Which two statements about sudo are correct? (Choose two.)
LPIC-1 Exam 102-500, objective 110. Security hard
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Choose 2.
Not correct sudo -s starts a login shell that re-reads the target user's login scripts and changes to their home directory.
Wrong; that describes sudo -i. sudo -s runs the target user's shell as a non-login shell, keeping the current working directory and most of the invoking environment.
Correct sudo -i simulates a full login: it starts a login shell, sources the target user's login files and begins in their home directory.
Correct. -i is the initial-login form and is the sudo counterpart of `su -`.
Not correct Rules dropped into /etc/sudoers.d only take effect after running pwconv.
Wrong. pwconv belongs to the shadow suite and migrates password hashes from /etc/passwd into /etc/shadow. It has nothing to do with sudo.
Correct Files placed in /etc/sudoers.d are read because /etc/sudoers contains an includedir directive, so no edit to /etc/sudoers itself is needed.
Correct. The shipped sudoers ends with an include of that directory (written #includedir /etc/sudoers.d, or @includedir in sudo 1.9.1 and later). Note that files whose names contain a dot or end in ~ are deliberately skipped, which quietly breaks drop-ins named like webteam.conf.
Not correct Without -u, sudo runs the command as the invoking user, so -u root is required to gain administrative rights.
Wrong. sudo runs commands as root unless -u names a different target user. Running a command as yourself would make sudo pointless.
Why
sudo's shell forms mirror su's: -i is the login form, -s is not. Configuration is layered: /etc/sudoers holds the base policy and pulls in a directory of drop-in files so that packages and configuration management can add rules without rewriting the main file. Edit either with visudo, which locks and syntax-checks. A sudoers rule reads `user host = (runas) commands`, for example `alice ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx`.
Where this comes from
- Cited
- LPI exam objective 110.1
- What it says
- Grant limited administrative access with sudo, including drop-in configuration files.
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 110 and space the ones you get wrong.
More questions on this objective
- During an audit you must list every file under /usr that has the set-user-ID bit set, regardless of what its other permission bits are. Which command does that? machine-checked
- You locked the password of the account `intern` and confirmed that its hash in /etc/shadow now begins with an exclamation mark. The intern nevertheless still reaches a shell on the host over SSH, without being prompted for anything. What is going on, and what actually stops it? machine-checked
- You have just been added to a sudo rule on a host and want sudo itself to report which commands you are allowed to run there, without running any of them. Type the complete command. machine-checked
- A daemon started from your bash session keeps hitting a 'too many open files' error. Which command raises the limit on open file descriptors for the current shell and the processes it starts to 4096? machine-checked
- You are about to take a server down for maintenance and want ordinary users refused at login for the next hour, with an explanatory message, while root can still get in. On a system using PAM's pam_nologin, creating which file achieves this? machine-checked
- Which two commands report the users who are logged in right now, rather than a history of past logins? (Choose two.) machine-checked