That action—Configure the required VLAN interfaces and routed gateway paths for intended inter-VLAN communication—is relevant to SVI inter-VLAN gateway. VLAN configuration creates Layer 2 separation; inter-subnet communication requires appropriate Layer 3 interfaces, addressing and policy. It does not correct the observed LACP bundled links condition.

The alternative targets VSF member management, where VSF presents supported physical members as a virtual switch while retaining operational requirements for healthy stacking links and member state. It does not establish the intended LACP bundled links behavior described in the scenario.

Uncontrolled Ethernet loops replicate broadcasts and destabilize MAC learning; redundant links require a mechanism to block or logically aggregate unsafe cycles. Keep an appropriate spanning-tree or supported loop-free design across redundant Layer 2 paths. would address spanning-tree loop prevention, but the reported facts instead point to LACP bundled links. That change would leave the actual requirement unresolved.

Successful authentication proves identity; separate authorization decisions determine permitted destinations, services and segmentation. Define explicit identity-to-role and role-to-policy mappings for campus clients. would address role-based access decisions, but the reported facts instead point to RADIUS service resilience. That change would leave the actual requirement unresolved.

That action—Break high-risk campus migration into staged, independently validated change waves—is relevant to change-risk classification. Changing many dependent control planes at once obscures root causes and enlarges outage blast radius; staging supplies evidence and rollback points. It does not correct the observed RADIUS service resilience condition.

The alternative targets RF survey and building materials, where propagation and attenuation vary with walls, shelving and device environments; a diagram alone cannot establish coverage or service quality. It does not establish the intended RADIUS service resilience behavior described in the scenario.

This would validate spanning-tree blocked forwarding, not EAP-TLS trust-chain failure. A correctly blocked path may be essential loop prevention; unblocking without analyzing topology can trigger broadcasts and MAC instability. It is therefore insufficient acceptance evidence for the reported condition.

That result—Packet capture shows the expected EAPOL handshake and the endpoint reaches the assigned authorized session state—concerns 802.1X supplicant disabled. An authentication server cannot authorize an endpoint that never initiates the intended EAP handshake on the controlled link. It can be healthy even while the current EAP-TLS trust-chain failure problem remains.

Cloud device online status does not prove every radio is active or that target clients can discover the selected channel. The indicated result—the intended radio advertises the configured SSID on a permitted channel visible to supported test clients—checks a different mechanism and would not confirm the required EAP-TLS trust-chain failure outcome.

This would validate missing default gateway, not 802.1X supplicant disabled. Traffic bound for other subnets needs a reachable Layer 3 next hop; a functioning local broadcast domain does not provide routing. It is therefore insufficient acceptance evidence for the reported condition.

A guest can associate and receive a lease without completing the portal flow; redirect and pre-auth policy must permit necessary portal dependencies. The indicated result—the guest device reliably reaches the portal and receives only its intended post-login access—checks a different mechanism and would not confirm the required 802.1X supplicant disabled outcome.

That result—The client receives an address, gateway and DNS from the approved pool and reaches the intended VLAN service—concerns wireless DHCP failure stage. Client association and 802.1X success occur before address allocation; VLAN or relay faults can prevent DHCP without an RF fault. It can be healthy even while the current 802.1X supplicant disabled problem remains.

Missing uplink, power, VLAN, routing and identity dependencies cause apparently successful device replacements to disconnect applications or clients unexpectedly. Inventory existing physical, logical and service dependencies before finalizing the change sequence. would address inventory and dependency discovery, but the reported facts instead point to VLAN and subnet segmentation. That change would leave the actual requirement unresolved.

The alternative targets routing and VRF separation, where VLANs divide Layer 2 domains, whereas VRFs maintain separate Layer 3 routing contexts; any intentional crossing needs controlled connectivity. It does not establish the intended VLAN and subnet segmentation behavior described in the scenario.

That action—Design dual-homed access uplinks with suitable link aggregation and loop prevention for the selected platform—is relevant to dual-homed downstream aggregation. Hardware redundancy is ineffective if every downstream path still depends on one forwarding node or unsound Layer 2 topology. It does not correct the observed VLAN and subnet segmentation condition.

That action—Reconcile inventory, subscriptions and management access when devices are moved or retired—is relevant to network asset lifecycle. Stale registrations and credentials introduce operational confusion and potential access risk even when hardware is no longer installed. It does not correct the observed topology and documentation currency condition.

