When AAA login authentication is configured on Cisco routers, which two authentication methods should be used as the final method to ensure that the administrator can still log in to the router in case the external AAA server fails? (Choose two.)

A.
group RADIUS

B.
group TACACS+

C.
local

D.
krb5

E.
enable

F.
if-authenticated