A retail store is setting up guest Wi-Fi on a Cisco 9800 WLC.

For a retail guest WLAN deployment, Cisco best practices dictate using central web authentication (web-auth) combined with access control lists (ACLs) to enforce network segmentation and restrict guest traffic to internet-only access. Central web authentication allows all guest devices to be redirected to a captive portal for login without requiring a pre-shared key or WPA2-Enterprise credentials, satisfying the “no password” requirement. Applying an ACL that blocks access to internal subnets ensures that guest traffic cannot interfere with corporate networks while still permitting internet connectivity. Option A is unsuitable because WPA2-Enterprise and dynamic VLAN assignment are designed for employee or secure networks, not open guest access. Option B provides local web-auth, which is limited to a single WLC and does not scale across multiple floors effectively. Option D (MAC filtering) only enforces device-level access but does not provide web-based login or segmentation, failing the requirement for captive portal and internet-only access. Cisco Wireless Core Technologies recommend central web authentication with ACL enforcement for guest networks to provide consistent coverage, network isolation, and compliance with security policies across multiple APs and WLCs. Reference topics:Client Connectivity Configuration — Guest WLAN deployment, central web-auth, ACL enforcement, segmentation from corporate WLAN.