PEN-200 Linux Privilege Escalation Practice Question
When reviewing 'sudo -l' output, what does the 'NOPASSWD' tag signify for the listed command?
⚠ Common exam trap
Candidates often confuse NOPASSWD with a general sudo privilege. The trap is failing to realize that this specific tag bypasses the password prompt entirely, allowing for immediate execution of commands.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The command can be run as root without entering a password.
The 'NOPASSWD' tag indicates that the user can execute the specified command with sudo privileges without being prompted for their own password. This is a critical misconfiguration, as it removes the authentication barrier for privilege escalation. In an attack scenario, it allows for immediate, automated execution of commands as root, which is significantly more dangerous than configurations that still require a user to authenticate via their password.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user is automatically added to the root group.
Why it's wrong here
The NOPASSWD tag only affects the authentication requirement for sudo. It does not change the user's membership in the root group. Group membership is managed through /etc/group, and being in the root group provides its own set of privileges independent of any sudo configuration directives.
- ✓
The command can be run as root without entering a password.
Why this is correct
NOPASSWD specifically bypasses the sudo password prompt for the defined command. This allows the user to execute the command with the elevated privileges defined in the sudoers file instantly. This is a primary target during privilege escalation, as it simplifies the path to root significantly.
- ✗
The command is not logged by the system administrator.
Why it's wrong here
NOPASSWD has no impact on logging. The sudo configuration does not affect whether actions are recorded. System administrators typically have separate logging mechanisms enabled, such as syslog or auth.log, which will still record the command execution regardless of whether a password was required for the session.
- ✗
The command will run in a sandbox for security.
Why it's wrong here
NOPASSWD does not imply any form of sandboxing or isolation. It is purely an authentication bypass mechanism. The command runs with the full privileges of the user specified in the sudoers entry, which is usually root, without any secondary security controls applied to the process execution.
About these practice questions
One of 285 original PEN-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.