Which configuration protects VTY line passwords from over-the-shoulder exposure?

The service password-encryption command encrypts all unencrypted passwords, including those configured for VTY lines, using a weak type 7 encryption. While this encryption is easily reversible, it prevents casual "over-the-shoulder" viewing of passwords in the running or startup configuration. The options line vty 0 15 password $2$FpM7f82! and line vty 0 4 password $2$FpM7f82! show a type 8 or 9 (stronger) hashed password, which is a better security practice for individual passwords, but service password-encryption specifically addresses the protection of all unencrypted passwords from casual viewing. The username admin secret 7 6j809J23kpp438337113N7%e$ command encrypts a local username password using type 7 encryption, but it doesn't apply to VTY line passwords unless they are explicitly configured with login local.