Exam 300-135 topic 7 question 35 discussion

A is the correct answer service password-encryption is encrypt all password appear on the configuration using type 7. The question specifically ask about enable password only

The best way I like to remember it is: Enable Secret: hashes your enable password so that even if someone has access to the configuration and could copy / paste the code into a Cisco Password Cracker they still wouldn't be able to figure out what the correct password is. Service password-encryption: This is used for encrypting all your passwords so that they cannot be easily read by people watching you configure the switch over your shoulder. It is a lot better having the passwords not show clear text as then other people who don't need to be accessing the switch still do not know. Now, you don't want to be passing around your configs to everyone because if they get the config and copy / paste the password, even with service password-encryption enabled, it will be easily crackable in many websites. The only secure way is using enable secret. So correct answer is A.

enable secret: only enable pass encrypted service password-encryption: all password on a device is encrypted (vty, con....)

Correct answer is C

This is a very poorly worded question. The enable password is different than the enable secret – in fact it is possible to have both of them present on a device at the same time (if they are both present the enable secret takes precedence). I feel like the answer is C as it involves encrypting the enable PASSWORD (even though it is a less secure encryption than would be used on the enable SECRET).

C service password-encryption -> Encrypt passwords. To specify an additional layer of security over the enable password command, use the enable secret command. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/d1/sec-d1-cr-book/sec-cr-e1.html#wp3438133060

Correct answer is C. The question does not state how securely in the way of comparison, so in regard of the question both md5 and type 7 (vigerene if i remember correctly) are both secure enough. Enable secret produces a hash from a seed, it does not encrypt. Hence the question does ask to securely which command securely encrypts the enable password, thus C is correct