An engineer must define credentials for an autonomous access point that is configured to use 802.1X authentication against the switch port is attached to. Where are the credentials defined?

In 802.1X port-based authentication, the autonomous AP is the supplicant and the switch is the authenticator; the switch forwards the AP's identity and credentials to the RADIUS server, which is the authentication server that stores the valid credentials and returns an Access-Accept or Access-Reject. The credentials (username/password or certificate) must therefore be defined on the RADIUS server so it can verify the AP's identity and permit the switchport to transition to an authorized state.

Cisco Prime Infrastructure is a network management platform used for monitoring and provisioning; it does not serve as an 802.1X authentication server and does not store supplicant credentials.

A wireless LAN controller manages lightweight APs over CAPWAP and does not function as a RADIUS authentication server for autonomous AP 802.1X supplicant authentication to a switch.

TACACS+ is a device administration protocol used for CLI access control (login, enable, command authorization), not for 802.1X port authentication, so credentials defined there would not be consulted during EAP-based port authentication.