The alternative targets configuration revision and approval history, where auditability requires associating control-plane changes with an identity, time, reason and prior state, not just the new value. It does not establish the intended network asset lifecycle behavior described in the scenario.

API access is a privileged operational interface; overbroad or leaked tokens can compromise configuration and monitoring data. Use narrowly authorized API credentials and protect their storage and renewal lifecycle. would address REST API authentication boundaries, but the reported facts instead point to network asset lifecycle. That change would leave the actual requirement unresolved.

That action—Compare effective device configuration with Central intent and reconcile approved local overrides—is relevant to config drift after manual overrides. Undocumented differences make subsequent upgrades and incident response unpredictable because the managed baseline is no longer authoritative. It does not correct the observed network asset lifecycle condition.

The alternative targets peak WLAN concurrency, where RF coverage establishes reception, whereas channel contention and client airtime demand govern usable capacity in dense spaces. It does not establish the intended critical application traffic profile behavior described in the scenario.

Aggregate access capacity, application demand and supported congestion tolerance determine uplink sizing; port counts alone do not. Model oversubscription and dimension distribution uplinks for peak traffic patterns. would address uplink bandwidth capacity, but the reported facts instead point to critical application traffic profile. That change would leave the actual requirement unresolved.

That action—Define outage constraints, prerequisites, rollback triggers and restoration steps before deployment—is relevant to change-window and rollback requirements. A planned change must include dependencies and a reversible path because a correct configuration can still disrupt business services during transition. It does not correct the observed critical application traffic profile condition.

The alternative targets interference spectrum diagnosis, where non-802.11 emitters can occupy channel energy without appearing as normal Wi-Fi neighbors; channel changes or source mitigation need measured evidence. It does not establish the intended client experience versus device uptime behavior described in the scenario.

Right-sized operation reduces unnecessary resource use, but energy or capacity savings must not remove availability when users actually need the network. Adjust supported power or capacity policies according to measured usage while preserving peak service requirements. would address energy and utilization efficiency, but the reported facts instead point to client experience versus device uptime. That change would leave the actual requirement unresolved.

That action—Refresh LAN and WLAN baselines when demand, topology or application requirements materially change—is relevant to periodic baseline refresh. A fixed historical baseline can become misleading as workload mix and client capability change; thresholds should reflect current accepted operating conditions. It does not correct the observed client experience versus device uptime condition.

That result—The revised performance baseline includes recent peak usage and documented changes to client mix, application load and network capacity—concerns periodic baseline refresh. A fixed historical baseline can become misleading as workload mix and client capability change; thresholds should reflect current accepted operating conditions. It can be healthy even while the current failure recovery time objective problem remains.

This would validate client experience versus device uptime, not failure recovery time objective. Infrastructure availability is necessary but not sufficient for usable service; end-to-end user journeys expose service dependencies beyond device health. It is therefore insufficient acceptance evidence for the reported condition.

Fast reliable handoff requires compatible client capabilities, adequate AP overlap and secure authentication continuity rather than just increasing bandwidth. The indicated result—a walk test records acceptable handoff delay and voice packet loss under normal movement paths—checks a different mechanism and would not confirm the required failure recovery time objective outcome.

That action—Choose antenna pattern and placement for the coverage geometry and client distribution—is relevant to directional antenna selection. Directional gain shapes energy into target areas and can reduce unwanted spill, but a poorly aimed directional antenna creates coverage holes elsewhere. It does not correct the observed high-density channel-width choice condition.

A reliable voice WLAN needs usable signal and timely authentication/roaming behavior between neighboring cells, not maximum isolated AP range. Design cell overlap and roaming characteristics to support application handoff requirements. would address roaming voice coverage overlap, but the reported facts instead point to high-density channel-width choice. That change would leave the actual requirement unresolved.

The alternative targets poE budget planning, where available port count does not establish available power; a switch can have free interfaces while its aggregate PoE budget is exhausted. It does not establish the intended high-density channel-width choice behavior described in the scenario.

Endpoints without a supported supplicant need a deliberate alternative classification mechanism, not general unrestricted VLAN access. The indicated result—the registered device receives its restricted role and unregistered devices remain blocked or quarantined—checks a different mechanism and would not confirm the required RF interference and retries outcome.

This would validate AP radio disabled or unsupported channel, not RF interference and retries. Cloud device online status does not prove every radio is active or that target clients can discover the selected channel. It is therefore insufficient acceptance evidence for the reported condition.

