An engineer is configuring device-hardening on a router in order to prevent credentials from being seen if the router configuration was compromised. Which command should be used?

The `service password-encryption` command encrypts all unencrypted passwords in the running and startup configurations, using a weak type 7 encryption, making them unreadable to casual observers and protecting against accidental disclosure if the configuration is viewed. This command specifically obfuscates locally configured passwords, such as those for VTY lines or console access.

This command creates a username with a specified privilege level and password, but it does not encrypt existing or future passwords in the configuration.

`service password-recovery` enables or disables the password recovery mechanism, which is unrelated to encrypting passwords within the configuration itself.

This command creates a username and password, but without `service password-encryption` enabled, the password will be stored in cleartext.