Question 1110
At Research Hub, a campus gateway never receives employee SSID packets because the WLAN is set to bridge locally. Which TWO responses together provide a direct implementation and a continuing safeguard for the stated risk? Select TWO answers.
Explanation
Correct Answers
This is the implementation element for the Research Hub case: Bridge SSIDs forward locally; tunneled SSIDs use the gateway data path for policy. The specific action Choose approved bridge or tunneled forwarding mode and correctly map AP VLAN or gateway cluster addresses the stated fault; the question also requires a persistent risk control.
This is the continuing risk-control element for Research Hub. Assess roaming and segmentation impacts before changing WLAN forwarding mode prevents a future regression or unauthorized relaxation of the repair; it complements, rather than replaces, the implementation.
Incorrect Answers
This may be an ongoing precaution for Management VRF reachability: AOS-CX management VRF and default forwarding VRF may have separate reachability. It does not resolve the Bridge versus tunneled WLAN traffic requirement in Research Hub and is not one of the two controls requested. The direct mechanism here is bridge SSIDs forward locally; tunneled SSIDs use the gateway data path for policy
This may be a configuration step for Central device onboarding: Cloud inventory association and device management connectivity are separate onboarding requirements. It does not resolve the Bridge versus tunneled WLAN traffic requirement in Research Hub and is not one of the two controls requested. The direct mechanism here is bridge SSIDs forward locally; tunneled SSIDs use the gateway data path for policy