mediumMultiple ChoiceObjective-mapped
XK0-006 Practice Question: A security audit reveals that the /etc/shadow…
A security audit reveals that the /etc/shadow file has permissions 0644 and is owned by root:shadow. The auditor states that this is a security risk because any local user can read password hashes. The administrator wants to fix the permissions to ensure that only root and the shadow group can read the file, and no one else can read it. Additionally, the administrator wants to set the immutable attribute on the file to prevent accidental modification. Which set of commands achieves the desired state?
⚠ Common exam trap
CompTIA often tests the distinction between chmod (file permissions) and chattr (extended attributes), and the trap here is that candidates may confuse the immutable attribute (+i) with the append-only attribute (+a) or mistakenly use chmod to set it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
chmod 640 /etc/shadow; chattr +i /etc/shadow
Chmod 640 sets the file permissions to read/write for root (owner) and read-only for the shadow group, while removing all access for others. chattr +i sets the immutable attribute, which prevents any modifications (including deletion, renaming, or content changes) even by root until the attribute is removed. This satisfies the requirement that only root and the shadow group can read the file, and no one else can read it, while also protecting against accidental modification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
chmod 640 /etc/shadow; chattr +i /etc/shadow
Why this is correct
Sets permissions to owner rw, group r, others none; then sets immutable attribute.
- ✗
chmod 640 /etc/shadow; chattr +a /etc/shadow
Why it's wrong here
chattr +a sets append-only, not immutable; the file can still be read.
- ✗
chmod 640 /etc/shadow; chmod +i /etc/shadow
Why it's wrong here
chmod +i is not a valid command; must use chattr.
- ✗
chmod 600 /etc/shadow; chattr +i /etc/shadow
Why it's wrong here
chmod 600 removes group read, so shadow group cannot read the file.
Go deeper
Related to this question
Learn chapter
File Permissions and Ownership
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 979 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.