mediumMultiple Choice
220-1202 Practice Question: A security incident response team needs to…
A security incident response team needs to identify all files on a system that have the SUID bit set, as these may pose a security risk. Which command should they use?
⚠ Common exam trap
This question tests the distinction between exact permission matching (`-perm 4000`) and 'at least these bits' matching (`-perm -4000`). Candidates may incorrectly choose exact matching, which only finds files whose permissions are exactly 4000 and misses files with additional bits set. Be aware that on GNU find, `-perm /4000` is functionally equivalent to `-perm -4000` for a single bit, so both can identify SUID files.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
find / -type f -perm -4000
The `-perm -4000` syntax in the `find` command matches files that have the SUID bit set (the 4000 octal permission), regardless of other permission bits. The leading dash (`-`) means 'at least these bits must be set,' so it correctly identifies all files where the SUID bit is enabled. Note that GNU find's `-perm /4000` also matches files with the SUID bit set, since the slash means 'any of these bits must be set' and only one bit is specified; however, `-perm -4000` is the traditional and most widely recognized form for this task.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
find / -type f -perm 0777
Why it's wrong here
-perm 0777 matches files whose permission bits equal rwxrwxrwx exactly, ignoring the SUID bit entirely. It tempts because 0777 looks like a special-permission search, but SUID is octal 4000; the correct command targets that bit, not full world read/write/execute access.
- ✗
find / -type f -perm 4000
Why it's wrong here
-perm 4000 matches only files whose permission bits are exactly 4000, meaning SUID set with no other permissions; real SUID binaries also carry execute bits, so they are missed. It tempts as the literal SUID value, but exact matching excludes combined modes.
- ✓
find / -type f -perm -4000
Why this is correct
The -perm -4000 test matches files whose permission bits include the SUID bit, and -type f restricts results to regular files. Searching from / scans the whole filesystem, letting the team enumerate every SUID binary that could grant elevated privileges during incident triage.
- ✓
find / -type f -perm /4000
Why this is correct
The / syntax is used for some find versions, but -perm -4000 is the standard POSIX way to match any file with the SUID bit.
Go deeper
Related to this question
About these practice questions
This 220-1202 question is part of Courseiva's 687-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.