Refer to the exhibit. A network engineer must configure the WLC to allow only DHCP and DNS packets for User1 and User2. Which configuration must be used?

Web Authentication is a Layer 3 process, while 802.1X is Layer 2, and this combination is not the primary mechanism for setting specific pre-authentication traffic policies.

Fallback Policy with MAC filtering provides a different security function for client authentication and device identification, but it does not granularly control pre-authentication traffic to permit only DHCP and DNS.

On a WLC, enabling a Layer 3 Web policy, often associated with a captive portal or web authentication, allows for the configuration of a pre-authentication access control list (ACL). This ACL can be specifically set to permit only essential services like DHCP and DNS packets for unauthenticated users before they complete the web-based authentication process.

Enabling Web Authentication under the AAA Server configuration is about integrating with the authentication server, not about defining the traffic policy for unauthenticated clients on the WLC itself.