Re: Multi layer
well, the user using su would still have to know the root password to be able to use it. Users using sudo need to know their user password, not root, but they have to be added to the /etc/sudoers files to be able to use sudo.
It all depends on what you want.
If you are the only one using the system, then your better bet would be using su, since you pretty much already know the root password anyway. If other users have access, then you can give them access with sudo to do limited things, but without the need to provide them with root password which would give them unlimited access.