Clients are failing EAP authentication. A debug shows that an EAPOL start is sent and the clients are then de-authenticated. Which two issues can cause this problem? (Choose two.)

A changed WLC certificate would cause a failure during the TLS handshake phase of EAP-TLS or PEAP, not immediately after EAPOL-Start before RADIUS communication is even established.

An incorrect EAP supplicant type mismatch would cause a protocol negotiation failure deeper in the EAP exchange, not an immediate de-authentication right after EAPOL-Start.

If the shared secret configured on the WLC and the RADIUS server do not match, the RADIUS server will silently drop or reject Access-Request messages from the WLC, causing the authentication exchange to fail after EAPOL-Start and resulting in client de-authentication.

If the WLC has not been added as a RADIUS client (NAS) on the RADIUS server, the server will reject all authentication requests from that WLC's IP address, preventing EAP from completing and forcing the WLC to de-authenticate the client.

A machine vs. user authentication mismatch would cause an Access-Reject from RADIUS but implies RADIUS communication is working - the described symptom points to RADIUS being unreachable or rejecting the NAS entirely.