affect individual users sporadically over time rather than simultaneously disabling all employees at the start of a new work week.

DNS server overload would degrade name resolution across all services and applications, not produce a failure isolated to 802.1x wireless authentication.

An IDS disabling the wireless network would constitute an operational state change and would typically generate alerts, which contradicts the technician's finding that no changes or outages were detected.

PEAP creates an encrypted TLS tunnel using a certificate presented by the RADIUS server before any inner authentication (such as MS-CHAPv2) occurs. If that certificate expired over the weekend, every wireless client would fail to validate the server identity and reject the connection, producing a sudden, organization-wide outage that coincides with no deliberate configuration changes - exactly matching the described scenario.