An engineer must configure R1 for a new user account. The account must meet these requirements: * It must be configured in the local database. * The…

The question requires configuring a user account with the strongest possible password

protection. Among the options presented, using the scrypt algorithm provides the

highest level of security. Cisco IOS supports several password hashing types, and

scrypt (Type 9) is specifically designed to be computationally and memory-intensive.

This makes it significantly more resistant to modern brute-force and dictionary attacks,

including those using specialized hardware like FPGAs and ASICs, compared to older

algorithms like SHA-256 or MD5. The command username engineer2 algorithm-type

scrypt secret test2021 correctly implements this strongest available mechanism.

•

B: This option uses secret 5, which corresponds to the MD5 hashing algorithm.

MD5 is considered cryptographically weak and is significantly less secure than

scrypt.

/561

•

C: This option uses password 7, which is not a true hash but a weak, reversible

Vigenè re cipher. It offers minimal security and is easily decrypted. The password

keyword is always less secure than the secret keyword.

•

D: This option uses secret 4, which corresponds to a salted SHA-256 hash.

While SHA-256 is a strong hashing algorithm, it is less resistant to hardware-

accelerated brute-force attacks than scrypt.

1. Cisco, "Password Security," Security Configuration Guide: Securing User

Services, Cisco IOS XE Release 3S.

o This guide details the different password encryption types. It states: "Type

9 passwords use the scrypt algorithm... We recommend Type 9 passwords

because they are the most secure."

o URL: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/secs1-cr-book/sec-cr-s1/sec-passwords.html (See the table "Password

Encryption Types" and the description for Type 9).

2. Cisco, "username," Security Command Reference: Commands T to Z,

Cisco IOS XE Gibraltar 16.12.x.

o This command reference shows the syntax username name [algorithm-

type {pbkdf2 | scrypt}] [privilege level] [view view-name] {password [0 | 7]

password | secret [0 | 4 | 5 | 8 | 9] secret}. It confirms that scrypt is a

configurable algorithm-type.

o URL: https://www.cisco.com/c/en/us/td/docs/iosxml/ios/sec_data_login/command/sec-t-z/sec-s3.html#wp1974737275

(See the username command syntax and parameter descriptions).

3. IETF RFC 7914: The scrypt Password-Based Key Derivation Function.

o This RFC provides the official specification for the scrypt algorithm,

detailing its design to frustrate attacks using custom hardware. This

establishes scrypt as a state-of-the-art, strong hashing function

appropriate for high-security applications.

o URL: https://doi.org/10.17487/RFC7914 (See Section 1: Introduction).

/561