For configuring guest access on a Cisco Catalyst 9800 WLC using an external WebAuth server, the WLAN must be explicitly associated with the external server through a parameter map. The correct command syntax in Cisco IOS XE iswireless wlan < wlan-name > followed bysecurity web-auth external < parameter-map > . This configuration links the WLAN to the external WebAuth server defined in the parameter map, allowing guests to be redirected to the portal for authentication. The parameter map (webauth-ext) contains details such as server IP, port, and other authentication parameters required for the external WebAuth interaction. Option B is incorrect because it improperly uses multiple WLAN names in one command, which is not valid syntax. Option C usesparameter external security-map, which is invalid and does not associate the WLAN correctly with the WebAuth server. Option D incorrectly combines the security and parameter-map syntax and is not supported in IOS XE for external WebAuth. Cisco Wireless Core Technologies recommends this approach for centralized guest management, allowing consistent enforcement of guest policies, seamless authentication, and integration with external WebAuth servers across multiple WLANs and APs. Reference topics:Client Connectivity Configuration — WebAuth, external guest portal, WLAN parameter map configuration, Cisco IOS XE 17.x.