This community bank design scenario requires precise alignment of EWC deployment scale, AAA integration, and traffic routing decisions with the stated constraints. With four APs per campus and a goal of local traffic handling, converting a single C9120 to EWC mode is optimal — converting two APs to EWC (Options B and C) on a four-AP campus wastes 50% of campus AP infrastructure for controller functions rather than client service. The single EWC AP serves as the active local controller for the remaining three client-serving APs. The HQ WLC set as N+1 backup ensures that if the branch EWC fails, the remaining APs fall back to the centralized controller. For the guest WLAN, local web authentication on the guest VLAN provides the locally routed guest access requirement without requiring WAN connectivity to HQ. For the employee WLAN, adding the HQ ISE AAA server to the EWC ' s RADIUS configuration enables 802.1x PEAP authentication to traverse the WAN to ISE at the time of client association. Once authenticated, traffic is locally switched — satisfying both the central authentication and local traffic routing requirements simultaneously. Option D ' s use of guest anchor for the employee WLAN is architecturally incorrect and would route traffic through HQ rather than locally. Reference: WLSD Study Guide — EWC Design, N+1 Redundancy, AAA Integration for Branch WLANs, Local Web Authentication.