Which method is used to shield the client from class 3 management attacks?

With MFP, all management frames are cryptographically hashed to create a Message Integrity
Check (MIC). The MIC is added to the end of the frame (before the Frame Check Sequence
(FCS)).

When MFP is enabled on one or more WLANs configured in the WLC. the WLC sends a unique
key to each radio on each registered AP. Management frames are sent by the AP over the MFP-
enabled WLANs. These APs are labeled with a frame protection MIC IE. Any attempt to alter the
frame invalidates the message, which causes the receiving AP that is configured to detect MFP
frames to report the discrepancy to the WLAN controller.
http:llwww.cisco.com/clenlus/supportldocs/wireless-mobility/wlan-security/82196-mfp.html