Which Cisco Wireless LAN Controller feature, when enabled, restricts management access from specified networks?

CPU ACLs (Access Control Lists) on a Cisco Wireless LAN Controller (WLC) are specifically designed to filter management traffic destined for the WLC's CPU. By configuring a CPU ACL, you can restrict which IP addresses or networks are permitted to access the WLC's management interfaces (e.g., Telnet, SSH, HTTP/S, SNMP). TACACS and RADIUS are authentication, authorization, and accounting (AAA) protocols used for authenticating users who attempt to access the WLC, but they don't inherently restrict network-level access. Flex ACLs are applied to client data traffic passing through the WLC, not to management traffic targeting the WLC itself.