When AAA login authentication is configured on Cisco routers, which two authentication
methods should be used as the final method to ensure that the administrator can still log in to
the router in case the external AAA server fails? (Choose two.)

A.
group RADIUS

B.
group TACACS+

C.
local

D.
krb5

E.
enable

F.
if-authenticated

Explanation:
http://www.cisco.com/en/US/docs/ios/12_2/security/configuration/guide/scftplus.html