Which aaa command configures R1 to use RADIUS for logins and fall back to the local user database if RADIUS is unavailable?

The command aaa authentication exec default radius local correctly configures AAA for login authentication. It specifies that for all login attempts (exec default), the router should first try to authenticate users using a RADIUS server. If the RADIUS server is unreachable or authentication fails through RADIUS, the router will then fall back to its local user database. This provides redundancy and ensures users can still log in even if the RADIUS server is down. The options aaa authentication exec default radius would only attempt RADIUS and not fall back to local, potentially locking out users if RADIUS fails. The aaa authorization commands are incorrect because they deal with what a user is allowed to do after logging in, not the login process itself.