Which configuration helps prevent over-the-shoulder disclosure of VTY passwords?

The service password-encryption command encrypts all plain-text passwords, including those configured with the password command under VTY lines, using a weak, reversible encryption algorithm (Type 7). While not cryptographically strong, it prevents casual "over-the-shoulder" viewing of passwords in the running or startup configuration. The option line vty 0 15 password XD822j configures a plain-text password, which is visible to anyone viewing the configuration. The options username netadmin secret 7 $1$42J31k98867Pyh4QzwXyZ4 and username netadmin secret 9 $9$vFpMf8elb4RVV8$seZ/bDA use stronger, irreversible hashing (Type 5 and Type 9 respectively) for local user accounts, but these do not affect passwords configured directly on VTY lines using the password command.