SSCP Systems and Application Security Practice Question
A security auditor discovers that a Linux server has a user who can execute any command as root via sudo without a password. Which file should be reviewed to verify this configuration?
⚠ Common exam trap
SSCP often tests the distinction between authentication files (/etc/passwd, /etc/shadow) and authorization configuration files (/etc/sudoers), so candidates may incorrectly choose /etc/shadow because it relates to passwords, but the question specifically asks about sudo privileges.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
/etc/sudoers
The /etc/sudoers file is the primary configuration file for the sudo command, defining which users or groups can run which commands on which hosts, and whether a password is required. A user with NOPASSWD: ALL in this file can execute any command as root without a password. Therefore, reviewing /etc/sudoers is the correct action to verify the auditor's finding.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
/etc/shadow
Why it's wrong here
/etc/shadow stores password hashes and ageing fields, not sudo rules, so it cannot reveal a NOPASSWD entry. It is tempting because it governs authentication, yet passwordless sudo bypasses password checks entirely; the configuration sits in /etc/sudoers or /etc/sudoers.d/ drop-ins.
- ✗
/etc/group
Why it's wrong here
/etc/group lists group memberships only, so it cannot show sudo privileges or the NOPASSWD tag. It is tempting because administrators often add users to the sudo or wheel group, but the actual rule granting passwordless root execution lives in /etc/sudoers or its included drop-in files.
- ✓
/etc/sudoers
Why this is correct
/etc/sudoers defines sudo privileges, including NOPASSWD entries that let a user run commands as root without authentication. Reviewing it confirms the auditor's finding, since the sudoers policy is the authoritative source for this configuration rather than PAM or group membership files.
- ✗
/etc/passwd
Why it's wrong here
/etc/passwd holds account names, UIDs, home directories and login shells, but no sudo authorisation data. It is tempting because it defines users, yet the NOPASSWD privilege is declared in /etc/sudoers or its included files under /etc/sudoers.d/, which the auditor must review.
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.