The alternative targets REST API authentication boundaries, where API access is a privileged operational interface; overbroad or leaked tokens can compromise configuration and monitoring data. It does not establish the intended topology and documentation currency behavior described in the scenario.

Reversible change management requires knowing the previous effective state, not merely retaining a screenshot of intended edits. Capture a restorable configuration checkpoint and change record before modifying network intent. would address configuration backup before changes, but the reported facts instead point to topology and documentation currency. That change would leave the actual requirement unresolved.

This would validate missing default gateway, not RF interference and retries. Traffic bound for other subnets needs a reachable Layer 3 next hop; a functioning local broadcast domain does not provide routing. It is therefore insufficient acceptance evidence for the reported condition.

That result—Authentication logs and client diagnostics show a valid trusted handshake and correct certificate identity verification—concerns EAP-TLS trust-chain failure. EAP-TLS relies on a trusted certificate path; successful network reachability does not bypass expired or unknown issuing authorities. It can be healthy even while the current RF interference and retries problem remains.

A silent RADIUS transport failure prevents normal authentication regardless of whether the user certificate or role rules are correct. The indicated result—RADIUS requests and responses traverse the approved path and the client reaches its intended authorized role—checks a different mechanism and would not confirm the required RF interference and retries outcome.

Management interfaces and privileged control operations need narrower access than ordinary client traffic to reduce compromise and configuration risk. The indicated result—administrative access tests allow authorized management sources and reject unauthorized clients with attributable audit events—checks a different mechanism and would not confirm the required 5 GHz regulatory channel constraints outcome.

That result—The channel plan improves spectrum reuse and measured busy-period throughput rather than relying on theoretical PHY rate alone—concerns high-density channel-width choice. Wider channels can raise peak link rates in isolation yet reduce the number of independent channels available in dense environments. It can be healthy even while the current 5 GHz regulatory channel constraints problem remains.

This would validate coverage versus capacity tradeoff, not 5 GHz regulatory channel constraints. A higher RSSI does not remove contention; channel planning, cell sizing and client density are needed to increase effective capacity. It is therefore insufficient acceptance evidence for the reported condition.

Management intent, synchronization status and the running device state are distinct; failed changes or local overrides can leave unintended effective configuration. Inspect configuration audit and effective device state rather than assuming an issued change was applied. would address central configuration audit, but the reported facts instead point to BPDU Guard at edge ports. That change would leave the actual requirement unresolved.

That action—Configure the required VLAN interfaces and routed gateway paths for intended inter-VLAN communication—is relevant to SVI inter-VLAN gateway. VLAN configuration creates Layer 2 separation; inter-subnet communication requires appropriate Layer 3 interfaces, addressing and policy. It does not correct the observed BPDU Guard at edge ports condition.

The alternative targets trunk allowed VLAN list, where a VLAN's existence on each switch is insufficient if the inter-switch trunk omits it, so frames cannot traverse the missing membership. It does not establish the intended BPDU Guard at edge ports behavior described in the scenario.

This would validate OSPF passive interfaces, not management connectivity and DNS. A passive interface can advertise its connected prefix through the process while avoiding unwanted OSPF hello exchanges toward endpoints. It is therefore insufficient acceptance evidence for the reported condition.

That result—The effective device configuration reflects documented scoped intent and any deliberate higher-priority exception—concerns new Central scoped inheritance. New Central includes global, collection, site and device scopes; more specific applicable configuration can override broader inherited values. It can be healthy even while the current management connectivity and DNS problem remains.

Shared templates are reusable only when site-specific identity, address and port data are correctly substituted for each target device. The indicated result—rendered configurations contain the intended unique addresses and device settings with no unresolved placeholder values—checks a different mechanism and would not confirm the required management connectivity and DNS outcome.

Reversible change management requires knowing the previous effective state, not merely retaining a screenshot of intended edits. Capture a restorable configuration checkpoint and change record before modifying network intent. would address configuration backup before changes, but the reported facts instead point to central client health visibility. That change would leave the actual requirement unresolved.

The alternative targets UXI application tests, where network device health does not establish application experience; end-to-end synthetic tests expose DNS, transport and service delays along the client path. It does not establish the intended central client health visibility behavior described in the scenario.

That action—Record baseline interface utilization, errors, discards and latency before judging later degradation—is relevant to baseline interface health metrics. Counters are most useful when compared with known normal operating behavior and collection intervals rather than isolated snapshots. It does not correct the observed central client health visibility condition.