What is one requirement for the switch to accept the message and authorize the client?

An AOS-Switch enforces 802.1X. It receives an Access-Accept with this HPE VSA from its Radius server:

Attribute Name and ID = HPE-User-Role (25) Value = contractor

The switch then rejects the client.

What is one requirement for the switch to accept the message and authorize the client?
A . The initial user role must be set to the factory default permit any role.
B . User role authorization must be enabled globally on the switch.
C . An aaa authentication local user group must have the contractor name.
D . The RADIUS server settings must permit dynamic authorization.

Answer: D