GIAC Certified Incident Handler (GCIH) — Question 130

Where would salted hashes be found on a Linux machine?

Answer options

• A. In the LSASS process
• B. %SYSTEMROOT%\ntds.dit
• C. /etc/passwd
• D. /etc/shadow

Correct answer: D

Explanation

Salted hashes are stored in the /etc/shadow file on Linux systems, which is specifically designed for secure storage of password hashes. The other options are incorrect as they refer to locations or files specific to Windows environments or other uses that do not store Linux password hashes.