A network engineer is deploying a new wireless monitoring solution in a large campus.

For campus wireless monitoring deployments involving Cisco Spaces, ISE, and Catalyst Center appliances, strict separation of management traffic from user data is required to maintain security and service continuity. The correct approach is to configure the switch interfaces connecting these appliances as access ports assigned to the dedicated management VLAN. This ensures that management and telemetry traffic is isolated from production WLAN traffic, preventing any disruption to end users if configuration changes are made. Assigning the management VLAN as the native VLAN on trunk ports (Option B) is inappropriate because the native VLAN still transmits untagged traffic and could allow accidental bridging with user traffic, violating security policies. PortFast (Option A) is used for rapid STP convergence on end-user ports but does not enforce VLAN separation or management isolation. Port Aggregation Protocol (Option C) is intended for link bundling and redundancy, not VLAN segmentation. Cisco Wireless best practices emphasize access port configuration for management appliances in a dedicated VLAN to guarantee security, telemetry reliability, and non-disruptive network operations. Proper implementation involves assigning a unique VLAN ID for all monitoring and management devices and configuring the switch port as an access port, ensuring consistent isolation and predictable behavior in a high-density campus environment. Reference topics:Wireless Monitoring and Management — Cisco Spaces deployment, ISE integration, management VLAN isolation, switch access port configuration.