That result—An unauthorized BPDU on the protected access port triggers the configured protective behavior without altering the campus root—concerns BPDU Guard at edge ports. Edge ports should not accept topology-control messages from unauthorized bridges; BPDU Guard can protect the switching domain by restricting offending links. It can be healthy even while the current SVI inter-VLAN gateway problem remains.

This would validate VSX peer synchronization, not SVI inter-VLAN gateway. VSX peers retain independent control planes and only designated supported feature sets synchronize; unchecked settings may diverge. It is therefore insufficient acceptance evidence for the reported condition.

Uncontrolled Ethernet loops replicate broadcasts and destabilize MAC learning; redundant links require a mechanism to block or logically aggregate unsafe cycles. The indicated result—STP topology is stable, with intentional root and port roles and no recurring MAC-flap or broadcast-storm indications—checks a different mechanism and would not confirm the required SVI inter-VLAN gateway outcome.

This would validate campus requirements and acceptance criteria, not RF survey and building materials. The low-level design should express observable outcomes such as authentication success, endpoint reachability, failover behavior and performance thresholds rather than only equipment names. It is therefore insufficient acceptance evidence for the reported condition.

Hardware redundancy is ineffective if every downstream path still depends on one forwarding node or unsound Layer 2 topology. The indicated result—a link or peer failure test keeps supported endpoint traffic forwarded over the surviving upstream path—checks a different mechanism and would not confirm the required RF survey and building materials outcome.

That result—The capacity model and busy-period test account for concurrent clients, channel airtime and application throughput—concerns peak WLAN concurrency. RF coverage establishes reception, whereas channel contention and client airtime demand govern usable capacity in dense spaces. It can be healthy even while the current RF survey and building materials problem remains.

That action—Design repeatable API updates to check existing state and converge on intended configuration—is relevant to configuration API idempotence. An idempotent workflow can be safely retried without proliferating duplicate objects or introducing inconsistent partial configuration. It does not correct the observed API paging and rate limits condition.

The alternative targets NAE event rules on AOS-CX, where AOS-CX NAE provides locally evaluated telemetry/event logic; defining useful triggers matters more than merely enabling generic monitoring. It does not establish the intended API paging and rate limits behavior described in the scenario.

Auditability requires associating control-plane changes with an identity, time, reason and prior state, not just the new value. Retain attributable configuration history and link changes to reviewable approvals. would address configuration revision and approval history, but the reported facts instead point to API paging and rate limits. That change would leave the actual requirement unresolved.

That result—A moving client transitions APs with acceptable interruption duration while retaining approved access—concerns roaming reassociation delay. Roaming quality depends on usable overlap and timely client/security transitions; stationary speed tests cannot diagnose roaming interruption. It can be healthy even while the current IPv6 router-advertisement spoofing problem remains.

Scoped configuration precedence can explain isolated divergence; changing the shared profile again can unintentionally impact healthy devices. The indicated result—the effective device value is traced to its controlling scope and the corrected override restores intended behavior—checks a different mechanism and would not confirm the required IPv6 router-advertisement spoofing outcome.

This would validate client isolation and peer access, not IPv6 router-advertisement spoofing. Client isolation can intentionally prevent peer-to-peer wireless communication despite successful association, addressing and external reachability. It is therefore insufficient acceptance evidence for the reported condition.

The alternative targets address pool capacity, where more APs cannot solve exhaustion of the IP-address pool; usable addresses, lease duration and peak devices must be evaluated together. It does not establish the intended uplink bandwidth capacity behavior described in the scenario.

Hardware redundancy is ineffective if every downstream path still depends on one forwarding node or unsound Layer 2 topology. Design dual-homed access uplinks with suitable link aggregation and loop prevention for the selected platform. would address dual-homed downstream aggregation, but the reported facts instead point to uplink bandwidth capacity. That change would leave the actual requirement unresolved.

That action—Plan OSPF area boundaries and backbone reachability before implementing neighbors—is relevant to OSPF area design. Area design controls link-state information distribution, and nonbackbone areas normally connect through Area 0 via appropriate routers. It does not correct the observed uplink bandwidth capacity condition.

The alternative targets physical layer link fault, where repeated link transitions and frame errors point to Layer 1 quality or negotiation rather than an unseen WLAN authentication issue. It does not establish the intended MAC learning and unintended loops behavior described in the scenario.

