mediumMultiple ChoiceObjective-mapped
300-410 Practice Question: Examine the following partial configuration:…
Examine the following partial configuration:
username admin privilege 15 secret 5 $1$abcdefg$hashedvalue username operator privilege 1 password cisco
!
line console 0
login local !
line vty 0 4
login local transport input ssh
What is a potential security issue with this configuration?
⚠ Common exam trap
Cisco often tests the distinction between 'password' and 'secret' in username configurations, and the trap here is that candidates may overlook the security implications of using 'password' instead of 'secret' for non-privileged users, assuming it only matters for enable passwords.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'operator' username uses a password instead of a secret, which is stored insecurely in the configuration.
The 'operator' username uses a 'password' keyword instead of 'secret', which means the password is stored in plaintext (or weakly hashed) in the running configuration. Cisco recommends using 'secret' with a strong hash algorithm (e.g., MD5 or SHA-256) to protect credentials from being easily compromised if the configuration is viewed. This is a direct violation of secure device access best practices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The 'operator' username uses a password instead of a secret, which is stored insecurely in the configuration.
Why this is correct
The 'password' keyword stores the password in a reversible format (type 7 or clear), whereas 'secret' uses MD5 hashing.
- ✗
The 'admin' user has privilege 15, which is too high for administrative access.
Why it's wrong here
Privilege 15 is appropriate for full administrative access.
- ✗
The console line is missing the 'transport input' command.
Why it's wrong here
Console typically does not require 'transport input'; it's for VTY lines.
- ✗
The VTY lines should use 'login' without 'local' to allow remote authentication.
Why it's wrong here
'login local' is correct for local database authentication.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.