API access is a privileged operational interface; overbroad or leaked tokens can compromise configuration and monitoring data. The indicated result—a scoped automation token reads intended resources, fails prohibited write operations and is absent from code repositories—checks a different mechanism and would not confirm the required access-control change verification outcome.

This would validate change freeze and backout criteria, not access-control change verification. Recovery decisions based on elapsed time and service impact are more reliable than an operator's improvised judgment under incident pressure. It is therefore insufficient acceptance evidence for the reported condition.

That result—Certificate inventory and alerts show sufficient renewal lead time and successful test authentication after renewal—concerns certificate expiry monitoring. Healthy RF and RADIUS reachability cannot compensate for an expired or untrusted certificate that fails the authentication handshake. It can be healthy even while the current access-control change verification problem remains.

The alternative targets address pool capacity, where more APs cannot solve exhaustion of the IP-address pool; usable addresses, lease duration and peak devices must be evaluated together. It does not establish the intended inventory and dependency discovery behavior described in the scenario.

Physical installation and initial configuration depend on explicit interface-level intent; ambiguities produce swapped services or accidental trunk exposure. Create a detailed port, VLAN, power and uplink mapping for implementation. would address low-level port map, but the reported facts instead point to inventory and dependency discovery. That change would leave the actual requirement unresolved.

That action—Plan an RF site survey that incorporates floor materials, interference and required client behavior—is relevant to RF survey and building materials. Propagation and attenuation vary with walls, shelving and device environments; a diagram alone cannot establish coverage or service quality. It does not correct the observed inventory and dependency discovery condition.

Low PHY data rates use more airtime per transmitted bit; rate changes must be constrained by coverage and device support. The indicated result—the pilot shows less management/data airtime overhead while required legacy clients remain supported or have a documented exception—checks a different mechanism and would not confirm the required roaming voice latency outcome.

That result—A forced component failure restores approved traffic within a measured recovery-time objective—concerns failure recovery time objective. Resilience depends on recovery behavior, routing/bridging convergence and application tolerance, not the number of installed redundant devices. It can be healthy even while the current roaming voice latency problem remains.

This would validate channel reuse planning, not roaming voice latency. Co-channel neighbors share airtime when within interference range; thoughtful reuse can reduce contention without simply widening channels. It is therefore insufficient acceptance evidence for the reported condition.

The alternative targets channel reuse planning, where co-channel neighbors share airtime when within interference range; thoughtful reuse can reduce contention without simply widening channels. It does not establish the intended high-density WLAN airtime optimization behavior described in the scenario.

That action—Choose channel width that balances individual throughput with channel reuse and interference—is relevant to WLAN channel-width optimization. Wide channels can improve peak rates per connection yet shrink available channel separation, raising cochannel contention in dense networks. It does not correct the observed high-density WLAN airtime optimization condition.

Access port sum can greatly exceed distribution bandwidth, so congestion and burst tolerance must be planned rather than inferred from port speed labels. Reassess traffic mix and oversubscription ratio against measured peak uplink utilization. would address uplink oversubscription tuning, but the reported facts instead point to high-density WLAN airtime optimization. That change would leave the actual requirement unresolved.

That action—Configure a controlled default route and distribute it only where the campus topology requires—is relevant to default-route propagation. A routing protocol's internal adjacency does not guarantee a usable route for unknown destinations; a valid and authorized default egress is needed. It does not correct the observed VSX peer synchronization condition.

The alternative targets device group selection, where a device must receive intent appropriate to its product family and role; the wrong group or persona can apply unrelated settings or reject configuration. It does not establish the intended VSX peer synchronization behavior described in the scenario.

VSF presents supported physical members as a virtual switch while retaining operational requirements for healthy stacking links and member state. Provision the supported VSF stack topology, member roles and intermember links consistently. would address VSF member management, but the reported facts instead point to VSX peer synchronization. That change would leave the actual requirement unresolved.

This would validate MAC learning and unintended loops, not captive portal redirect fault. Rapid MAC moves and broadcast amplification indicate switching topology instability, not a problem fixed by adding a default route. It is therefore insufficient acceptance evidence for the reported condition.

Roaming quality depends on usable overlap and timely client/security transitions; stationary speed tests cannot diagnose roaming interruption. The indicated result—a moving client transitions APs with acceptable interruption duration while retaining approved access—checks a different mechanism and would not confirm the required captive portal redirect fault outcome.

