The Linux command to make the /etc/shadow file, already owned by root, readable only by root is which of the following?

chmod 444 sets read permission for owner, group, AND others, which would allow all users to read the shadow file, defeating its security purpose.

chown root:root changes file ownership but does not modify permissions, so it would not enforce read-only access for root only.

chmod 400 sets permissions to read-only for the owner (root) and no permissions for group or others (octal 4=read, 0=none, 0=none). Since /etc/shadow already belongs to root, this ensures only root can read the file, protecting hashed passwords from unauthorized access. This is the minimal and correct permission set for this security-sensitive file.

chown is used to change file ownership, not permissions; '400' is not a valid argument for chown and this command would fail or produce an error.