In a centrally switched deployment, the WLAN traffic is tunneled via CAPWAP from the AP to the WLC, where VLAN assignment occurs. To ensure that client devices are placed into the correct VLAN (in this case, VLAN 10), the WLAN policy profile must define the VLAN mapping. This allows the WLC to tag client traffic appropriately when forwarding to the upstream switch. Option C is correct because it configures the WLAN profile (policy profile) with VLAN 10, ensuring all clients associating with the WLAN are mapped to the proper VLAN automatically. Option A is incorrect because VLAN tagging is managed centrally on the WLC, and access ports at the AP are typically trunked or transparent in central switching mode. Option B is invalid; manually configuring VLAN on client devices is not feasible or scalable in enterprise deployments and does not integrate with CAPWAP central switching. Option D is also incorrect; relying on MAC-based redirection introduces complexity and is not standard practice for VLAN assignment in centrally switched networks. Cisco Wireless Core Technologies recommend using policy profiles to centrally enforce VLANs, simplifying management, ensuring security compliance, and supporting consistent enterprise Wi-Fi connectivity. Reference topics:Client Connectivity Configuration - VLAN assignment, WLAN policy profiles, centrally switched deployments, Cisco Catalyst 9800 WLC.

The correct answer is D. Cisco Spaces connector deployments often require a VLAN on which the connector is reachable for management or data, and Cisco Spaces wired gateway guidance identifies the connector VLAN as the VLAN used for communication to the connector. The same guidance also supports multiple source VLANs for monitored wired devices, which aligns with the requirement for future analytics-service scalability.
A trunk port is the proper design choice because it can carry multiple VLANs over the same physical interface. Cisco Catalyst switch documentation states that an access port carries traffic for only one VLAN, while an IEEE 802.1Q trunk carries multiple VLANs and supports tagged traffic. The command switchport trunk allowed vlan 30 limits the trunk initially to VLAN 30, satisfying the current management VLAN requirement without changing the native VLAN or other default VLAN settings. Cisco also documents that an allowed VLAN list limits VLAN membership only on the associated trunk port, so it does not affect other switch ports.
Option A works only for a single untagged VLAN and is less scalable. Options B and C mix access mode with trunk-only commands and are syntactically or operationally invalid. Reference topic: Wireless Monitoring and Management - Cisco Spaces connector deployment, VLAN reachability, trunking, and analytics service scalability.

The correct command isreceiver ip address 198.51.100.10 57555 protocol tls-native profile spaces- profilebecause it matches the Cisco IOS XE model-driven telemetry subscription syntax used on Catalyst
9800 controllers. Cisco documents the receiver statement under telemetry ietf subscription as receiver ip address ip-address receiver-port protocol protocol profile name, and describes it as the command that configures the receiver IP address, port, protocol, and profile for telemetry notifications.
In the exhibit, the subscription already defines the telemetry feed: encode-tdl encoding, a native stream, the TDL URI for ewlc/wlan_config, the WLC source address, and an on-change update policy. What is missing is the collector destination. For Cisco Spaces or Catalyst Center-style integrations, the WLC must know where to export telemetry and which secure transport profile to use. Cisco troubleshooting examples for Catalyst
9800 telemetry use the same command structure: receiver ip address X.X.X.X 25103 protocol tls-native profile ... under the telemetry subscription.
Options A, B, and D are invalid because they reorder the CLI keywords. IOS XE telemetry configuration is parser-order sensitive: the command begins with receiver ip address, followed by the receiver port, then protocol, then profile. Reference topic:Wireless Monitoring and Management - Catalyst 9800 streaming telemetry, Cisco Spaces integration, TLS transport, and telemetry receiver configuration.

Dynamic endpoint profiling in Cisco wireless networks is used to classify devices based on type, behavior, and attributes, enabling policy enforcement that adapts to device posture. In a deployment integrated with Cisco ISE, profiling groups are created to define rules and categories for device types such as smartphones, laptops, printers, and IoT devices. These profiling groups allow the wireless controller to map devices to the correct ISE policy sets dynamically, ensuring that security policies, VLAN assignments, and access controls are applied according to the device profile. Option A (device-type groups) is a generic categorization that does not fully leverage ISE dynamic profiling capabilities. Option C (user ID groups) focuses on user identity rather than device characteristics. Option D (endpoint group mapping) is typically applied after device profiling and classification, but initial enforcement requires creating profiling groups. By configuring profiling groups, the IT team ensures that the network can classify endpoints automatically, enforce access policies consistently, and integrate with ISE for context-aware security and compliance monitoring. Reference topics:Wireless Monitoring and Management - Dynamic endpoint profiling, Cisco ISE policy integration, profiling groups, device classification for secure access.

For configuring guest access on a Cisco Catalyst 9800 WLC using an external WebAuth server, the WLAN must be explicitly associated with the external server through a parameter map. The correct command syntax in Cisco IOS XE iswireless wlan < wlan-name > followed bysecurity web-auth external < parameter-map > .
This configuration links the WLAN to the external WebAuth server defined in the parameter map, allowing guests to be redirected to the portal for authentication. The parameter map (webauth-ext) contains details such as server IP, port, and other authentication parameters required for the external WebAuth interaction. Option B is incorrect because it improperly uses multiple WLAN names in one command, which is not valid syntax.
Option C usesparameter external security-map, which is invalid and does not associate the WLAN correctly with the WebAuth server. Option D incorrectly combines the security and parameter-map syntax and is not supported in IOS XE for external WebAuth. Cisco Wireless Core Technologies recommends this approach for centralized guest management, allowing consistent enforcement of guest policies, seamless authentication, and integration with external WebAuth servers across multiple WLANs and APs. Reference topics:Client Connectivity Configuration - WebAuth, external guest portal, WLAN parameter map configuration, Cisco IOS XE 17.x.