Examkin

Question

Difficulty: MediumDevice Access Control and Local Password Authentication

A network administrator inspects a Cisco IOS XE switch and finds the following running configuration snippet:

text
username secadmin privilege 15 password 0 C1sc0123!
!
line vty 0 4
transport input ssh
login local

The organization's security hardening baseline requires all local database user accounts to store credentials using PBKDF2 (Type 8) password hashing rather than unencrypted plaintext (Type 0). Which global configuration command correctly updates the local user credential to meet this security standard?

  1. username secadmin privilege 15 secret algorithm-type sha256 C1sc0123!Answer
  2. B
    service password-encryption algorithm-type sha256
  3. C
    username secadmin privilege 15 password 8 C1sc0123!
  4. D
    enable secret algorithm-type sha256 C1sc0123!

Answer

The correct command is 'username secadmin privilege 15 secret algorithm-type sha256 C1sc0123!'.
The command 'username secadmin privilege 15 secret algorithm-type sha256 C1sc0123!' properly replaces the Type 0 unencrypted local password entry with a secure PBKDF2 SHA-256 (Type 8) hash for the specified local user account.

Step-by-Step Solution

1
Analyze the existing local user configuration statement
The command 'username secadmin privilege 15 password 0 C1sc0123!' uses the 'password 0' syntax, storing the credential as cleartext (Type 0).
Cleartext passwords expose administrative credentials to unauthorized viewing in running configuration files and backups.
2
Identify the Cisco IOS XE command keyword for Type 8 PBKDF2 password hashing
Using 'secret algorithm-type sha256' configures Cisco IOS XE to hash the local user password with SHA-256 based PBKDF2 (Type 8).
The 'secret' keyword replaces weak password storage methods with modern, key-stretching cryptographic algorithms.
3
Formulate the correct global configuration mode command for the specified local user account
'username secadmin privilege 15 secret algorithm-type sha256 C1sc0123!' preserves the username and privilege level while enforcing Type 8 security.
This matches all baseline security requirements specified in the scenario.

Key Concept

Cisco IOS Local Password Hashing Types and Command Syntax
Rate this question

Topics

Device Access Control and Local Password Authentication

More questions from this topic