To enable WPA2-Enterprise with RADIUS authentication on a Cisco Catalyst 9800 WLC, the WLAN configuration must specify the use of 802.1X as the authentication mechanism. The commandsecurity wpa wpa2 akm dot1xexplicitly instructs the WLAN to use WPA2 encryption with the 802.1X authentication key management (AKM), which leverages the configured RADIUS server group for client authentication. Option B (security dot1x authentication-list) and Option C (security dot1x method-list) are legacy or IOS-style commands that define AAA method lists but do not directly bind the WLAN to WPA2-Enterprise security.
Option A (security wpa enable) only enables WPA but does not define the authentication mode or RADIUS integration, which is insufficient for WPA2-Enterprise deployments. Cisco Wireless design guides emphasize that for staff or enterprise-class WLANs using external RADIUS servers, the WLAN's security profile must use WPA2 with AKM set to 802.1X. This ensures clients perform EAP authentication with the external server, supporting secure credential exchange and proper authorization. Correctly applyingsecurity wpa wpa2 akm dot1xin the WLAN configuration guarantees the WLC enforces encryption and authentication policies in line with enterprise security requirements. Reference topics:Client Connectivity Configuration - WPA2- Enterprise, 802.1X, AKM, RADIUS integration on Cisco WLCs.

The correct answer isline-of-sight. In RF terminology, line-of-sight describes a wireless path where the transmitting antenna and receiving antenna have an unobstructed visual or RF path between them. Cisco's RF power documentation defines this directly: antennas that can see each other without obstacles between them are considered to be in line of sight. This is especially important in outdoor, bridge, mesh, and point-to-point wireless designs, where buildings, terrain, foliage, or other obstructions can degrade or block the RF path.
The other options describe different RF behaviors.Attenuationis signal loss as RF energy travels through free space, cables, walls, or other materials.Reflectionoccurs when RF energy bounces off a surface such as metal, glass, or concrete, often contributing to multipath.Beamformingis an antenna/transmission technique that focuses RF energy toward a client or receiver to improve signal quality; it is not the condition of having no obstacles. Cisco mesh planning guidance also emphasizes verifying whether a wireless link has clear line of sight before deployment, reinforcing that LOS is a path condition, not a modulation or security feature.
Reference topic:RF Fundamentals - RF propagation, path loss, line-of-sight, obstruction effects, and wireless link planning.

Optimized roaming is a Cisco WLC feature designed to reduce sticky-client behavior. A sticky client remains associated to an AP even after moving far enough away that another AP would provide better RF service.
Cisco describes optimized roaming as actively monitoring client data RSSI and disconnecting clients when received signal strength falls below the configured threshold. The official Catalyst 9800 documentation states that optimized roaming "disassociates client when the RSSI is lower than the set threshold," which directly matches option A.
This function does not calculate device location through peer-to-peer beaconing, does not depend on external experience services, and is not static load balancing. It is an RF/client-roaming enforcement mechanism controlled by the wireless infrastructure. In practical operation, the AP/WLC evaluates client signal quality and, when the configured optimized roaming criteria are met, forces the client to disconnect so it can reassess the RF environment and roam to a better AP. Cisco also notes that optimized roaming helps maintain client connectivity by managing disassociationn based on RSSI and data-rate thresholds. Reference topics:Client Connectivity Configuration - client roaming behavior, sticky-client mitigation, RSSI thresholds, and WLC roaming optimization

The log is a Layer 2 802.1X authentication failure, not an AP join or WLAN encryption mismatch. In WPA3- Enterprise, the client authenticates with 802.1X/EAP through the configured AAA path. Cisco's Catalyst
9800 WPA3 Enterprise configuration requires the necessary RADIUS or AAA servers and authentication lists before enabling WPA3 Enterprise, and the WLAN must reference the dot1x authentication list. Therefore, aCred Failreason points directly at the user/device credential validation path: the supplicant credentials, Active Directory identity source, RADIUS policy match, or RADIUS reachability.
Cisco's 9800 802.1X configuration workflow also shows the controller defining a RADIUS server, adding it to a RADIUS group, creating a dot1x AAA authentication method list, and applying that list to the WLAN. It further recommends checking whether the RADIUS server is alive and using ISE RADIUS Live Logs to inspect authentication requests and results. Option A is wrong because the AP is not the supplicant in this WLAN client authentication event. Option B downgrades the security model and avoids 802.1X rather than fixing it. Option D addresses NAC behavior, not a credential authentication failure. Reference topics:Client Connectivity Configuration - WPA3-Enterprise, 802.1X/EAP, RADIUS authentication, and client authentication troubleshooting.

The switch interfaces connected to the APs must be configured as 802.1Q trunk ports. The requirement states that AP management and guest Wi-Fi traffic must remain separate, and additional VLANs for IoT and voice are expected. An access port supports only one VLAN, so it cannot scale for multiple locally tagged client VLANs. Cisco's Catalyst AP guidance states that when multiple VLANs are used for client traffic, the AP switch port should trunk the VLANs, and management traffic is untagged; when a management VLAN is used, it should be configured as the native VLAN on the switch port. Cisco's Catalyst 9800 FlexConnect documentation also shows the AP connected to a trunk port with a native VLAN for AP IP connectivity and a separate VLAN for locally switched client traffic.
Option C is therefore correct: configure a trunk, set the AP management VLAN as native, and restrict the allowed VLAN list to only required management and client VLANs such as guest, IoT, and voice. This supports segmentation and prevents unnecessary internal VLAN exposure. Reference topics:AP switch-port design, 802.1Q trunks, native VLANs, client VLAN tagging, FlexConnect/local switching, and guest traffic segmentation.