To enforce adaptive policies based on user identity, device posture, and provide comprehensive visibility into device activity and location, Cisco recommends integrating Cisco Catalyst Center, Cisco ISE, and Cisco Spaces. Cisco ISE provides identity-based access control and posture assessment, allowing dynamic policy enforcement for users and devices. Mobile device management integration further extends posture checks for endpoint compliance. Cisco Catalyst Center enables real-time assurance and monitoring of network performance, device activity, and service health, while Cisco Spaces provides location analytics and visibility of client devices across the wireless environment.

The correct configuration is option C because Cisco IOS XE restricts inbound protocols on VTY lines with the transport input command. Cisco's Catalyst 9800 best-practice guidance states that administrators should confirm SSH is enabled and Telnet is disabled for better controller security, and that the Catalyst 9800 follows standard Cisco IOS XE behavior for enabling or disabling Telnet and SSH. Cisco IOS XE SSH documentation explicitly shows line vty line_number
[ending_line_number] followed by transport input ssh, and explains that this prevents non-SSH Telnet connections, limiting access to SSH only.
The existing exhibit already includes the SSH prerequisites: hostname, domain name, RSA key generation, AAA new-model, a default login method using local credentials, and a local privileged user. The missing VTY configuration must therefore apply that default AAA login list to the VTY lines with login authentication default and restrict inbound transport to SSH. Cisco AAA documentation confirms that login authentication default applies the configured default authentication list to the line or set of lines. Option A is incomplete and does not explicitly permit SSH. Option B uses invalid syntax. Option D omits the required input keyword.

For campus wireless monitoring deployments involving Cisco Spaces, ISE, and Catalyst Center appliances, strict separation of management traffic from user data is required to maintain security and service continuity. The correct approach is to configure the switch interfaces connecting these appliances as access ports assigned to the dedicated management VLAN. This ensures that management and telemetry traffic is isolated from production WLAN traffic, preventing any disruption to end users if configuration changes are made.

The correct authentication method is EAP-TLS. WPA2-Enterprise uses 802.1X/EAP authentication rather than a pre-shared key, and the supplicant, authenticator, and RADIUS authentication server participate in the enterprise authentication exchange. Cisco documentation states that in enterprise WPA/WPA2 operation, 802.1X/EAP is used for authentication and provides strong authentication between the client and authentication server.
The decisive requirement in the question is certificate-based mutual authentication requiring both client and server certificates. Cisco explicitly describes EAP-TLS as requiring both server-side and client-side certificates, while PEAP requires only a server-side certificate and normally authenticates the client with password-based credentials inside the protected tunnel. Cisco Secure ACS documentation also states that EAP-TLS uses the certificates of the authentication server and the end-user client, enforcing mutual authentication.

Optimized roaming is a Cisco WLC feature designed to reduce sticky-client behavior. A sticky client remains associated to an AP even after moving far enough away that another AP would provide better RF service. Cisco describes optimized roaming as actively monitoring client data RSSI and disconnecting clients when received signal strength falls below the configured threshold. The official Catalyst 9800 documentation states that optimized roaming "disassociates client when the RSSI is lower than the set threshold," which directly matches option A.
This function does not calculate device location through peer-to-peer beaconing, does not depend on external experience services, and is not static load balancing. It is an RF/client- roaming enforcement mechanism controlled by the wireless infrastructure. In practical operation, the AP/WLC evaluates client signal quality and, when the configured optimized roaming criteria are met, forces the client to disconnect so it can reassess the RF environment and roam to a better AP. Cisco also notes that optimized roaming helps maintain client connectivity by managing disassociationn based on RSSI and data-rate thresholds.