When a guest client is authenticated, which type of connection is created between the controller- based AP and the client?

An SSL connection operates at the application layer for specific services, not as the underlying wireless link layer connection between an AP and a client.

A TLS encrypted tunnel is similar to SSL, operating at the application layer, and is not typically used for the basic wireless link encryption in guest networks unless advanced WPA2-Enterprise with EAP-TLS is employed, which is uncommon for simple guest access.

After a guest client authenticates, typically through a captive portal or web authentication, the wireless connection between the client and the AP is generally an unsecured connection, meaning the over-the-air traffic itself is not encrypted by a WPA/WPA2/WPA3 key. While application-layer traffic might be encrypted (e.g., HTTPS), the underlying Wi-Fi link remains open.

An 802.1x/EAP tunnel is utilized for enterprise-grade authentication with WPA2/WPA3-Enterprise, providing strong encryption for the wireless link, which is not usually part of basic guest access setups.

An IPsec tunnel is a network-layer security protocol often used for VPNs, and it is not the protocol that secures the wireless link between an AP and a client.