5.3 Device Access and Local Passwords

Question 1

Define:

local authentication

Answer 1

A method where users log in using credentials stored on the device.

Local authentication is used when no external authentication servers (AAA) are configured.

Question 2

What command sets a local username and password on a Cisco device?

Answer 2

username < user> secret < password>

The secret keyword encrypts the password, unlike password, which is stored in plain text.

Question 3

What happens when no local password is set on a console or VTY line?

Answer 3

VTY access is denied without a password, while console access is open unless login is enforced.

By default, Cisco devices allow console access without a password unless explicitly configured with the login command.

Question 4

List three types of passwords used to secure access on Cisco devices.

Answer 4

1. Console password
2. VTY (Telnet/SSH) password
3. Enable secret password

Console password – Secures access to the device via the physical console port.

VTY (Telnet/SSH) password – Controls remote access through Telnet or SSH sessions.

Enable secret password – Protects privileged EXEC mode with an encrypted password.

Question 5

True or False:

The ‘enable password’ command is more secure than ‘enable secret’.

Answer 5

False

‘enable secret’ encrypts the password with MD5, while enable password stores it in plain text.

Question 6

Fill in the blank:

The command to encrypt plain-text passwords in a Cisco configuration is ______ ______.

Answer 6

service password-encryption

This command prevents casual viewing of passwords in the configuration file but uses weak encryption (Type 7).

Question 7

What command enables password authentication for console access?

Answer 7

line console 0 → password < password> → login

Without the login command, the password is ignored.

Question 8

What happens if both enable password and enable secret are configured?

Answer 8

The device prioritizes enable secret over enable password.

‘enable password’ is ignored when ‘enable secret’ is set.

Question 9

Why use an enable secret password over enable password?

Answer 9

It provides better security through encryption.

MD5 hashing protects enable secret passwords, whereas enable password is stored in plaintext.

Question 10

List two ways to strengthen password security on Cisco devices.

Answer 10

1. Use enable secret instead of enable password
2. Enforce password complexity with minimum length, uppercase, lowercase, numbers, and special characters.

Implementing enable secret ensures that the password is stored using a more secure hashing algorithm. Additionally, enforcing password complexity rules enhances security by making passwords more resistant to brute-force attacks.

Question 11

True or False:

The enable secret password can be decrypted by default.

Answer 11

False

It is hashed with MD5, making it non-reversible.

Question 12

Why should Telnet be disabled on production devices?

Answer 12

It transmits credentials in plaintext.

SSH is recommended since it encrypts login credentials, preventing eavesdropping attacks.

Question 13

What command restricts remote access to only SSH connections?

Answer 13

transport input ssh

This is configured under line vty mode to block insecure Telnet access.

Question 14

What does show running-config | include password display?

Answer 14

It filters and displays all configured passwords.

This command helps administrators review password configurations while troubleshooting.

Question 15

What command verifies user login attempts and authentication methods?

Answer 15

show login

This command tracks failed and successful login attempts, along with the authentication methods used.

Question 16

Fill in the blank:

The command ______ ______ ______ allows the device to display login failure messages.

Answer 16

login on-failure log

This feature helps track failed login attempts to detect potential security threats.

Question 17

What command logs failed login attempts and temporarily locks accounts?

Answer 17

login block-for < time> attempts < number> within < seconds>

This protects against brute-force attacks by locking accounts after repeated failures.

Question 18

List two commands to remove passwords from a Cisco device.

Answer 18

1. no enable secret
2. no username < user>

These commands delete passwords but should be used with caution.

Question 19

True or False:

The show version command displays password settings.

Answer 19

False

Passwords are visible in show running-config, not show version.

Question 20

What command removes all user-configured passwords?

Answer 20

‘write erase’ followed by ‘reload’

This resets the device to factory defaults, erasing all configurations.

Question 21

List two commands to verify password configurations.

Answer 21

1. show running-config
2. show startup-config

These commands display stored passwords and security configurations.