Exam 102-500 Topic 2 Question 198 Discussion

The /etc/shadow file contains the encrypted passwords and other information for each user account on a Linux system. The third field in each line of this file is the date of the last password change, expressed as the number of days since Jan 1, 1970. This information is used by the system to determine when a user must change their password, based on the password aging policy. The /etc/shadow file can be viewed and modified by the root user or by using the chage command123. The other files listed in the options do not store the date of the last password change. The /etc/gshadow file contains the encrypted passwords for group accounts4. The /etc/passwd file contains the basic information for each user account, such as the user name, user ID, group ID, home directory, login shell, etc., but not the password5. The /etc/pwdlog file does not exist by default on most Linux systems, and it is not related to the password change date. The /var/log/shadow file also does not exist by default on most Linux systems, and it is not related to the password change date. Reference: https://www.redhat.com/sysadmin/password-changes-chage-command
https://www.golinuxcloud.com/check-last-password-change-expiration-linux/