Identifying Tools by /etc/shadow Permission Denied Errors

SY0-701 By islever Editorial Last updated

Given a scenario, analyze indicators of malicious activity.

Short answer

D The tool is a password cracker attempting to access the restricted /etc/shadow file without sufficient privileges.

Question

A security administrator is performing an audit on a stand-alone UNIX server, and the following message is immediately displayed: (Error 13): /etc/shadow: Permission denied. Which of the following best describes the type of tool that is being used?
  1. Pass-the-hash monitor
  2. File integrity monitor
  3. Forensic analysis
  4. Password cracker Correct Answer

Key Takeaways

The question tests recognition of tool behavior by analyzing OS-level error messages, with the common trap being the assumption that audits only use benign monitoring tools like FIM.

This question tests the ability to identify security tools based on specific error messages during an audit. The correct answer is D because password crackers attempt to read /etc/shadow, triggering permission errors if privileges are insufficient.

Common mistake: Many learners chose B (File integrity monitor) assuming the context of an 'audit' implies a non-destructive scanning tool, ignoring that the error indicates an unauthorized access attempt typical of cracking tools.

Expert Analysis

Why the Answer Is Correct

The key to this question lies in the specific file and error message: /etc/shadow and Permission denied. In UNIX/Linux systems, /etc/shadow stores user password hashes and is strictly protected (readable only by root). A password cracker's primary function is to retrieve these hashes for offline cracking. If a password cracker is run without root privileges, it will immediately fail with a permission denied error when attempting to open this file. This behavior directly matches the scenario described.

Why the Other Options Are Wrong

Option A (Pass-the-hash monitor) involves replaying captured hashes, not reading local shadow files. Option C (Forensic analysis) is a broad discipline; while forensic tools might read shadow files, they typically operate with elevated privileges or handle evidence files rather than generating live OS permission errors in this manner. Option B (File integrity monitor) checks for changes to files but does not typically attempt to read the contents of restricted files like /etc/shadow in a way that generates this specific error during a standard audit configuration; FIMs usually rely on kernel hooks or privileged agents.

Community Comment Notes

The community was split, with many voting for D. As Cyberity noted, "Password crackers often attempt to access this file to obtain hashed passwords for cracking." However, some users like AndyK2 argued for B, stating, "I'd go with FIM - since it makes more sense" in the context of an audit. Others like Eracle questioned why a cracker would generate such an error, suggesting it operates on copies, but in a live server audit scenario, direct access attempts trigger these OS-level blocks.

Exam Strategy

When analyzing security scenarios involving error messages, focus on the resource being accessed. Accessing sensitive credential stores like /etc/shadow or SAM is a strong indicator of password-related attacks or tools, even if the tool fails due to permissions.

Frequently Asked Questions

Why isn't this a File Integrity Monitor?

FIMs check for changes to file contents or permissions but don't typically try to read the raw content of highly restricted files like /etc/shadow in a way that triggers immediate permission denied errors during setup.

Does a password cracker always fail on /etc/shadow?

No, if run as root it succeeds. The error indicates the specific tool instance lacked privileges, which is common in unprivileged audit or attack scenarios.

More SY0-701 FAQ →

Community Votes

D
56%
B
44%

56% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 20 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 20

