hardMultiple ChoiceObjective-mapped
220-1202 Practice Question: A security incident response team needs to find…
A security incident response team needs to find all files in /var/www that have the SUID bit set, which may indicate a privilege escalation risk. Which command should they use?
⚠ Common exam trap
CompTIA often tests the distinction between `-perm 4000` (exact match) and `-perm /4000` (any match), where candidates mistakenly choose the exact match option, not realizing it will miss files with additional permission bits set.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
find /var/www -type f -perm /4000
The `find` command with `-perm /4000` matches any file that has the SUID bit set (the 4000 octal permission), regardless of other permission bits. The `/` prefix tells `find` to match if any of the specified permission bits are set, which is the precise way to locate files with the SUID bit enabled. This command will recursively search `/var/www` for regular files (`-type f`) with the SUID bit, helping identify potential privilege escalation risks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
find /var/www -type f -perm 4000
Why it's wrong here
The `find` command with `-type f -perm 4000` performs an exact permission match. This means it would only identify files that have *only* the SUID bit set and no other read, write, or execute permissions for the owner, group, or others. Such a configuration is highly improbable for functional SUID executables, causing this command to miss nearly all relevant SUID files in a real-world scenario.
- ✓
find /var/www -type f -perm /4000
Why this is correct
The correct `find` command utilizes the `-type f -perm /4000` syntax, which signifies a 'bitwise OR' or 'any of' match for the specified permission bits. This ensures that any file with the SUID bit (4000) set, regardless of other standard read, write, or execute permissions, will be successfully identified. This method accurately targets all files where the SUID flag is active, fulfilling the requirement to locate them.
- ✗
ls -la /var/www | grep '^...s'
Why it's wrong here
The `ls -la /var/www | grep '^...s'` command is fundamentally flawed for a comprehensive SUID search because `ls` is not recursive. It will only list files and directories directly within `/var/www`, failing to traverse into subdirectories. Consequently, any SUID files located deeper within the directory structure would be entirely missed, rendering this approach incomplete and ineffective for a full security incident response.
- ✗
chmod -R u+s /var/www
Why it's wrong here
Executing `chmod -R u+s /var/www` would recursively *add* the SUID bit to all files and directories within the `/var/www` path. This action directly contradicts the objective of *finding* existing SUID files; instead, it would create new SUID files, potentially introducing severe security vulnerabilities by granting elevated privileges to many programs. This command is a destructive action, not a diagnostic one.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.