How to configure APIC GUI fallback to local authentication?
A Cisco APIC is configured to authenticate users by using RADIUS by default. The network administrator must ensure that the users can access the APIC GUI with a local account if the RADIUS server is unreachable. Which action achieves this goal?
Community Votes
80% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests the difference between creating an optional login domain and configuring an automatic fallback domain for default authentication when RADIUS fails.
This page explains how to configure Cisco APIC to fall back to local authentication when the default RADIUS server is unreachable. It establishes that configuring the fallback login domain to reference the Local Realm is the correct action.
Choosing D, because creating an additional login domain allows local access but does not make it an automatic fallback upon RADIUS failure.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Configuring the fallback login domain to reference the Local Realm (Option B) directly fulfills the requirement of providing local access only when the RADIUS server is unreachable. In Cisco APIC, the default authentication can be set to check a fallback domain if the primary authentication method fails. By pointing this fallback domain to the Local Realm, the APIC will automatically attempt local authentication using locally defined accounts when RADIUS is down.Why the Other Options Are Wrong
Option A, enabling the Fallback Check for Default Authentication, is only a partial step; it enables the check but does not specify the Local Realm as the fallback target. Option C, setting the RADIUS Realm to connect with Console Authentication, is irrelevant to GUI access and fallback behavior. Option D, creating an additional login domain to associate with local accounts, makes local authentication available but requires the user to manually select that domain at the login screen; it does not provide an automatic fallback when RADIUS fails.Community Comment Notes
Commenters debated between B and D, noting that D allows users to always choose local authentication. As cha_dadi_exams noted, "with D option you give the opportunity to the user to always choose local authentication. Although B is only a fall back if radius fails". This distinction is critical for the question's specific fallback requirement.Official Reference
Exam Strategy
Pay close attention to the specific trigger for the alternative authentication method. If the question asks for an automatic 'fallback' when the primary method fails, configure the fallback domain; if it asks for user-selectable domains, create an additional login domain.