  1. Cyberity 👍 9 Answered D
    Password crackers often attempt to access this file to obtain hashed passwords for cracking.
  2. laternak26 👍 4 Answered D
    D. Password cracker: A password cracker tool is used to attempt to recover passwords from hashed password files. In the case of UNIX-based systems, the /etc/shadow file typically stores user passwords in a hashed format. If a security administrator or attacker is trying to analyze this file, they might encounter the "Permission denied" message if they do not have sufficient privileges to access it. This suggests that the tool being used is likely attempting to crack or analyze the passwords stored in the /etc/shadow file, and it's encountering permission issues. Why not B. File integrity monitor: A file integrity monitor typically checks whether critical system files have been modified. It wouldn't be used to crack passwords or access /etc/shadow in this way, and it wouldn’t typically result in a "Permission denied" error unless there’s an attempt to modify files rather than just monitor them.
  3. c7b3ff0 👍 4 Answered B
    I don't know why so many of you think that a security administrator would use a password cracker during an audit, but I bet there are quite a few more reasons they would use a file integrity monitor during an audit. That would probably need to be given permissions to access a restricted file like /etc/shadow before they ran it, and if they didn't give them, I bet it would kick out a don't touch me error just like this. Answer is B.
  4. AndyK2 👍 4 Answered B
    Strange, Claude says it's FIM. But ChatGPT says Password Cracker. I'd go with FIM - since it makes more sense.
  5. fmeox567 👍 2 Answered D
    D. Password cracker Explanation: The message /etc/shadow: Permission denied indicates that the tool is attempting to access the /etc/shadow file, which typically contains password hashes for user accounts on a UNIX/Linux system. In a normal scenario, this file is restricted to root or privileged users to prevent unauthorized access. This kind of message is commonly seen when a password cracker is trying to access the /etc/shadow file to extract password hashes for the purpose of cracking them (typically using brute force or dictionary attacks). The "Permission denied" error indicates that the tool lacks sufficient privileges to access the file, which is a normal security measure to protect sensitive data.
Show 15 more comments
  1. dbrowndiver 👍 2 Answered D
    The /etc/shadow file stores encrypted passwords and is protected with strict permissions to prevent unauthorized access. • Scenario Application: The error message (Error 13): /etc/shadow: Permission denied indicates that the tool being used attempted to access the /etc/shadow file but failed due to insufficient permissions. This behavior is consistent with a password cracker attempting to retrieve password hashes for analysis or cracking.
  2. Gman530 👍 2 Answered B
    A file integrity monitor would attempt to read the contents of etc/shadow while doing integrity checks, this may fail due to insufficient permissions. - File Integrity monitor matches the activity of an administrator performing an audit. - Password Cracking is more aligned with pentesting than auditing.
  3. Ty13 👍 2 Answered B
    B. File Integrity Monitoring The /etc/shadow file stores encrypted user passwords, and you can only access it as root. If you're checking file integrity, you're checking the permissions are still properly set and haven't been changed. You WANT to see 'Permission Denied' if you're auditing the system.
  4. Eracle 👍 2 Answered B
    Why not D option: a password cracker attempts to crack passwords, not read the file directly. A password cracker typically operates on a copy of the /etc/shadow file (or extracted hashes) and would not generate a “Permission denied” error during its cracking operation.
  5. prabh1251 👍 2 Answered D
    (Permission Denied) happens when you try to access or modify /etc/shadow, which is a highly restricted system file that stores hashed passwords for user accounts.
  6. User92 👍 2 Answered D
    Password crackers often attempt to access the /etc/shadow file to retrieve hashed passwords for cracking.
  7. pindinga1 👍 2 Answered D
    The context based, the question says “tool” used for analysis. For my is D pssword cracker.
  8. AZZ99 👍 2 Answered D
    Copy pasted to ChatGPT and the answer is D. Make sense to me.
  9. mejestique 👍 1 Answered B
    B. File integrity monitor Explanation: The "/etc/shadow: Permission denied" error suggests that the tool is trying to access the /etc/shadow file, which stores password hashes on a UNIX system and is highly restricted. A File Integrity Monitor (FIM) checks system files for unauthorized changes, access attempts, or modifications. Since the security administrator is conducting an audit, a FIM tool is likely being used to ensure that critical system files (like /etc/shadow) have not been altered.
  10. Foreversmall 👍 1 Answered B
    both B and D could theoretically trigger the error, the context of a security audit strongly aligns with File integrity monitor (B). FIM tools are standard components of audits to ensure file integrity, whereas password crackers are more situational and less likely to be the focus of a general audit. The error reflects a permissions issue during routine integrity checks, making B the best answer. Answer: B. File integrity monitor
  11. prabh1251 👍 1 Answered B
    password cracker was running, it would likely try to read or copy the /etc/shadow file, rather than just check permissions.
  12. FrozenCarrot 👍 1 Answered B
    The /etc/shadow is a text-based password file.
  13. BevMe 👍 2
    B. File Integrity Monitor
  14. cyberWoof 👍 2 Answered B
    File integrity monitor
  15. 850bc48 👍 1
    D. password cracking

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide