A resort expands SD-Access to outdoor pools and villas, needing wireless clients to roam without reauthentication, enforce the same segmentation as wired guests, and let staff provision SSIDs centrally. Which fabric wireless and Catalyst Center design should the designer propose for policy and automation?

Fabric-enabled wireless with shared SGT policy, host-tracking roaming, and Catalyst Center is the right design because host tracking preserves client entries across APs, supporting seamless Layer 2 and Layer 3 roaming without a full 802.1X exchange at every roam. SGT-based Group-Based Policy also extends the wired guest virtual-network segmentation to wireless, while Catalyst Center centrally provisions SSIDs, policy, and RF profiles and provides automation and assurance. Requiring a full 802.1X EAP exchange on every AP roam adds latency and defeats seamless mobility, even though it retains SGT policy. VLAN pools and downloadable ACLs isolate clients through a traditional VLAN-and-ACL model rather than propagating fabric SGTs, so wired and wireless guests do not receive consistent TrustSec Group-Based Access Control. Provisioning SSIDs through Prime Infrastructure misses the SD-Access policy-controller role: Prime cannot automate fabric host pools, controller PnP, SGT bindings, or intent-based assurance. An exam caveat is that roaming or centralized SSID management alone does not establish integrated SGT policy; check that the proposed design includes all three: fabric wireless, shared SGT policy, and Catalyst Center automation. In practice, verify that Catalyst Center binds the SSID to the guest virtual network, inspect the SGT matrix and roaming history in assurance, and confirm 802.11r/k/v and host tracking remain enabled across the outdoor AP group.