mediumMultiple SelectObjective-mapped
XK0-006 Practice Question: A security audit identifies that the system's…
A security audit identifies that the system's /etc/passwd file is world-readable. Which three security issues does this pose? (Select THREE.)
⚠ Common exam trap
A common mix-up: candidates confuse the legacy practice of storing password hashes in /etc/passwd with the modern shadow password suite, and mistakenly select options A or E, not realizing that /etc/shadow is the actual hash store.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attackers can obtain usernames easily.
The /etc/passwd file contains a list of all system usernames. Since the file is world-readable, any user or attacker can easily read this file to enumerate valid usernames, which is a common first step in password guessing or brute-force attacks. Usernames are stored in the first colon-delimited field of each line, making them trivially extractable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attackers can read the encrypted passwords.
Why it's wrong here
Historically passwords were stored in /etc/passwd, but modern systems store them in /etc/shadow.
- ✓
Attackers can obtain usernames easily.
Why this is correct
/etc/passwd lists all local usernames.
- ✓
Attackers can see home directory paths.
Why this is correct
Home directory paths are listed in /etc/passwd.
- ✓
Attackers can see user ID mappings.
Why this is correct
The file contains UID and GID numbers for each user.
- ✗
Attackers can read password hashes.
Why it's wrong here
Password hashes are stored in /etc/shadow, which is not world-readable.
Go deeper
Related to this question
Learn chapter
File Permissions and Ownership
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
passwd
passwd is a command-line utility used on Linux and Unix-like systems to change a user's password, typically stored in an encrypted format in the /etc/shadow file.
About these practice questions
One of 979 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.