Where would an administrator define the split-tunneling mode for a RAP located at a branch office?

What is true about Aruba controllers under normal operations in a Mobility Master (MM)-Mobility Controller (MC) architecture?

An administrator configures a port on a RAP through the association of an AAA profile with 802.1X authentication to a RAP Ethernet port. This port connects to a switch with user desktops attached. The administrator notices that when users connect wirelessly to the RAP, a user role correctly restricts their traffic.
But, when users connect with their wired desktops, they are assigned an initial role and routed to a Captive Portal page.
What must the administrator do to enable desktop usage based on the user's role assignment?

Refer to the exhibit.

An administrator configures a policy for an AP Group. Port 3 of a RAP is a trunkthat connects to a switch at a branch office. VLAN 1 is untagged and VLANs 10 (for data) and 11 (for voice) are tagged. The administrator applies an ACL inbound on Port 3 of the RAP.
How does this configuration affect traffic on Port 3?

Refer to the exhibit.

What can be determined from the command output shown in the exhibit?