Auditing SUID files | LPIC-1 102-500 Exam original practice question

110.1Standard

Under /usr, list regular files whose owner-execute position has the SUID bit set.

Suppress permission-denied messages.

Which command is appropriate?

Hint 1: Focus on the requirement

Identify what must change and what must remain unchanged. Then choose the command whose scope matches that requirement.

Hint 2: Check each command's role

Separate commands that display information, change state, remove data, or affect a child process.

find /usr -type f -perm -4000 2>/dev/null: Correct. It searches regular files with SUID and redirects standard errors.
find /usr -type d -perm -4000 2>/dev/null: Incorrect. It limits the search to directories.
find /usr -type f -perm -2000 2>/dev/null: Incorrect. 2000 searches for SGID rather than SUID.
find /usr -type f -perm 4000 2>/dev/null: Incorrect. Exact mode matching would miss SUID files that also have ordinary permission bits.

Detailed explanation

Correctfind /usr -type f -perm -4000 2>/dev/null

Correct. It searches regular files with SUID and redirects standard errors.

Incorrectfind /usr -type d -perm -4000 2>/dev/null

Incorrect. It limits the search to directories.

Incorrectfind /usr -type f -perm -2000 2>/dev/null

Incorrect. 2000 searches for SGID rather than SUID.

Incorrectfind /usr -type f -perm 4000 2>/dev/null

Incorrect. Exact mode matching would miss SUID files that also have ordinary permission bits.

An example you can run in a temporary verification environment.

printf '%s
' '-type f=regular files' '-perm -4000=SUID bit present' '2>/dev/null=discard diagnostics'

-type f=regular files
-perm -4000=SUID bit present
2>/dev/null=discard diagnostics

Foundation review

Check whether the command acts on the current shell, a new process, an existing process, or a file.

Use the supplied command and compare the output with the expected result.

Question IDKP-110-845

EnvironmentGNU findutilsの構文対応表（filesystem走査なし）

Last technical review2026-08-13