This would validate network asset lifecycle, not configuration backup before changes. Stale registrations and credentials introduce operational confusion and potential access risk even when hardware is no longer installed. It is therefore insufficient acceptance evidence for the reported condition.

Undocumented differences make subsequent upgrades and incident response unpredictable because the managed baseline is no longer authoritative. The indicated result—the configuration audit identifies each intentional override and shows no unapproved divergence in running state—checks a different mechanism and would not confirm the required configuration backup before changes outcome.

That result—Approved managed and denied test identities produce expected authorization outcomes before wider AAA rollout—concerns AAA change coordination. Identity changes impact access before network routing tests can begin; testing distinct client classes limits unintended lockouts. It can be healthy even while the current configuration backup before changes problem remains.

The alternative targets IPv6 router-advertisement spoofing, where IPv4 ARP safeguards do not inspect ICMPv6 router announcements; RA protection constrains unauthorized router information on client segments. It does not establish the intended wireless DHCP failure stage behavior described in the scenario.

That action—Inspect roam timing, neighbor coverage and security reauthentication behavior during movement—is relevant to roaming reassociation delay. Roaming quality depends on usable overlap and timely client/security transitions; stationary speed tests cannot diagnose roaming interruption. It does not correct the observed wireless DHCP failure stage condition.

A successful authentication indicates identity acceptance, while authorization attributes and local mapping determine permitted services. Compare RADIUS authorization attributes with actual assigned session role and policy. would address incorrect RADIUS role result, but the reported facts instead point to wireless DHCP failure stage. That change would leave the actual requirement unresolved.

That result—The authorization matrix maps identity conditions to effective user roles and confirms forbidden access is denied—concerns role-based access decisions. Successful authentication proves identity; separate authorization decisions determine permitted destinations, services and segmentation. It can be healthy even while the current dual-homed downstream aggregation problem remains.

A functional hierarchy clarifies where endpoints attach, where traffic aggregates and where policy or Layer 3 boundaries belong. The indicated result—the low-level topology labels uplink capacity, device roles, VLAN boundaries and redundant forwarding paths—checks a different mechanism and would not confirm the required dual-homed downstream aggregation outcome.

This would validate failure-domain isolation, not dual-homed downstream aggregation. Two logical paths do not provide independent availability when they share a single cable route, power supply or upstream component. It is therefore insufficient acceptance evidence for the reported condition.

That action—Provision the supported VSF stack topology, member roles and intermember links consistently—is relevant to VSF member management. VSF presents supported physical members as a virtual switch while retaining operational requirements for healthy stacking links and member state. It does not correct the observed new Central persona applicability condition.

The alternative targets central configuration audit, where management intent, synchronization status and the running device state are distinct; failed changes or local overrides can leave unintended effective configuration. It does not establish the intended new Central persona applicability behavior described in the scenario.

Radio operation is constrained by regional rules, and an incorrect country or channel plan can prevent valid operation or break client support. Configure the AP regulatory domain and permissible channels for its actual deployment location. would address AP country-code and RF regulatory setting, but the reported facts instead point to new Central persona applicability. That change would leave the actual requirement unresolved.

RADIUS exchanges rely on correctly configured shared secrets and client definitions; basic IP reachability does not establish a valid AAA relationship. Match the network access device's RADIUS client settings and shared secret to the authorized server definition. would address RADIUS shared-secret consistency, but the reported facts instead point to device group selection. That change would leave the actual requirement unresolved.

The alternative targets gateway role deployment, where gateway responsibilities such as tunnel termination and role enforcement depend on the chosen software architecture and supported role. It does not establish the intended device group selection behavior described in the scenario.

That action—Distinguish Central's site/location assignment from the group-based configuration scope in Classic Central—is relevant to classic Central site versus group. Classic Central uses groups to distribute shared configuration while sites provide physical-location organization, so modifying location alone need not change running intent. It does not correct the observed device group selection condition.

That action—Reassess traffic mix and oversubscription ratio against measured peak uplink utilization—is relevant to uplink oversubscription tuning. Access port sum can greatly exceed distribution bandwidth, so congestion and burst tolerance must be planned rather than inferred from port speed labels. It does not correct the observed failure recovery time objective condition.

The alternative targets baseline before optimization, where optimization claims require equivalent loads, test methods and service metrics before and after; otherwise changes in demand confound comparison. It does not establish the intended failure recovery time objective behavior described in the scenario.

