easyMultiple Choice
XK0-006 A security audit reveals a misconfiguration Practice Question
Network Topology
A security audit reveals a misconfiguration. Which file has insecure permissions that could allow unauthorized users to read password hashes?
⚠ Common exam trap
CompTIA often tests the misconception that /etc/passwd contains password hashes (as it did in older Unix systems), but modern Linux distributions use shadow passwords, so the hashes are exclusively in /etc/shadow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
/etc/shadow
The /etc/shadow file stores password hashes and should be readable only by the root user (typically permissions 640 or 600). If its permissions are too permissive (e.g., world-readable), any local user could read the hashes and attempt offline cracking. This is the misconfiguration the audit would flag.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Both files are misconfigured
Why it's wrong here
/etc/shadow and /etc/passwd differ on where hashes reside: shadow stores them, passwd holds placeholders. Only /etc/shadow's permissions expose hashes, so claiming both are misconfigured is wrong. It tempts because /etc/passwd's world-readable mode looks alarming, yet that is its intended design for username lookups.
- ✓
/etc/shadow
Why this is correct
/etc/shadow stores password hashes and must be readable only by root, typically mode 000 or 640 with group shadow. Insecure permissions such as world-readable allow any local user to copy hashes for offline cracking. This directly satisfies the audit's requirement to identify the file exposing password hashes.
- ✗
Neither file has a misconfiguration
Why it's wrong here
A misconfiguration does exist: /etc/shadow must be root-only (000 or 640), and world-readable permissions expose password hashes. It is tempting because /etc/passwd legitimately holds no hashes on modern systems, and it would be correct if only that file were in scope.
- ✗
/etc/passwd
Why it's wrong here
/etc/passwd holds account metadata — usernames, UIDs, home directories, login shells — not password hashes, which live in /etc/shadow. Its world-readable 644 permissions are therefore normal and expected. The option tempts because /etc/passwd historically stored hashes before shadowing moved them; it would be the answer if the question asked where user account records reside.
Go deeper
Related to this question
About these practice questions
One of 781 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.