A data VLAN or management group cannot correct a switch power budget that denies the PD enough electrical power. Inspect the switch's per-port and aggregate PoE allocation against endpoint power requirements. would address power-over-Ethernet failure, but the reported facts instead point to MAC learning and unintended loops. That change would leave the actual requirement unresolved.

That action—Validate the AAA server path, UDP service and allowed transport before changing identity policies—is relevant to RADIUS server reachability. A silent RADIUS transport failure prevents normal authentication regardless of whether the user certificate or role rules are correct. It does not correct the observed MAC learning and unintended loops condition.

That result—Rendered configurations contain the intended unique addresses and device settings with no unresolved placeholder values—concerns template variable rendering. Shared templates are reusable only when site-specific identity, address and port data are correctly substituted for each target device. It can be healthy even while the current SSID role and VLAN assignment problem remains.

EAP-TLS verifies certificate-based identities through the configured authentication system; a shared PSK does not give per-device certificate identity. The indicated result—a representative approved device completes certificate-based enterprise authentication and receives its authorized network role—checks a different mechanism and would not confirm the required SSID role and VLAN assignment outcome.

This would validate wired 802.1X port control, not SSID role and VLAN assignment. An AAA server cannot enforce identity on a port whose access-control mechanism is disabled; unauthorized endpoints must receive a restricted result. It is therefore insufficient acceptance evidence for the reported condition.

This would validate acceptance of WLAN security and mobility, not change-risk classification. An AP advertising a network does not prove that clients can authenticate, receive approved privileges or maintain application continuity while moving. It is therefore insufficient acceptance evidence for the reported condition.

Propagation and attenuation vary with walls, shelving and device environments; a diagram alone cannot establish coverage or service quality. The indicated result—predictive and on-site measurements identify weak areas and confirm intended application-level RF coverage—checks a different mechanism and would not confirm the required change-risk classification outcome.

That result—Administrative access tests allow authorized management sources and reject unauthorized clients with attributable audit events—concerns management-plane security. Management interfaces and privileged control operations need narrower access than ordinary client traffic to reduce compromise and configuration risk. It can be healthy even while the current change-risk classification problem remains.

The alternative targets access port VLAN membership, where client frames received untagged are placed in the port's access VLAN; a healthy physical link cannot compensate for wrong Layer 2 membership. It does not establish the intended LACP bundled links behavior described in the scenario.

A VLAN's existence on each switch is insufficient if the inter-switch trunk omits it, so frames cannot traverse the missing membership. Allow required tagged VLANs consistently along the end-to-end trunk path. would address trunk allowed VLAN list, but the reported facts instead point to LACP bundled links. That change would leave the actual requirement unresolved.

That action—Apply authorized MAC-based device classification with restrictive role enforcement where 802.1X is unavailable—is relevant to MAC authentication for headless devices. MAC authentication can support devices without a supplicant but is weaker than cryptographic identity, so narrow policy and inventory are essential. It does not correct the observed LACP bundled links condition.

That result—The effective device configuration reflects documented scoped intent and any deliberate higher-priority exception—concerns new Central scoped inheritance. New Central includes global, collection, site and device scopes; more specific applicable configuration can override broader inherited values. It can be healthy even while the current central device inventory onboarding problem remains.

Management intent, synchronization status and the running device state are distinct; failed changes or local overrides can leave unintended effective configuration. The indicated result—the audit reports no unresolved deployment errors and the running device setting matches approved intent—checks a different mechanism and would not confirm the required central device inventory onboarding outcome.

This would validate AP uplink power and negotiation, not central device inventory onboarding. Wireless features depend on the wired uplink and power available to the AP; sufficient coverage does not prove the device is operating at full capacity. It is therefore insufficient acceptance evidence for the reported condition.

That result—The intended VRF shows both the subnet interface and reachable next-hop route while unrelated VRFs remain isolated—concerns VRF route-context configuration. Routes and interfaces are looked up within the relevant VRF; a default route in a different table cannot repair a missing path. It can be healthy even while the current BPDU Guard at edge ports problem remains.

Uncontrolled Ethernet loops replicate broadcasts and destabilize MAC learning; redundant links require a mechanism to block or logically aggregate unsafe cycles. The indicated result—STP topology is stable, with intentional root and port roles and no recurring MAC-flap or broadcast-storm indications—checks a different mechanism and would not confirm the required BPDU Guard at edge ports outcome.

This would validate SSID-to-forwarding path consistency, not BPDU Guard at edge ports. Wireless association is only the first hop; downstream tunnel, VLAN and gateway mappings must agree for application access. It is therefore insufficient acceptance evidence for the reported condition.