You are designing an Out of Band Cisco Network Admission Control, Layer 3 Real-IP Gateway deployment for a customer. Which VLAN must be trunked back to the Clean Access Server from the access switch?

The untrusted VLAN is where clients are initially placed prior to posture assessment and authentication. The Clean Access Server must receive this VLAN traffic directly so it can redirect clients to the authentication portal, evaluate endpoint compliance, and enforce policy before moving users to the trusted network segment.

The user VLAN is the trusted segment where clients reside after successful authentication; the CAS does not need to intercept already-authenticated traffic on this VLAN.

The management VLAN carries device management traffic such as SSH and SNMP and is not associated with client authentication or posture assessment workflows.

There is no separate 'authentication VLAN' in Cisco NAC OOB terminology; the untrusted VLAN itself is the segment that handles pre-authentication client traffic.