Examkin

Question

Difficulty: MediumPassword Security Policies, MFA, and Certificates

A security policy requires that all locally configured administrative accounts on Cisco network devices store passwords using strong one-way cryptographic hashing instead of reversible encryption. During an audit, an engineer inspects a switch configuration and discovers the command `username netadmin password 7 0822455D0A16`. Which action must the engineer take to bring this account configuration into compliance with the security policy?

  1. Reconfigure the account using the `username netadmin secret` command so the password is saved using a one-way hash algorithm.Answer
  2. B
    Execute the global configuration command `service password-encryption` to upgrade existing Type 7 passwords to SHA-256 hashes.
  3. C
    Configure `enable password` for the account to automatically enforce one-way encryption across all vty lines.
  4. D
    Save the configuration using `copy running-config startup-config` to trigger automatic conversion of password storage types.

Answer

Reconfigure the account using the `username netadmin secret` command so the password is saved using a one-way hash algorithm.
Replacing the configuration with `username netadmin secret` ensures that Cisco IOS stores the password using a strong one-way hash (such as Type 5 MD5 or Type 8/9 SHA-256/scrypt). Because it is a one-way function, the original password cannot be decrypted from the configuration file, satisfying the security policy.

Step-by-Step Solution

1
Analyze the existing password type in the device configuration.
The configuration entry uses `password 7`, which indicates Cisco Type 7 weak reversible encryption.
Type 7 encryption uses a simple Vigenère cipher that can be instantly decrypted using publicly available tools.
2
Identify the command required to store local account passwords securely as one-way hashes.
The `username <name> secret <password>` syntax creates a one-way cryptographic hash (Type 5 MD5, Type 8 PBKDF2 with SHA-256, or Type 9 scrypt).
One-way hashing prevents administrative passwords from being reversed or recovered if the configuration file is exposed.

Key Concept

Cisco IOS Password Storage (Type 7 reversible encryption vs. Type 5/8/9 one-way secret hashes)
Rate this question

Topics

Password Security Policies, MFA, and Certificates

More questions from this topic