Which configuration protects the password for the VTY lines against over-the-shoulder attacks?

The `line vty 0 15` command simply specifies the range of virtual terminal lines to configure; it does not encrypt passwords.

While `secret` passwords are encrypted using a strong (Type 5) hash, this command configures a specific local user password and does not affect unencrypted passwords configured elsewhere, such as with `password` on VTY lines.

The `line vty 0 4` command, similar to option A, only specifies a range of VTY lines and does not provide password encryption or protection.

The `service password-encryption` command encrypts all unencrypted passwords, including those configured with the `password` command on VTY lines, using a weak but irreversible Type 7 encryption. This obfuscates the passwords when viewing the configuration, protecting them from casual observation (over-the-shoulder attacks).