In a Cisco Wireless LAN Controller (WLC), AP groups are used to manage the distribution of WLANs to different access points (APs). By configuring AP groups, an engineer can specify which WLANs are broadcasted by which APs. This allows for the creation of multiple WLANs across different APs without the need to create new interfaces for each WLAN. AP groups provide the flexibility to control WLAN availability based on location or other criteria, ensuring that only the intended WLANs are available through specific APs.

The Cisco OfficeExtend Access Point (OEAP) feature is enabled on a Cisco Catalyst 9800 Series Wireless Controller through the Flex Profile. The Flex Profile allows for the configuration of various settings specific to FlexConnect deployments, including OEAP settings, which enable remote workers to connect to the corporate network securely.
References :=
* CCNP Enterprise Wireless Design ENWLSD 300-425 and Implementation ENWLSI 300-430 Official Cert Guide
* Cisco documentation on Catalyst 9800 Series Wireless Controllers

The Simple Certificate Enrollment Protocol (SCEP) is used to securely issue certificates to network devices in a scalable manner. When provisioning certificates on a Cisco Catalyst 9800 Series Wireless Controller using a third-party CA server, SCEP is the protocol that facilitates this process. It allows the controller to request and install certificates automatically, which is essential for establishing secure communications within the network. References := (CCNP Enterprise Wireless Design ENWLSD 300-425 and Implementation ENWLSI
300-430 Official Cert Guide)
Reference: https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/trustpoints/b- configuring-trustpoints-on-cisco-catalyst-9800- series-controllers/c-workflow-to-configure-a-trustpoint-for-a- third-party-certificate-on-catalyst-9800.html

mDNS has specific restrictions regarding its configuration. Option C is correct because mDNS is not supported on FlexConnect APs with a locally switched WLAN, which limits its deployment in certain network designs. Option D is also correct; the controller software must be newer than version 7.0.6 to support mDNS features, which means that older controller software versions do not have the necessary capabilities to handle mDNS. References: CCNP Enterprise Wireless Design ENWLSD 300-425 and Implementation ENWLSI 300-430 Official Cert Guide

EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) is an EAP method that an Access Point (AP) can use to authenticate to the wired network. EAP-TLS is considered one of the most secure EAP methods because it uses mutual authentication, where both the client and the server authenticate each other using certificates.