APIC Fallback Authentication for Local Access
A Cisco APIC is configured with RADIUS authentication as the default. The network administrator must ensure that users can access the APIC GUI with a local account if the RADIUS server is unreachable. Which action must be taken to accomplish this goal?
Community Votes
72% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests ACI authentication fallback mechanisms, where the common trap is confusing fallback domains with additional login domains.
Configuring APIC authentication realms to ensure GUI access via local accounts when the primary RADIUS server is unreachable requires creating a dedicated login domain.
Option B is often chosen because it sounds like 'fallback,' but in ACI, the fallback domain is a specific system-level setting that does not automatically create a user-selectable login option without proper realm configuration.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Creating an additional login domain (Option C) allows users to explicitly select the local authentication method. In Cisco ACI, authentication realms are processed in order, and by defining a separate domain for local accounts, you provide a distinct path for authentication that remains available even if external servers fail.Why the Other Options Are Wrong
Option A associates console auth with RADIUS, which worsens the outage scenario. Option B references the local realm in the fallback domain; while this configures the system to try local auth, it doesn't necessarily expose a selectable login option for users in the same way a dedicated domain does, and best practices favor explicit domains. Option D enables fallback checks but relies on the default domain, which might still be tied to RADIUS if not configured correctly.Community Comment Notes
Comments indicate confusion between options B and C. One user noted that while both might work technically, Cisco documentation suggests creating another local domain as the best practice. Another user argued that creating an additional domain gives users the possibility to choose local credentials explicitly.Exam Strategy
Always look for the 'best practice' solution in ACI questions. When redundancy is required for authentication, creating a separate login domain is the standard approach to ensure user choice and clear separation of concerns.
Frequently Asked Questions
Why is Option B incorrect for fallback authentication?
Referencing the local realm in the fallback domain configures the system's internal fallback behavior but may not provide a user-selectable login option in the GUI as reliably as a dedicated domain.
What is the best practice for APIC local authentication?
Cisco recommends creating an additional login domain specifically for local accounts to ensure clear separation and reliable access during primary server outages.