What provides centralized control of authentication and roaming in an enterprise network?

A lightweight access point (LAP) is an endpoint device that depends on a WLC for configuration and management, not a central control point itself.

A firewall primarily enforces network security policies by filtering traffic, but it does not centralize the control of wireless client authentication and roaming functions.

A Wireless LAN Controller (WLC) is specifically designed to provide centralized management for multiple lightweight access points (LAPs), orchestrating authentication, enforcing security policies, and enabling seamless roaming for wireless clients across an entire enterprise network.

A LAN switch provides wired network connectivity and Layer 2/3 forwarding, but it does not offer centralized control over wireless authentication or roaming.