hardMultiple ChoiceObjective-mapped
XK0-006 Practice Question: Audit all write operations to the /etc/shadow file
An administrator needs to audit all write operations to the /etc/shadow file. Which audit rule should be added to /etc/audit/rules.d/audit.rules?
⚠ Common exam trap
It's easy for candidates to confuse the `-p` permission flags with syscall-based rules, mistakenly choosing option C because they think `-S open` captures all writes, but they overlook that writes can occur via other syscalls (like `write`) and that `-w -p wa` is the correct, simpler approach for file-based auditing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
-w /etc/shadow -p wa
The audit rule `-w /etc/shadow -p wa` uses the `-w` (watch) flag to monitor the file for write (`w`) and attribute change (`a`) permissions, which captures all write operations to `/etc/shadow`. This is the standard syntax for auditing file writes in Linux auditd, and it directly meets the requirement to audit write operations without unnecessary syscall filtering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
-w /etc/shadow -k identity
Why it's wrong here
The '-k' sets a key but does not specify permissions; the '-p' flag is needed.
- ✗
-w /etc/shadow -p rwxa
Why it's wrong here
'rwxa' includes read, write, execute, and attribute change; read is unnecessary and may generate excessive logs.
- ✗
-a always,exit -S open -F path=/etc/shadow
Why it's wrong here
This watches the open syscall on the file, which may not capture all write events (e.g., writes via already open fd).
- ✓
-w /etc/shadow -p wa
Why this is correct
This watches /etc/shadow for write and attribute changes, which includes modifications.
Go deeper
Related to this question
About these practice questions
One of 979 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.