easyMultiple ChoiceObjective-mapped
How to Fix Insecure /etc/shadow Permissions (chmod 600)
A security audit reveals that the /etc/shadow file has permissions 777. Which command should be used to correct this vulnerability?
Quick Answer
The correct command is `chmod 600 /etc/shadow`, which sets read and write permissions exclusively for the root owner while stripping all access from group and others. This is essential because the /etc/shadow file stores hashed user passwords, and permissions 777 would allow any user on the system to read, modify, or even execute the file, creating a critical security vulnerability that exposes password hashes to brute-force attacks. On the CompTIA Linux+ XK0-005 exam, this scenario tests your understanding of Linux file permissions and the principle of least privilege, often appearing as a straightforward fix for a security audit finding. A common trap is confusing this with `chmod 644`, which would still allow group or others to read the file—remember, shadow must be root-only. A useful memory tip: think of "600" as "six-zero-zero" meaning "only the owner (root) gets the key (read/write), and everyone else gets zero access."
⚠ Common exam trap
It's easy for candidates to confuse the required permissions for /etc/shadow with those for /etc/passwd (which is 644), leading them to choose 644 or 640 instead of the more restrictive 600.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
chmod 600 /etc/shadow
The /etc/shadow file stores hashed user passwords and must be readable only by root to prevent unauthorized access. Permissions 777 allow any user to read, write, and execute the file, which is a critical security vulnerability. The correct command is `chmod 600 /etc/shadow`, which sets read and write permissions for the owner (root) only, denying all access to group and others.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
chmod 660 /etc/shadow
Why it's wrong here
Allows group write, which is insecure.
- ✓
chmod 600 /etc/shadow
Why this is correct
Only root can read/write.
- ✗
chmod 644 /etc/shadow
Why it's wrong here
Allows world read, which is insecure.
- ✗
chmod 640 /etc/shadow
Why it's wrong here
Allows group read, which is insecure.
Go deeper
Related to this question
Learn chapter
File Permissions and Ownership
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
chmod
chmod is a command in Linux and Unix-like operating systems used to change the permissions (read, write, execute) of a file or directory.
About these practice questions
This XK0-006 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on XK0-006
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security audit reveals that a server's /etc/shadow file is readable by all users. Which command would correctly fix the permissions?
hard- A.chmod 644 /etc/shadow
- ✓ B.chmod 600 /etc/shadow
- C.chmod 640 /etc/shadow
- D.chmod 640 /etc/shadow && chown root:shadow
Why B: The correct command is 'chmod 600 /etc/shadow' (option B). The /etc/shadow file should only be readable by the root user, as it contains password hashes. Permission 600 grants read and write access only to the owner (root). Option A (644) would allow world read access, which is insecure. Option C (640) would allow group read access, which is also not recommended. Option D includes an unnecessary chown command and uses 640 permissions.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.