Refer to the exhibit.

The two RADIUS servers are reached through different Layer 2 and routing contexts. RAD1 is reachable through the management interface, while RAD2 is reachable through VLAN 22. Configuring the correct source interface for each RADIUS server group ensures that authentication requests originate from an IP address belonging to the subnet that the corresponding server permits. Separate AAA login method lists must then associate console authentication with RAD1 and remote SSH authentication with RAD2. Command authorization controls whether authenticated users may execute particular commands; it does not determine which server authenticates console or SSH access. Changing the dead timer only alters how long an unresponsive server is avoided and does not meet either authentication-selection requirement. Therefore, both the per-group source-interface configuration and the service-specific AAA authentication method lists are required.