117-303 · Question #100
On a new Linux system, the root user is being asked to provide the root user password before being able to use the su command. What line in the /etc/pam.d/su file will allow root to use su without…
The correct answer is D. auth sufficient pam_rootok.so. See the full explanation below for the reasoning.
Question
Options
- Aauth required pam_norootpw.so
- Bauth sufficient pam_norootpw.so
- Cauth required pam_rootok.so
- Dauth sufficient pam_rootok.so
How the community answered
(21 responses)- A5% (1)
- B10% (2)
- C5% (1)
- D81% (17)
Community Discussion
6
Lena V.Nov 8, 2025D is the correct answer. The pam_rootok.so module tells PAM that if the caller is already root (UID 0), authentication is automatically satisfied, no password needed. The "sufficient" control flag is the key detail here: it means that if pam_rootok.so succeeds (caller is root), PAM stops processing further auth rules and grants access immediately. Using "required" instead of "sufficient" would mean the module result still factors into a chain, but PAM would continue checking other rules, which defeats the purpose since those other rules can still prompt for a password.
Mei-Ling H.Oct 25, 2025I almost picked C because "required" sounds like it means root is definitely allowed, but "required" actually means PAM keeps checking other modules even after it passes, so root can still get prompted. "Sufficient" stops the chain right there if root matches, so D is the one.
Orla P.Oct 27, 2025"Required" and "sufficient" trip up a lot of people on this exam, but worth noting that "sufficient" only short-circuits the chain on success, so if root fails that module, PAM still falls through to the rest of the stack.
Prof. SaraNov 13, 2025Option C will trip you up on exam day because pam_rootok.so is absolutely the right module, but "required" means PAM must still honor every other stack entry below it, so the password prompt survives. The magic is "sufficient," which tells PAM to short-circuit the rest of the stack the moment root's UID-zero check passes, making D the answer you mark.
Mei-Ling H.Nov 15, 2025Good point on the control flag, but add this to your notes: "sufficient" only short-circuits the modules that come after it in the stack, so if the exam scenario buries pam_rootok.so below pam_unix.so, the UID-zero check never gets its chance to bail out early and the password prompt still appears.
Grace U.Oct 27, 2025I saw this exact one and almost second-guessed myself right at the last second, because I kept mixing up pam_rootok.so with pam_norootpw.so and then "required" with "sufficient," but the key is that pam_rootok.so is the module that simply checks if the caller is already root, and you need "sufficient" so PAM treats that check as enough to grant access without demanding a password. D is your answer, and once you lock in that pam_rootok means "root is already OK, move on," the rest falls into place.