An engineer must configure AAA on a Cisco 9800 WLC for central web authentication. Which two commands are needed to accomplish this task? (Choose two.)

Question

Exhibit

Options

• A(Cisco Controller) > config wlan aaa-override disable <wlan-id>
• B(Cisco Controller) > config radius acct add 10.10.10.12 1812 SECRET
• C(Cisco Controller) > config wlan aaa-override enable <wlan-id>
• DDevice(config-locsvr-da-radius)# client 10.10.10.12 server-key 0 SECRET
• EDevice(config)# aaa server radius dynamic-author

• A
  7% (3)
• B
  16% (7)
• C
  4% (2)
• D
  73% (33)

Explanation

Explanation

For Central Web Authentication (CWA) on a Cisco 9800 WLC, the ISE or RADIUS server must be able to send Change of Authorization (CoA) messages back to the WLC, which requires configuring the WLC as a Dynamic Authorization client. Command E (aaa server radius dynamic-author) enables the RADIUS Dynamic Authorization server on the WLC, and command D (client 10.10.10.12 server-key 0 SECRET) defines the trusted RADIUS/ISE server allowed to send CoA messages - together, these two commands establish the CoA relationship essential for CWA to function.

Why the distractors are wrong:

• A & C refer to legacy Cisco AireOS WLC syntax (config wlan aaa-override), not the IOS-XE-based 9800 WLC CLI.
• B also uses AireOS syntax and incorrectly uses port 1812 for accounting (1812 is authentication; 1813 is accounting), making it doubly wrong and irrelevant to the 9800 platform.

Memory Tip

Think "Dynamic CoA = Two Steps": first open the door (aaa server radius dynamic-author) then invite the guest (client <IP> server-key). If you see AireOS-style commands like config wlan or config radius, eliminate them immediately when the question specifies a 9800 WLC.

No community discussion yet for this question.