An ACL is configured to restrict access for BYOD clients. The ACL must redirect devices to the guest portal. To which two devices on the local network must the ACL allow access other than the DHCP ser

An SNMP server handles network device polling and trap collection and plays no role in the BYOD client web-redirect or portal authentication flow.

Cisco ISE hosts the BYOD and guest portals to which the redirect ACL sends unregistered clients, so the ACL must permit HTTP/HTTPS traffic to ISE or the redirect process will be blocked before the device can complete onboarding.

The DNS server must be permitted in the redirect ACL because the client must resolve the portal hostname to an IP address before any HTTP redirect can succeed - without DNS, the browser cannot reach the ISE guest portal URL.

The WLC manages wireless sessions and enforces the ACL policy, but it is not a destination that a redirected client needs to reach directly to complete portal-based BYOD onboarding.

RADIUS is a backend AAA protocol used between the WLC or switch and ISE for policy enforcement, not a service that the client itself communicates with during a web portal redirect.