Examkin

Question

Difficulty: MediumDevice Access Control and Local Password Authentication

A network administrator reviews a Cisco IOS XE router configuration and notices the following line in the running configuration:

`username netadmin privilege 15 password 7 08221509421E05150C`

This entry was created after a technician executed `username netadmin privilege 15 password 0 SecretPass123` followed by `service password-encryption`.

Which statement accurately describes the primary security risk of using this password storage method compared to configuring `username netadmin secret SecretPass123`?

  1. The Type 7 algorithm uses weak vigenère-based obfuscation that can be easily reversed to plain text using standard tools.Answer
  2. B
    The service password-encryption setting encrypts credentials only in NVRAM, leaving plain text passwords exposed in active RAM.
  3. C
    Using password 0 forces AAA fallback to TACACS+ or RADIUS, disabling local database authentication across VTY lines.
  4. D
    The password keyword automatically restricts user privileges to Level 1 during SSH sessions regardless of the privilege level configured.

Answer

The Type 7 algorithm uses weak vigenère-based obfuscation that can be easily reversed to plain text using standard tools.
The statement identifying Type 7 as a weak, reversible algorithm is correct. In Cisco IOS, using the `password` command combined with `service password-encryption` produces a Type 7 obfuscated password string. Type 7 uses a simple vigenère-style cipher designed purely to prevent shoulder surfing. It is easily reversible back to plain text. To secure local credentials, administrators should use the `username <name> secret <password>` command, which uses secure one-way hash algorithms (Type 5, Type 8, or Type 9).

Step-by-Step Solution

1
Analyze the password syntax used in the configuration command
The command `username netadmin password 0 SecretPass123` creates a local database account using plain text (Type 0).
The `password` keyword in Cisco IOS specifies unhashed or weak password storage unless superseded by `secret`.
2
Evaluate the effect of `service password-encryption`
It converts plain text passwords into Type 7 obfuscated strings in the configuration file.
Type 7 encryption uses a well-known, simple reversible cipher intended solely to protect against visual inspection over an admin's shoulder.
3
Compare Type 7 password storage with the `secret` keyword
The `secret` keyword applies strong one-way cryptographic hashing (Type 5 MD5, Type 8 PBKDF2 SHA-256, or Type 9 scrypt), which cannot be reversed back to plain text.
Hardening Cisco IOS device access requires non-reversible hashing algorithms rather than reversible Type 7 obfuscation.

Key Concept

Local Password Hashing vs Type 7 Obfuscation in Cisco IOS
Rate this question

Topics

Device Access Control and Local Password Authentication

More questions from this topic