A retail customer opened two new branch locations, and the main store HQ handles data...

This multi-constraint design scenario requires precise alignment of EWC architecture, N+1 redundancy hierarchy, AAA integration, and WLAN security policies. Option B correctly addresses all requirements. With only three APs per branch and a requirement to keep traffic local, converting a single C9130 to EWC mode is the correct and resource-efficient approach — converting two APs to EWC (Options A and C) wastes AP capacity in a small three-AP branch. The preferred controller set to the EWC AP ensures local APs join locally. The HQ WLC as primary N+1 backup satisfies the data center WLC always being primary requirement. Other branches ' EWC APs configured as secondary and tertiary controllers creates the cross-branch redundancy hierarchy. Since guests and employees share the same SSID but require different VLANs, MAC Authentication Bypass (MAB) with AAA override allows the HQ ISE/AAA server to return VLAN attributes based on device or user identity — dynamically assigning the correct VLAN at the policy level. The 2 Mbps guest rate limiting is applied through per-client QoS policies on the EWC. Option D ' s use of local web auth for guests does not enable dynamic VLAN assignment from AAA. Reference: WLSD Study Guide — EWC Architecture, N+1 Redundancy Hierarchy, AAA Override and Dynamic VLAN Assignment.