Which device controls the forwarding of authentication requests for users when connecting to the network...

Answer D is the technically correct selection. In a lightweight AP deployment, the wireless LAN controller handles WLAN policy and forwards authentication requests to the AAA server. The AP provides radio access, but the WLC controls the client WLAN configuration and authentication path in the controller-based architecture. This aligns with Cisco CCNA 200-301 v1.1 because the exam blueprint requires engineers to recognize operational behaviour from configuration symptoms and topology requirements. A RADIUS server validates credentials, while TACACS+ is mainly used for device administration; the AP is not the controlling device in this model. Treat the distractors carefully: most are real Cisco terms, but they solve a different problem or operate at a different layer. The selected answer is the one that would be used by an engineer on the device or in the design to produce the outcome stated in the question.