An engineer can log in to a WLC but cannot log in to the AP. Which configuration change allows the engineer to log in to the AP without changing the global login policy?

Changing the WLC password modifies the global credential, which the question explicitly prohibits and would impact all APs managed by that controller.

The AAA override feature on a Cisco WLC lets an administrator assign a separate AAA authentication method or credential set to a specific AP or AP group, bypassing the globally configured AP management login policy for that AP only. This means the engineer can authenticate to the problematic AP using credentials valid for it without altering the credentials applied to all other APs managed by the controller. It is the correct scoped solution when global policy must remain unchanged.

Override the credentials refers to statically setting a per-AP username and password field directly on the AP record, but this does not address the AAA authentication policy layer that controls login behavior.

Reloading the WLC does not alter any credential or authentication configuration and would not resolve a login failure caused by a policy mismatch.