CEH Enumeration and System Hacking Practice Question
A penetration tester finds that a Linux binary has the SUID bit set and is owned by root. Which of the following does this indicate?
⚠ Common exam trap
Many exam-takers confuse the SUID bit with execution restrictions (option B) or file immutability (option A), but the SUID bit specifically grants privilege escalation, not access control or file protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The binary will run with root privileges when executed by any user
When the SUID (Set User ID) bit is set on a binary owned by root, the binary executes with the effective user ID of the file owner (root), regardless of which user runs it. This allows any user to run the binary with root privileges, which is why option D is correct. The SUID bit is represented by an 's' in the owner's execute position (e.g., -rwsr-xr-x).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The binary is immutable and cannot be deleted
Why it's wrong here
The SUID bit is a permission setting that dictates how a binary executes, specifically concerning its effective user ID. It has no direct relation to the file's immutability, which is a separate file attribute managed by tools like `chattr`. An immutable file cannot be modified or deleted, regardless of its SUID status, making this statement incorrect as SUID does not confer immutability.
- ✗
The binary can be executed only by the root user
Why it's wrong here
The primary purpose of the SUID bit is to allow users who are *not* the file owner to execute a program with the privileges of the file owner. If a binary could only be executed by the root user, setting the SUID bit would be entirely redundant, as root already possesses all necessary privileges. Therefore, this statement fundamentally misunderstands the function of SUID, which is to enable privilege escalation for non-root users.
- ✗
The binary is a symbolic link to a root-owned file
Why it's wrong here
The SUID bit is a special permission flag set directly on an executable file's inode, indicating how it should run in terms of user privileges. It is a distinct attribute from a symbolic link, which is merely a pointer to another file or directory. While a symbolic link might point to a root-owned file, the SUID bit's effect applies to the *target* file itself, not the link, making this distinction crucial for understanding file permissions.
- ✓
The binary will run with root privileges when executed by any user
Why this is correct
When the SUID (Set User ID) bit is set on an executable file, and that file is owned by the root user, any user who executes this binary will temporarily assume the effective user ID of the file owner. This means the program will run with root privileges for the duration of its execution, allowing it to perform actions that would normally require root access. This mechanism is crucial for system utilities that need elevated permissions to function correctly for all users.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.