Exam 200-301 topic 1 question 626 discussion

A is not the best answer because it says UNAUTHORISED user. Once the command is executed, passwords are encrypted in the running config file. No user can view the clear text passwords anymore, unless you decrypt them. It's not only restricting unauthorised users. B is correct because plain passwords entered by administrators are converted to encrypted format. Administors cannot set clear text passwords anymore.

A is correct

Answer A is correct. From what I understand, the letter "B" seems right, but it is "wrong", because even using the "service password-encryption" command, the "enable password" or "username password" settings are configured in "clear text", but only in shown in the running-config with an encryption weak (type 7). The main purpose of the "service password-encryption" command is to prevent passwords from being displayed in plain text in the device configuration, protecting them from casual viewing (by an unauthorized user).

All passwords configured on an IOS device, with the exception of the passwords configured with enable secret password, are stored in clear-text in the device configuration file. This means that all that attacker needs to do to find out the passwords is to run the show running-config command. LINK: https://geek-university.com/service-password-encryption-command/

i think the answar is B

I was flapping between A and B but, this cleared for me: "If the service password-encryption command is set, the encrypted form of the password you create is displayed when the more nvram:startup-config command is entered. "