That action—Plan an RF site survey that incorporates floor materials, interference and required client behavior—is relevant to RF survey and building materials. Propagation and attenuation vary with walls, shelving and device environments; a diagram alone cannot establish coverage or service quality. It does not correct the observed acceptance of WLAN security and mobility condition.

EAP-TLS authenticates with certificates, so healthy network transport alone cannot correct absent trust, expired credentials or unmanaged key lifecycle. Include client/server certificate issuance, trust, expiry and revocation in the EAP-TLS design. would address EAP-TLS certificate lifecycle, but the reported facts instead point to acceptance of WLAN security and mobility. That change would leave the actual requirement unresolved.

The alternative targets low-level port map, where physical installation and initial configuration depend on explicit interface-level intent; ambiguities produce swapped services or accidental trunk exposure. It does not establish the intended acceptance of WLAN security and mobility behavior described in the scenario.

That action—Plan an RF site survey that incorporates floor materials, interference and required client behavior—is relevant to RF survey and building materials. Propagation and attenuation vary with walls, shelving and device environments; a diagram alone cannot establish coverage or service quality. It does not correct the observed inventory and dependency discovery condition.

RF coverage establishes reception, whereas channel contention and client airtime demand govern usable capacity in dense spaces. Size the wireless design for peak concurrent airtime demand rather than signal strength alone. would address peak WLAN concurrency, but the reported facts instead point to inventory and dependency discovery. That change would leave the actual requirement unresolved.

The alternative targets VSF versus VSX platform planning, where VSF forms a virtual switch with supported stacking members; VSX coordinates two peers while retaining separate control planes, so support and failure domains differ. It does not establish the intended inventory and dependency discovery behavior described in the scenario.

That action—Define explicit identity-to-role and role-to-policy mappings for campus clients—is relevant to role-based access decisions. Successful authentication proves identity; separate authorization decisions determine permitted destinations, services and segmentation. It does not correct the observed RADIUS service resilience condition.

The alternative targets acceptance of WLAN security and mobility, where an AP advertising a network does not prove that clients can authenticate, receive approved privileges or maintain application continuity while moving. It does not establish the intended RADIUS service resilience behavior described in the scenario.

Allowed frequencies, radar-detection obligations and client capabilities can vary by country and AP model, so global channel templates may fail. Match 5 GHz channel choices to regulatory permissions, DFS behavior and supported clients. would address 5 GHz regulatory channel constraints, but the reported facts instead point to RADIUS service resilience. That change would leave the actual requirement unresolved.

The alternative targets unauthorized DHCP server, where DHCP snooping restricts untrusted hosts from responding as servers and can help preserve legitimate addressing information on the VLAN. It does not establish the intended client isolation and peer access behavior described in the scenario.

IPv4 ARP safeguards do not inspect ICMPv6 router announcements; RA protection constrains unauthorized router information on client segments. Apply appropriate IPv6 RA protection on untrusted access ports. would address IPv6 router-advertisement spoofing, but the reported facts instead point to client isolation and peer access. That change would leave the actual requirement unresolved.

That action—Check AP radio administrative state, band and regulatory channel support—is relevant to AP radio disabled or unsupported channel. Cloud device online status does not prove every radio is active or that target clients can discover the selected channel. It does not correct the observed client isolation and peer access condition.

That result—Predictive and on-site measurements identify weak areas and confirm intended application-level RF coverage—concerns RF survey and building materials. Propagation and attenuation vary with walls, shelving and device environments; a diagram alone cannot establish coverage or service quality. It can be healthy even while the current change-window and rollback requirements problem remains.

This would validate 5 GHz regulatory channel constraints, not change-window and rollback requirements. Allowed frequencies, radar-detection obligations and client capabilities can vary by country and AP model, so global channel templates may fail. It is therefore insufficient acceptance evidence for the reported condition.

The low-level design should express observable outcomes such as authentication success, endpoint reachability, failover behavior and performance thresholds rather than only equipment names. The indicated result—the signed acceptance matrix associates each campus requirement with a measurable test, expected result and responsible owner—checks a different mechanism and would not confirm the required change-window and rollback requirements outcome.

The alternative targets roaming voice coverage overlap, where a reliable voice WLAN needs usable signal and timely authentication/roaming behavior between neighboring cells, not maximum isolated AP range. It does not establish the intended 2.4 GHz interference planning behavior described in the scenario.

That action—Plan enough usable wireless airtime and spatial reuse rather than simply raising transmit power—is relevant to coverage versus capacity tradeoff. A higher RSSI does not remove contention; channel planning, cell sizing and client density are needed to increase effective capacity. It does not correct the observed 2.4 GHz interference planning condition.

