An engineer is setting up a WLAN to work with a Cisco ISE as the AAA server. The company policy requires that all users be denied access to any resources until they pass the validation. Which componen

AAA override allows ISE to dynamically assign VLANs and ACLs after authentication, but it does not restrict access before the authentication process completes.

A preauthentication ACL is applied to a WLAN to control what traffic a wireless client can send or receive before successfully authenticating through ISE. It enforces the deny-all policy by permitting only the traffic necessary to reach the ISE portal (such as DHCP, DNS, and the ISE redirect URL), effectively blocking all other resource access until validation passes.

WPA2 passkey is a Layer 2 authentication method and does not control access to network resources after the wireless association is established.

A CPU ACL protects the WLC's management plane from excessive traffic directed at the controller itself, and is unrelated to restricting wireless client access before authentication.