An engineer must configure router R1 to validate user logins via RADIUS and fall back to the local user database if the RADIUS server is not available. Which configuration must be applied?

The `aaa authentication exec default` command specifies the authentication method list for accessing the EXEC shell. `radius` is configured as the primary method, causing the router to attempt authentication against the RADIUS server first. `local` is the fallback method, ensuring that if the RADIUS server is unreachable, the router will then authenticate against its locally configured user database, fulfilling the requirement.

This command specifies RADIUS as the only authentication method and does not include a fallback mechanism to the local user database, meaning user logins would fail if the RADIUS server is unavailable.

This command configures `authorization`, which determines what a user can do after authentication, rather than `authentication`, which verifies the user's identity during login.

This command configures `authorization` instead of `authentication`, and it also lacks the necessary fallback to the local user database, making it incorrect for the stated requirement.