CCNP Infrastructure Practice Question
Which TWO methods can be used to prevent unauthorized access to the privileged EXEC mode on a Cisco router? (Choose two.)
⚠ Common exam trap
Cisco often tests the distinction between commands that protect privileged EXEC mode (enable password/secret) versus commands that protect user EXEC mode (login local) or merely obscure passwords (service password-encryption), leading candidates to select options that do not actually control access to the enable prompt.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the enable secret password.
The privileged EXEC mode (enable mode) is protected by either the `enable password` or `enable secret` command. The `enable secret` command uses a stronger MD5-based hash (or SHA-256 in newer IOS versions) to store the password, making it the recommended method. Both commands restrict access to privileged EXEC mode by requiring a password before executing `enable`.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable AAA authentication.
Why it's wrong here
AAA is a broader framework.
- ✓
Configure the enable secret password.
Why this is correct
Provides encrypted access.
- ✗
Use the service password-encryption command.
Why it's wrong here
Encrypts passwords but does not set enable password.
- ✓
Configure the enable password.
Why this is correct
Sets an unencrypted enable password.
- ✗
Configure login local on the console line.
Why it's wrong here
This is for user authentication, not enable.
About these practice questions
This 350-401 question is part of Courseiva's 1,175-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.