With the implementation of a BYOD policy, the security director should be concerned about malware and lost and stolen devices. Malware can compromise the corporate network if infected devices connect to it. Lost and stolen devices pose a risk of unauthorized access to corporate data and resources, potentially leading to data breaches.

When IGMP snooping is enabled, multicast traffic is sent only to the ports which sent IGMP joins.
If IGMP snooping is disabled, then traffic is flooded to all the ports in that VLAN.

Differentiated Services Code Point (DSCP) is the trust model that must be configured on the switch ports to which the APs are connected in local mode. This is because DSCP provides a way to classify and manage network traffic and to provide QoS. DSCP can be trusted on the switch port, and the AP can then mark the packets with the appropriate DSCP value, which will be retained across the network.

Multicast-direct requires the AP's management VLAN to receive the multicast stream; enable multicast routing on VLAN 210 so the AP can join and receive the group.
IGMP must be enabled end-to-end so joins from the AP reach the source and multicast forwarding is established.

To meet the requirement of allowing employees to easily onboard their personal devices and visitors to connect without reception desk intervention, configuring a self-registration guest portal on Cisco ISE is the appropriate solution. This feature enables guests to create their own accounts and gain network access, streamlining the process for both employees' personal devices and visitors.