Apply an exec authorization method that checks a AAA server first, then local users, and denies access if both fail. Which configuration does this?

The correct command, aaa authorization exec default group radius local, configures the authorization method list named "default" for EXEC sessions. It specifies that the router should first attempt authorization using the RADIUS server group. If the RADIUS server is unavailable or authorization fails, it then attempts authorization using the local user database. If both methods fail, access is denied by default because no further methods are specified. The incorrect option aaa authorization exec default local group radius none would try local authentication first, then RADIUS, and none would explicitly allow access if both fail, which contradicts the requirement to deny access. The option aaa authorization exec default group radius local none also includes none, which would allow access if RADIUS and local fail. The option aaa authorization exec default local group tacacs+ uses TACACS+ instead of RADIUS and also tries local first.