What does the service password-encryption command accomplish?

• A. This command encrypts passwords as they are transmitted across serial WAN links.
• B. This command prevents someone from viewing the running configuration passwords.
• C. This command enables a strong encryption algorithm for the enable secret password command.
• D. This command automatically encrypts passwords in configuration files that are currently stored in NVRAM.

Answer: (B)

Obfuscating passwords stored in the device’s configuration is what this command does. It applies a reversible, but weak, type 7 encryption to plaintext passwords in the running configuration, so they don’t appear in clear text when you view the config. This helps prevent casual onlookers from reading passwords, but it’s not strong cryptography and can be decrypted easily. It doesn’t protect passwords in transit across a network, which would require SSH or other secure transport. It doesn’t change how the enable secret is stored, and it doesn’t automatically rewrite passwords in NVRAM immediately—you must save the configuration for the startup-config in NVRAM to reflect the encrypted values.