When is local EAP authentication on the controller used?

A.
To authenticate the APs that act as 802.1X supplicants

B.
As a backup in case the APs cannot reach the controllers

C.
As a backup in case the RADIUS servers are not reachable

D.
When deploying guest access using the anchor controller