Available port count does not establish available power; a switch can have free interfaces while its aggregate PoE budget is exhausted. Calculate the access-switch PoE budget including device draw and operational headroom. would address poE budget planning, but the reported facts instead point to 2.4 GHz interference planning. That change would leave the actual requirement unresolved.

Fast reliable handoff requires compatible client capabilities, adequate AP overlap and secure authentication continuity rather than just increasing bandwidth. The indicated result—a walk test records acceptable handoff delay and voice packet loss under normal movement paths—checks a different mechanism and would not confirm the required high-density WLAN airtime optimization outcome.

This would validate storm control tuning, not high-density WLAN airtime optimization. Overly aggressive limits can discard necessary discovery traffic, while absent protection permits broadcasts to overwhelm forwarding capacity. It is therefore insufficient acceptance evidence for the reported condition.

That result—Spectrum observations isolate the interference source and the post-remediation error rate falls measurably—concerns interference spectrum diagnosis. Non-802.11 emitters can occupy channel energy without appearing as normal Wi-Fi neighbors; channel changes or source mitigation need measured evidence. It can be healthy even while the current high-density WLAN airtime optimization problem remains.

The alternative targets VSX keepalive isolation, where separate failure detection helps peers distinguish link disruption from peer loss, reducing the risk of harmful split-brain behavior. It does not establish the intended default-route propagation behavior described in the scenario.

IGMP membership information lets switches constrain Layer 2 multicast distribution instead of flooding traffic indiscriminately. Enable appropriate IGMP snooping and multicast forwarding behavior for subscriber VLANs. would address multicast receiver handling, but the reported facts instead point to default-route propagation. That change would leave the actual requirement unresolved.

That action—Place the SVI and required routes in the correct VRF routing context—is relevant to VRF route-context configuration. Routes and interfaces are looked up within the relevant VRF; a default route in a different table cannot repair a missing path. It does not correct the observed default-route propagation condition.

This would validate RADIUS shared-secret consistency, not native VLAN alignment. RADIUS exchanges rely on correctly configured shared secrets and client definitions; basic IP reachability does not establish a valid AAA relationship. It is therefore insufficient acceptance evidence for the reported condition.

A VLAN's existence on each switch is insufficient if the inter-switch trunk omits it, so frames cannot traverse the missing membership. The indicated result—the VLAN is present on each relevant trunk and authenticated client traffic traverses the expected path—checks a different mechanism and would not confirm the required native VLAN alignment outcome.

That result—The client-facing port shows the assigned access VLAN and obtains an address from the intended subnet—concerns access port VLAN membership. Client frames received untagged are placed in the port's access VLAN; a healthy physical link cannot compensate for wrong Layer 2 membership. It can be healthy even while the current native VLAN alignment problem remains.

This would validate OSPF adjacency prerequisites, not route redistribution filters. OSPF adjacency depends on compatible peer parameters and reachable interfaces; a live link is insufficient when control-plane settings disagree. It is therefore insufficient acceptance evidence for the reported condition.

RADIUS exchanges rely on correctly configured shared secrets and client definitions; basic IP reachability does not establish a valid AAA relationship. The indicated result—the RADIUS server accepts requests from the expected client and the 802.1X session completes under the intended authorization—checks a different mechanism and would not confirm the required route redistribution filters outcome.

That result—Multicast reaches registered subscriber ports while nonmember access ports show no unnecessary stream traffic—concerns multicast receiver handling. IGMP membership information lets switches constrain Layer 2 multicast distribution instead of flooding traffic indiscriminately. It can be healthy even while the current route redistribution filters problem remains.

That action—Configure the required VLAN interfaces and routed gateway paths for intended inter-VLAN communication—is relevant to SVI inter-VLAN gateway. VLAN configuration creates Layer 2 separation; inter-subnet communication requires appropriate Layer 3 interfaces, addressing and policy. It does not correct the observed LACP bundled links condition.

The alternative targets VSF member management, where VSF presents supported physical members as a virtual switch while retaining operational requirements for healthy stacking links and member state. It does not establish the intended LACP bundled links behavior described in the scenario.

Uncontrolled Ethernet loops replicate broadcasts and destabilize MAC learning; redundant links require a mechanism to block or logically aggregate unsafe cycles. Keep an appropriate spanning-tree or supported loop-free design across redundant Layer 2 paths. would address spanning-tree loop prevention, but the reported facts instead point to LACP bundled links. That change would leave the actual requirement unresolved.