The correct configuration issecurity wpa wpa2 ciphers gcmp256. The WLAN already contains WPA3, SAE, FT-SAE, SAE-EXT-KEY, and FT-SAE-EXT-KEY AKMs, so adding another SAE-EXT-KEY command is not the missing element. For Wi-Fi 7 operation, Cisco states that WPA3-Personal requiresGCMP256 with SAE-EXT-KEY and/or FT + SAE-EXT-KEY, and that AES/CCMP128 clients do not operate as Wi-Fi 7 clients when the required stronger cipher combination is absent. Cisco’s Catalyst 9800 WPA3 security enhancement guide gives the CLI syntax directly:security wpa wpa2 ciphers gcmp256, which configures GCMP-256 cipher support.

Option D is therefore the only valid WLC command that enables the required cipher for Wi-Fi 7-capable client operation and higher throughput behavior. Option A uses incorrect syntax and is already functionally represented in the exhibit assecurity wpa akm sae ext-key. Options B and C use invalid cipher constructs; TKIP is legacy and incompatible with modern high-throughput WLAN operation. Reference topics:802.11be/Wi-Fi 7 security requirements, WPA3-Personal, SAE-EXT-KEY, GCMP-256 cipher support, and Catalyst 9800 WLAN security configuration.