The Allow AAA Override setting must be enabled for the WLAN. AAA Override permits the Wireless LAN Controller to accept and apply authorization attributes returned by Cisco ISE through RADIUS, including the tunnel-type, tunnel-medium-type, and tunnel-private-group-ID attributes used for dynamic VLAN assignment. Without AAA Override, the controller generally retains the interface or VLAN statically configured on the WLAN and ignores the VLAN assignment returned by ISE. Change of Authorization allows ISE to modify or reauthenticate an existing session but does not itself enable dynamic VLAN assignment. A CWA redirect ACL is used for Central Web Authentication redirection. FlexConnect controls how access points switch client traffic at remote locations and is not the parameter that authorizes RADIUS-based VLAN overrides. The candidate file marks D, but that answer is technically incorrect; the verified answer is C.