Which Cisco DNA Center setting allows running diagnostic CLI commands on managed devices?

The correct answer is Enable Command Runner. Cisco DNA Center's Command Runner feature specifically allows administrators to execute CLI commands on managed network devices directly from the DNA Center interface, facilitating diagnostics, troubleshooting, and configuration verification. Enabling Secure Shell (SSH) is a prerequisite for secure remote access to devices but doesn't, by itself, provide the DNA Center integration for running commands. Enabling APIs allows programmatic interaction with DNA Center itself or devices, but Command Runner is the dedicated DNA Center feature for CLI execution. Enabling CDP (Cisco Discovery Protocol) is for discovering neighboring devices and has no direct role in running diagnostic commands from DNA Center.