EX200 Manage security Practice Question
After configuring sudo, a user reports: 'sudo: unable to open /etc/sudoers: Permission denied'. The admin checks the file permissions and sees '-rw-r-----' owned by root:root. What is the most likely cause?
⚠ Common exam trap
Many exam-takers assume 'Permission denied' always means the user lacks read access, but sudo specifically rejects files with write permissions for root to enforce its security policy, not because the user cannot read the file.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file permissions are too permissive (0640 instead of 0440).
The sudoers file requires strict permissions of 0440 (owner read, group read) to be considered secure by sudo. The current permissions of 0640 (owner read/write, group read) are too permissive, as they grant write access to the owner (root), which violates sudo's security model. When sudo detects that /etc/sudoers has permissions other than 0440, it refuses to open the file and reports 'Permission denied' to prevent potential tampering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file is owned by the wrong user.
Why it's wrong here
If /etc/sudoers were owned by a non-root user, sudo would refuse to read it and issue a warning such as 'sudo: /etc/sudoers is owned by uid X, should be 0' rather than a generic 'unable to open' message. In this setup, the file is correctly owned by root:root, so ownership is not the cause. Sudo specifically checks the owner UID and aborts before attempting to open the file if ownership is invalid.
- ✗
The sudo binary is missing the setuid bit.
Why it's wrong here
A missing setuid bit on /usr/bin/sudo would prevent sudo from gaining root privileges to read the root-only sudoers file, but the immediate failure would be 'sudo: effective uid is not 0' or a similar privilege error, not 'unable to open /etc/sudoers'. The error described indicates sudo did start with root privileges and then failed while opening the policy file. Therefore, while the setuid bit is essential, its absence produces a different symptom.
- ✓
The file permissions are too permissive (0640 instead of 0440).
Why this is correct
Sudo requires /etc/sudoers to be owned by root:root and have mode 0440 (read-only for owner and group). A mode of 0640 grants write permission to root, which sudo considers unsafe because it suggests the file was modified manually outside visudo's validation; sudo then refuses to open it for policy parsing and reports an error. Changing the mode back to 0440 with `chmod 0440 /etc/sudoers` resolves the issue. The message may explicitly say 'sudo: /etc/sudoers is mode 0640, should be 0440'.
- ✗
SELinux is blocking access.
Why it's wrong here
SELinux uses type enforcement, and /etc/sudoers has a default type (etc_t) that the sudo_t domain is allowed to read. An SELinux denial would appear in audit.log as an AVC message and would require a Boolean or context change; it would not be fixed by altering file mode. Since the scenario points to a permission problem after editing the file, and the file's SELinux context is almost always correct, SELinux is not the cause. If SELinux were blocking, you would also see denials even after the mode is corrected.
Go deeper
Related to this question
About these practice questions
Courseiva writes every EX200 question from scratch — 127 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This EX200 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX200 exam.