Right-sized operation reduces unnecessary resource use, but energy or capacity savings must not remove availability when users actually need the network. Adjust supported power or capacity policies according to measured usage while preserving peak service requirements. would address energy and utilization efficiency, but the reported facts instead point to failure recovery time objective. That change would leave the actual requirement unresolved.

Low PHY data rates use more airtime per transmitted bit; rate changes must be constrained by coverage and device support. The indicated result—the pilot shows less management/data airtime overhead while required legacy clients remain supported or have a documented exception—checks a different mechanism and would not confirm the required multicast traffic scope outcome.

That result—Peak legitimate discovery succeeds and a simulated excessive broadcast rate triggers the intended bounded protection—concerns storm control tuning. Overly aggressive limits can discard necessary discovery traffic, while absent protection permits broadcasts to overwhelm forwarding capacity. It can be healthy even while the current multicast traffic scope problem remains.

This would validate trust and QoS marking boundary, not multicast traffic scope. Blindly trusting endpoint markings lets untrusted traffic dominate queues; classification must reflect approved service importance. It is therefore insufficient acceptance evidence for the reported condition.

The alternative targets DHCP relay on routed segments, where layer 3 boundaries do not normally forward client DHCP broadcasts without relay behavior; the helper target must also be reachable. It does not establish the intended BPDU Guard at edge ports behavior described in the scenario.

VLAN configuration creates Layer 2 separation; inter-subnet communication requires appropriate Layer 3 interfaces, addressing and policy. Configure the required VLAN interfaces and routed gateway paths for intended inter-VLAN communication. would address SVI inter-VLAN gateway, but the reported facts instead point to BPDU Guard at edge ports. That change would leave the actual requirement unresolved.

That action—Validate client security-mode capability and stage a compatible secure WLAN migration—is relevant to WPA3 and legacy clients. WLAN security changes can exclude devices with unsupported cipher, authentication or protected-management-frame capabilities. It does not correct the observed BPDU Guard at edge ports condition.

This would validate power-over-Ethernet failure, not spanning-tree blocked forwarding. A data VLAN or management group cannot correct a switch power budget that denies the PD enough electrical power. It is therefore insufficient acceptance evidence for the reported condition.

Repeated link transitions and frame errors point to Layer 1 quality or negotiation rather than an unseen WLAN authentication issue. The indicated result—the repaired link remains stable under load and physical error counters stop increasing unexpectedly—checks a different mechanism and would not confirm the required spanning-tree blocked forwarding outcome.

That result—The neighbor reaches Full and logs no authentication failures after the matched configuration is applied—concerns OSPF authentication mismatch. Routing protocol control packets may be rejected when authentication differs, even if underlying Layer 3 ping succeeds. It can be healthy even while the current spanning-tree blocked forwarding problem remains.

That result—The effective device value is traced to its controlling scope and the corrected override restores intended behavior—concerns wrong Central scope override. Scoped configuration precedence can explain isolated divergence; changing the shared profile again can unintentionally impact healthy devices. It can be healthy even while the current access VLAN misassignment problem remains.

Rapid MAC moves and broadcast amplification indicate switching topology instability, not a problem fixed by adding a default route. The indicated result—the repaired topology has stable learned MAC locations and broadcast volume returns to expected baseline—checks a different mechanism and would not confirm the required access VLAN misassignment outcome.

This would validate optics compatibility and signal levels, not access VLAN misassignment. An unsupported or poorly coupled optical path prevents reliable Ethernet signalling regardless of correct routing or authentication configuration. It is therefore insufficient acceptance evidence for the reported condition.

That result—STP topology is stable, with intentional root and port roles and no recurring MAC-flap or broadcast-storm indications—concerns spanning-tree loop prevention. Uncontrolled Ethernet loops replicate broadcasts and destabilize MAC learning; redundant links require a mechanism to block or logically aggregate unsafe cycles. It can be healthy even while the current central configuration audit problem remains.

Radio operation is constrained by regional rules, and an incorrect country or channel plan can prevent valid operation or break client support. The indicated result—the AP radio state uses legally permitted channels and clients connect under the intended local regulatory settings—checks a different mechanism and would not confirm the required central configuration audit outcome.

This would validate new Central scoped inheritance, not central configuration audit. New Central includes global, collection, site and device scopes; more specific applicable configuration can override broader inherited values. It is therefore insufficient acceptance evidence for the reported condition.