A store uses FlexConnect local switching. When the WAN to the controller fails, already connected clients keep passing local traffic, and new clients cannot authenticate. Central authentication is the only method configured. What is missing for new clients during that failure?
Select an answer to reveal the explanation.
Short Explanation
The clients already on your WLAN can keep using the local network, but a new client still needs an authentication answer and the controller is gone. Local authentication is the copy of that answer on the access point. Hiding the name does not invent it.
Full Explanation
FlexConnect central authentication asks the controller, and usually the RADIUS server behind it, to accept a new client. When the WAN to the controller fails, that check cannot complete, so new clients fail even though locally switched clients who were already on keep passing traffic. Local authentication lets the access point authenticate new clients while the controller is unreachable. That is the missing piece. Sniffer mode captures frames and does not authenticate anyone. A WAN failure does not turn an access point into a sniffer that magically accepts clients. A hidden SSID does not skip authentication. New clients would still need a successful security handshake, and hiding the name does not store credentials on the access point. Monitor mode scans and does not keep a RADIUS server. It would stop client service rather than back it up. Exam caveat: local authentication has to be set up before the outage, with the users or the backup method actually present on the access point. Turning it on after the WAN is down does not help the clients who are failing now. Operational check: fail the WAN in a maintenance window and confirm a new test client can authenticate locally and receive an address from the branch.