Ask what you are allowed to do, then do one thing

Answer

sudo -l sudo systemctl restart nginx sudo -k

`sudo -l` prints the policy that applies to you, which is the honest way to find out what you may run rather than guessing. `sudo -k` forgets the cached credential immediately instead of leaving the grace period open on a shared machine.

sudo(8), sudoers(5) — sudo 1.9