A security administrator is performing an audit on a stand-alone UNIX server, and the following message is immediately displayed:
(Error 13) : /etc/shadow: Permission denied.
Which of the following best describes the type of tool that is being used?
Correct Answer: B
A file integrity monitor is a tool that checks the permissions, hashes, and other attributes of files to detect unauthorized changes. The error message indicates that the tool tried to access the /etc/shadow file, which contains the encrypted passwords of the users, but was denied due to insufficient permissions. This file is usually protected by the root user and the shadow group, and only tools with the suid bit set or running as root can access it12. A pass-the-hash monitor, a forensic analysis tool, and a password cracker would not generate this error message, as they have different purposes and methods.