That result—The intended radio advertises the configured SSID on a permitted channel visible to supported test clients—concerns AP radio disabled or unsupported channel. Cloud device online status does not prove every radio is active or that target clients can discover the selected channel. It can be healthy even while the current captive portal redirect fault problem remains.

This would validate longest-prefix route selection, not OSPF prefix advertisement omission. IP forwarding selects the most specific matching destination prefix before comparing less-specific alternatives; a summary route does not override a more-specific match. It is therefore insufficient acceptance evidence for the reported condition.

That result—Packet and session evidence shows traffic and permitted replies follow paths accepted by the relevant stateful controls—concerns asymmetric path enforcement. Stateful firewalls can drop replies they did not see established; checking only the outbound route misses asymmetric forwarding. It can be healthy even while the current OSPF prefix advertisement omission problem remains.

A successful authentication indicates identity acceptance, while authorization attributes and local mapping determine permitted services. The indicated result—the client session reports the approved role and positive/negative application tests match that role's permissions—checks a different mechanism and would not confirm the required OSPF prefix advertisement omission outcome.

That action—Implement the authorized guest captive-portal workflow and associated access policy—is relevant to guest captive-portal flow. Association and address assignment alone cannot enforce guest registration or policy acceptance; the portal and post-login role must be connected. It does not correct the observed wired 802.1X port control condition.

Gateway responsibilities such as tunnel termination and role enforcement depend on the chosen software architecture and supported role. Provision each gateway with a supported network role that matches its forwarding architecture. would address gateway role deployment, but the reported facts instead point to wired 802.1X port control. That change would leave the actual requirement unresolved.

The alternative targets corporate EAP-TLS SSID, where EAP-TLS verifies certificate-based identities through the configured authentication system; a shared PSK does not give per-device certificate identity. It does not establish the intended wired 802.1X port control behavior described in the scenario.

That action—Verify platform model, software release and licensed-feature compatibility in the design—is relevant to firmware feature-support planning. Product capabilities and configuration syntax depend on supported hardware and software releases; a feature described in another model's guide may be unavailable. It does not correct the observed guest network isolation requirements condition.

The alternative targets high-density channel-width choice, where wider channels can raise peak link rates in isolation yet reduce the number of independent channels available in dense environments. It does not establish the intended guest network isolation requirements behavior described in the scenario.

Allowed frequencies, radar-detection obligations and client capabilities can vary by country and AP model, so global channel templates may fail. Match 5 GHz channel choices to regulatory permissions, DFS behavior and supported clients. would address 5 GHz regulatory channel constraints, but the reported facts instead point to guest network isolation requirements. That change would leave the actual requirement unresolved.

That result—The requirements document includes per-application targets that can be checked in QoS and performance tests—concerns critical application traffic profile. Real-time applications can fail with adequate average throughput when contention increases delay or jitter; requirement gathering must distinguish traffic classes. It can be healthy even while the current coverage versus capacity tradeoff problem remains.

This would validate directional antenna selection, not coverage versus capacity tradeoff. Directional gain shapes energy into target areas and can reduce unwanted spill, but a poorly aimed directional antenna creates coverage holes elsewhere. It is therefore insufficient acceptance evidence for the reported condition.

6 GHz operation requires capable client hardware and supported regulatory and security settings; enabling the band does not upgrade legacy adapters. The indicated result—pilot devices supporting the target band join securely and unsupported clients have a documented alternative network—checks a different mechanism and would not confirm the required coverage versus capacity tradeoff outcome.

That result—The active client session displays the correct assigned role and an explicit deny test confirms enforcement—concerns dynamic role enforcement. A RADIUS Access-Accept alone does not prove the switch or gateway applied the intended role policy to user sessions. It can be healthy even while the current AP country-code and RF regulatory setting problem remains.

Gateway responsibilities such as tunnel termination and role enforcement depend on the chosen software architecture and supported role. The indicated result—the managed gateway appears under the correct role and forwards sample SSID traffic according to the intended design—checks a different mechanism and would not confirm the required AP country-code and RF regulatory setting outcome.

This would validate new Central scoped inheritance, not AP country-code and RF regulatory setting. New Central includes global, collection, site and device scopes; more specific applicable configuration can override broader inherited values. It is therefore insufficient acceptance evidence for the reported condition.