Question

Difficulty: HardDevice Access Control and Local Password Authentication

A network security administrator must perform a local password recovery procedure on a Cisco IOS router after administrative credentials were lost. Arrange the procedural steps in the correct chronological order required to restore administrative access without losing the active device configuration.

  1. 1Interrupt the normal boot sequence to enter ROMMON mode and set the configuration register to `0x2142`.
  2. 2Initialize the router boot process into Cisco IOS and enter privileged EXEC mode without entering a password.
  3. 3Execute the `copy startup-config running-config` command in privileged EXEC mode.
  4. 4Configure a new password using `enable secret` in global configuration mode.
  5. 5Revert the configuration register to `0x2102` and save the memory state using `copy running-config startup-config`.

Answer

The correct chronological sequence for Cisco IOS password recovery is: 1) Interrupt the boot sequence in ROMMON and set the configuration register to `0x2142`. 2) Boot into Cisco IOS and enter privileged EXEC mode without password prompt. 3) Execute `copy startup-config running-config`. 4) Set a new password using `enable secret`. 5) Revert the configuration register to `0x2102` and save changes with `copy running-config startup-config`.
The correct sequence follows standard Cisco IOS administrative recovery: First, interrupt boot in ROMMON to change the register to `0x2142`, ignoring startup configuration. Second, complete boot into privileged EXEC mode without credentials. Third, copy startup configuration into running configuration (`copy startup-config running-config`) to restore network settings into RAM. Fourth, define a new password using `enable secret`. Fifth, reset the register to `0x2102` and save the configuration (`copy running-config startup-config`) to NVRAM.

Step-by-Step Solution

1
Change configuration register in ROMMON mode
Configuration register value set to `0x2142`
Forces Cisco IOS to bypass reading NVRAM (startup-config) during boot up.
2
Boot device and access privileged EXEC mode
Router boots to `Router>` and allows `enable` without credential prompt
Since startup-config is ignored, no local authentication controls or passwords are loaded.
3
Load startup configuration into active RAM using `copy startup-config running-config`
Original operational configuration is restored into RAM
Preserves all existing router settings so they are not accidentally wiped when saving.
4
Configure a new password using `enable secret` in global configuration mode
New encrypted password replaces the old locked password in running-config
Updates the local access password in RAM while keeping all restored settings.
5
Reset configuration register to `0x2102` and save running configuration to startup configuration
Router register set back to normal boot mode and startup-config in NVRAM updated
Ensures future reboots load configuration from NVRAM normally with the new password.

Key Concept

Cisco IOS Local Password Recovery Procedure and Configuration Register Values
Rate this question