mediumMultiple ChoiceObjective-mapped
CISA Practice Question: An information systems auditor is evaluating user…
Exhibit
Refer to the exhibit. ``` # cat /etc/shadow | grep -E "^(root|admin|test):" root:$6$xyz...$abc:18000:0:99999:7::: admin:!:18001:0:99999:7::: test:$6$def...$ghi:18001:0:99999:7::: ```
An information systems auditor is evaluating user accounts in an organization's Linux environment. The accounts have the following properties: - The 'root' account has its password field set to '!!' (disabled). - The 'admin' account has its password field set to '!' (locked) and UID 0. - The 'test' account is a regular user with UID 1000. Based on this information, which user account poses the HIGHEST security risk?
⚠ Common exam trap
Candidates often assume that a locked account is inherently safe, but the trap is that an account with UID 0 (root privileges) remains a high risk even if its password is locked, as alternative authentication methods or local privilege escalation could still be exploited. The question tests understanding that account risk must consider both privilege level and authentication controls together.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
admin
The 'admin' account poses the highest security risk because, despite its password being locked (indicated by '!' in the shadow file), it has UID 0 (root privileges). A locked password prevents password-based login, but the account may still be accessible via SSH keys or other authentication methods, and its privileged status makes it a valuable target for privilege escalation attacks. In contrast, the 'root' account may be fully disabled, and the 'test' account is a standard user without elevated privileges.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
root
Why it's wrong here
Root has a valid password hash; normal.
- ✓
admin
Why this is correct
The '!' indicates a locked password, but account may still exist.
- ✗
test
Why it's wrong here
Test has a valid hash; could be risky but not highest.
- ✗
None of the accounts are risky
Why it's wrong here
Admin account is risky.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.