That result—The guest device reliably reaches the portal and receives only its intended post-login access—concerns captive portal redirect fault. A guest can associate and receive a lease without completing the portal flow; redirect and pre-auth policy must permit necessary portal dependencies. It can be healthy even while the current RF interference and retries problem remains.

VSX peers retain independent control planes and only designated supported feature sets synchronize; unchecked settings may diverge. The indicated result—both VSX peers display expected synchronized state and intentional independent routing configurations remain correct—checks a different mechanism and would not confirm the required LACP bundled links outcome.

This would validate VRF route-context configuration, not LACP bundled links. Routes and interfaces are looked up within the relevant VRF; a default route in a different table cannot repair a missing path. It is therefore insufficient acceptance evidence for the reported condition.

That result—The relay forwards requests to the approved DHCP service and clients receive leases in the correct subnet—concerns DHCP relay on routed segments. Layer 3 boundaries do not normally forward client DHCP broadcasts without relay behavior; the helper target must also be reachable. It can be healthy even while the current LACP bundled links problem remains.

That result—The intended radio advertises the configured SSID on a permitted channel visible to supported test clients—concerns AP radio disabled or unsupported channel. Cloud device online status does not prove every radio is active or that target clients can discover the selected channel. It can be healthy even while the current wireless DHCP failure stage problem remains.

A successful authentication indicates identity acceptance, while authorization attributes and local mapping determine permitted services. The indicated result—the client session reports the approved role and positive/negative application tests match that role's permissions—checks a different mechanism and would not confirm the required wireless DHCP failure stage outcome.

This would validate IPv6 router-advertisement spoofing, not wireless DHCP failure stage. IPv4 ARP safeguards do not inspect ICMPv6 router announcements; RA protection constrains unauthorized router information on client segments. It is therefore insufficient acceptance evidence for the reported condition.

This would validate wrong Central scope override, not RADIUS accounting versus authorization. Scoped configuration precedence can explain isolated divergence; changing the shared profile again can unintentionally impact healthy devices. It is therefore insufficient acceptance evidence for the reported condition.

That result—Test rogue advertisements are blocked while approved router advertisements continue to reach clients—concerns IPv6 router-advertisement spoofing. IPv4 ARP safeguards do not inspect ICMPv6 router announcements; RA protection constrains unauthorized router information on client segments. It can be healthy even while the current RADIUS accounting versus authorization problem remains.

OSPF requires compatible area identity, network type and essential adjacency parameters; IP reachability alone does not establish a neighbor. The indicated result—both peers enter Full adjacency and exchange the expected route information—checks a different mechanism and would not confirm the required RADIUS accounting versus authorization outcome.

The alternative targets central device inventory onboarding, where a functioning Ethernet link does not establish cloud-management ownership; onboarding requires the correct device identity, management association and supported connectivity. It does not establish the intended SVI inter-VLAN gateway behavior described in the scenario.

That action—Enable suitable BPDU protection on ports intended only for endpoints—is relevant to BPDU Guard at edge ports. Edge ports should not accept topology-control messages from unauthorized bridges; BPDU Guard can protect the switching domain by restricting offending links. It does not correct the observed SVI inter-VLAN gateway condition.

Client frames received untagged are placed in the port's access VLAN; a healthy physical link cannot compensate for wrong Layer 2 membership. Assign the correct access VLAN and verify the port's effective untagged membership. would address access port VLAN membership, but the reported facts instead point to SVI inter-VLAN gateway. That change would leave the actual requirement unresolved.

That action—Check SSID client-isolation policy before changing routes or AP power—is relevant to client isolation and peer access. Client isolation can intentionally prevent peer-to-peer wireless communication despite successful association, addressing and external reachability. It does not correct the observed IPv6 router-advertisement spoofing condition.

A configured SVI cannot act as the client gateway without operational Layer 2 underlay and correct interface state. Check VLAN operational state and active interface membership when an SVI is down. would address SVI down due to VLAN state, but the reported facts instead point to IPv6 router-advertisement spoofing. That change would leave the actual requirement unresolved.

The alternative targets firmware-induced configuration drift, where successful reboot and version display do not establish that all intended policies and interface behaviors survived the change. It does not establish the intended IPv6 router-advertisement spoofing behavior described in the scenario.