How many Linux Privilege Escalation questions are on the PEN-200 exam?

The Linux Privilege Escalation domain is one of the weighted domains on the PEN-200 exam. The Courseiva question bank has 18 practice questions for this domain.

Free PEN-200 Linux Privilege Escalation Practice Questions (2026)

Q: How can I practice Linux Privilege Escalation questions for PEN-200?

Click any of the 18 questions listed on this page to see the full question and explanation, or use the session launcher to start a focused practice session of 10, 20, 30 or 50 questions drawn only from the Linux Privilege Escalation domain.

Domain overview

About the Linux Privilege Escalation domain

Linux Privilege Escalation on PEN-200 covers moving from a low-privileged shell to root by abusing misconfigurations rather than exploits alone. You enumerate sudo rights, SUID/SGID binaries, cron jobs, writable files, capabilities, and kernel versions, then pick the least disruptive path and prove root access with a reliable, repeatable exploit.

Exam objectives

What Linux Privilege Escalation tests on PEN-200

1
Reading sudo -l output and abusing NOPASSWD entries, wildcards, and GTFOBins-style command escapes
2
Finding SUID/SGID binaries and exploiting relative path or PATH hijacking in system() calls
3
Enumerating root cron jobs and writable scripts or directories they execute
4
Identifying kernel and service versions, then selecting a matching local privilege escalation exploit

Watch out — common Linux Privilege Escalation traps

!
Running a kernel exploit first instead of checking sudo, SUID, and cron misconfigurations that are safer and more reliable
!
Missing that a SUID binary calls a command without an absolute path, so PATH hijacking is possible
!
Editing a root cron script without preserving permissions or triggering the job, or breaking the target so it crashes

Practice Linux Privilege Escalation questions

10Q 20Q 30Q 50Q

All PEN-200 Linux Privilege Escalation questions (18)

Start session

Click any question to see the full explanation and answer options, or start a focused practice session above.

You have gained a low-privileged shell on a Linux system and discovered a binary with the SUID bit set. The binary executes a system call to 'cat' without specifying an absolute path. How can you leverage this to escalate privileges?

Refer to the exhibit. Given the sudo privileges, which command will successfully spawn a root shell?

Which Linux kernel feature, if misconfigured or outdated, allows an unprivileged user to gain root access by exploiting a vulnerability in the handling of user namespaces?

Refer to the exhibit. The 'find' binary has the SUID bit set. How can you leverage this to gain a root shell?

You find that a binary relies on a relative path to execute a secondary script. If you cannot modify the PATH variable, what is the best alternative to exploit this configuration?

When reviewing 'sudo -l' output, what does the 'NOPASSWD' tag signify for the listed command?

When performing a kernel exploit for privilege escalation, what is the most significant risk to the stability of the target system?

Why is it often effective to check for 'Capabilities' on Linux binaries when SUID is not present?

Which file is essential for auditing to determine which users have been granted sudo privileges?

Which command is most useful for identifying processes that are running as root, which might be potential targets for privilege escalation?

You identify a cron job running as root that executes a script located in a writable directory. What is the most reliable way to escalate privileges in this scenario?

During a Linux privilege escalation assessment, you discover that the current user can run `/usr/bin/find` via sudo without a password. You execute `sudo find /home -exec /bin/bash \;`. What is the outcome?

You have a low-privileged shell on a Linux host. You discover a cron job that runs every minute as root and executes a script located at /opt/backup/backup.sh. The script is world-writable. However, you also notice that the directory /opt/backup is owned by root and has permissions 755. Which of the following is the MOST reliable way to escalate privileges?

You have obtained a low-privileged shell on a Linux server. During enumeration, you discover a file named `backup.sh` in `/opt/scripts` that is owned by root and has permissions `-rwxr-xr-x`. A cron job runs this script every night as root. The directory `/opt/scripts` has permissions `drwxrwxr-x` and is owned by root:developers. Your user is a member of the `developers` group. What is the most reliable way to escalate privileges?

While enumerating a Linux host, you notice that the `passwd` command has the SUID bit set and is owned by root. You recall that SUID binaries run with the privileges of the file owner. Which of the following is the most direct way to leverage this to gain root access?

During post-exploitation on a Linux target, you discover a binary with the SUID bit set owned by root. Running 'strings' on the binary reveals it calls 'system("ps")' without specifying an absolute path. Which of the following techniques is most likely to allow you to escalate privileges by exploiting this behavior?

A penetration tester discovers that the current user can write to a script located in /opt/backup/ that is executed every minute by a cron job running as root. The script has permissions `-rwxr-xr-x 1 root root`. What is the MOST reliable way to escalate privileges?

During a Linux privilege escalation assessment, you obtain a low-privileged shell as user 'student'. You run 'id' and see the user belongs to the 'docker' group. Which command will most reliably escalate to root on this host?

Other PEN-200 exam domains

Client-Side Attacks Enumeration and Reconnaissance Active Directory Attacks Public Exploits Web Application Attacks Buffer Overflow Fundamentals Port Redirection and Tunneling Antivirus Evasion Password Attacks Windows Privilege Escalation

Frequently asked questions

What does the Linux Privilege Escalation domain cover on the PEN-200 exam?

Enumerate sudo -l, SUID/SGID files, cron jobs, writable paths, and kernel version, then exploit the simplest misconfiguration to gain root. The key is verifying the exact command context and permissions before acting so the escalation is reliable and does not destabilize the host.

How many Linux Privilege Escalation questions are in the PEN-200 question bank?

The Courseiva PEN-200 question bank contains 18 questions in the Linux Privilege Escalation domain. Click any question to see the full explanation and answer breakdown.

What is the best way to practice Linux Privilege Escalation for PEN-200?

Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.

Can I practice only Linux Privilege Escalation questions for PEN-200?

Yes — the session launcher on this page draws questions exclusively from the Linux Privilege Escalation domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.

Free forever · No credit card required

Track your PEN-200 domain progress

Save your results, see per-domain analytics, and get readiness scores — free, for every certification.

Free forever · Every certification included