Courseiva
← XK0-005
Full test
Question 448 of 1,000
Security →mediumMultiple ChoiceObjective-mapped

XK0-005 Security Practice Question

This XK0-005 practice question tests your understanding of security. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A security audit reveals that the /etc/shadow file is readable by all users. What is the most appropriate immediate action?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

chmod 600 /etc/shadow && chown root:shadow /etc/shadow

The /etc/shadow file stores hashed user passwords and must be protected from unauthorized access. The correct command is `chmod 600 /etc/shadow && chown root:shadow /etc/shadow` because it sets the file to be readable and writable only by the owner (root) and changes the group to 'shadow', which is the standard group used by many Linux distributions to allow certain system utilities (like `pwck` or `unix_chkpwd`) to read the file without granting access to all users. This ensures that only root and members of the shadow group can read the file, immediately fixing the security issue.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    chmod 000 /etc/shadow

    Why it's wrong here

    Removes all permissions, including root's, preventing login.

  • ✓

    chmod 600 /etc/shadow && chown root:shadow /etc/shadow

    Why this is correct

    Sets proper permissions and ownership to root and shadow group.

    Related concept

    Read the scenario before looking for a memorised answer.

  • ✗

    chmod 640 /etc/shadow

    Why it's wrong here

    Allows group read access; should be restricted to root.

  • ✗

    chmod 600 /etc/shadow

    Why it's wrong here

    Only root can read/write; correct, but not most appropriate yet.

Common exam traps

Common exam trap: answer the scenario, not the keyword

Cisco often tests the misconception that simply setting restrictive permissions (like 600) is sufficient, without also ensuring the correct group ownership (shadow), which is a common oversight in Linux security hardening.

Detailed technical explanation

How to think about this question

Under the hood, the shadow suite (shadow-utils) relies on the shadow group to control access to /etc/shadow via PAM modules like pam_unix.so. The `chown root:shadow` command ensures that only the root user and members of the shadow group can read the file, which is critical because many system services (e.g., `login`, `su`, `sudo`) need to verify passwords but should not expose hashes to all users. In a real-world scenario, a misconfigured /etc/shadow with world-readable permissions could allow any local user to extract password hashes and attempt offline cracking, leading to a full system compromise.

KKey Concepts to Remember

  • Read the scenario before looking for a memorised answer.
  • Find the constraint that changes the correct option.
  • Eliminate answers that are true in general but not in this case.

TExam Day Tips

  • Watch for words such as best, first, most likely and least administrative effort.
  • Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A practitioner preparing for the XK0-005 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related practice questions

Related XK0-005 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Security practice questions

Practise XK0-005 questions linked to Security.

Troubleshooting practice questions

Practise XK0-005 questions linked to Troubleshooting.

Scripting, Containers, and Automation practice questions

Practise XK0-005 questions linked to Scripting, Containers, and Automation.

System Management practice questions

Practise XK0-005 questions linked to System Management.

Scripting, Containers and Automation practice questions

Practise XK0-005 questions linked to Scripting, Containers and Automation.

XK0-005 fundamentals practice questions

Practise XK0-005 questions linked to XK0-005 fundamentals.

XK0-005 scenario practice questions

Practise XK0-005 questions linked to XK0-005 scenario.

XK0-005 troubleshooting practice questions

Practise XK0-005 questions linked to XK0-005 troubleshooting.

Practice this exam

Start a free XK0-005 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions20 questions30 questions50 questionsTimed 30
XK0-005 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this XK0-005 question test?

Security — This question tests Security — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: chmod 600 /etc/shadow && chown root:shadow /etc/shadow — The /etc/shadow file stores hashed user passwords and must be protected from unauthorized access. The correct command is `chmod 600 /etc/shadow && chown root:shadow /etc/shadow` because it sets the file to be readable and writable only by the owner (root) and changes the group to 'shadow', which is the standard group used by many Linux distributions to allow certain system utilities (like `pwck` or `unix_chkpwd`) to read the file without granting access to all users. This ensures that only root and members of the shadow group can read the file, immediately fixing the security issue.

What should I do if I get this XK0-005 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Last reviewed: Jul 4, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

Sign in to join the discussion.

This XK0-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-005 exam.