Redirect output with >, >>, 2>, and pipes, then process text using grep, sed, awk, cut, and sort; find files with find and locate, archive with tar and gzip, and create hard and symbolic links with ln. Get absolute versus relative path handling right.
Start practicing
Essential Tools — choose a session length
Free · No account required
Domain overview
Essential Tools is 11% of EX200 and covers the command-line fundamentals every other RHEL 9 task depends on: shell redirection, text processing, file finding, archiving, and links. Questions appear as hands-on lab items where you run commands in a terminal and the grader inspects resulting files, permissions, and output, not multiple-choice recall.
Exam objectives
Redirect stdout and stderr with >, >>, 2>, and pipes between grep, cut, sort, and wc
Locate files by name, owner, size, or mtime using find with -exec and xargs
Create and extract tar archives, including gzip and bzip2 compression with tar czf and tar xjf
Manage hard links and symbolic links with ln and ln -s, and read file contents via cat, less, head, tail
Using > when >> is needed, silently truncating an existing file instead of appending the new output to it
Forgetting that 2>&1 must follow the redirection order, so stderr still prints to the terminal instead of the file
Creating a hard link across filesystems or to a directory, which ln refuses, when a symbolic link was intended
Click any question to see the full explanation and answer options, or start a focused practice session above.
A system administrator needs to find all files in /var/log that have been modified in the last 2 hours. Which command should be used?
2A user complains that the 'ls' command no longer outputs colors. The administrator suspects a change in environment variables. Which command would help diagnose the issue?
3During a security audit, an administrator needs to list all TCP ports on which the system is listening, showing only the port numbers and the associated process names. Which command best achieves this?
4A new Linux administrator needs to read the manual page for the 'ls' command but also wants to search for the word 'color' within the manual. Which command accomplishes this?
5An administrator needs to terminate a hung process with PID 3456 that does not respond to 'kill -15 3456'. Which signal should be used next?
6A backup script uses tar to create an archive, but the administrator wants to exclude the /tmp directory from the backup. Which tar option should be added?
7An administrator wants to display a list of all currently logged-in users. Which command is most appropriate?
8A developer needs to search for the string 'ERROR' in all files under /var/log, but wants to exclude files ending with '.gz'. Which command is correct?
9Which TWO commands can be used to view the contents of a compressed file named 'archive.tar.gz' without extracting it?
10Refer to the exhibit. Why does the 'bin' user have /sbin/nologin as its shell?
11A user reports that a script in their home directory fails to execute. The script has permissions -rw-r--r-- and is owned by the user. Which command will allow execution for the owner?
12A system administrator needs to find all regular files larger than 10MB in /var/log. Which find command should they use?
13An administrator wants to ensure that when a user presses Ctrl+C during a long-running script, the script cleans up temporary files before exiting. Which approach should the script use?
14A user needs to view the last 15 lines of a log file that is constantly being updated. Which command should they use?
15An administrator needs to compress a directory 'data' into an archive named backup.tar.gz using gzip compression. Which command should they use?
16A system administrator needs to find all files modified in the last 24 hours under /var/log. Which command accomplishes this?
17A user reports that they cannot use the 'systemctl' command to manage services. The user is part of the 'wheel' group. Which configuration change is required to allow this?
18During boot, a server fails to mount an NFS filesystem listed in /etc/fstab. Which troubleshooting step should be taken first to isolate the issue?
19A script needs to be run at system boot for a specific user. Which method ensures the script runs with that user's environment?
20Which command displays the current system time, timezone, and whether NTP synchronization is active?
21An administrator needs to monitor network traffic on a specific interface in real time. Which tool is most appropriate for this task?
22A developer needs to compile software from source and install it under /opt/custom. To avoid affecting the system package manager, which approach should be used?
23Which TWO commands can be used to display the contents of a compressed log file without decompressing it first?
24Which TWO methods can be used to permanently set the system's hostname to 'server01.example.com'?
25Which THREE file descriptors are always available for every Unix process?
26Which command displays the current working directory?
27A user needs to find all files with the '.conf' extension under /etc. Which command should be used?
28An administrator wants to gracefully terminate a process with PID 12345. Which command should be used?
29A system administrator needs to replace all occurrences of 'enabled' with 'disabled' in /etc/ssh/sshd_config, but only on lines that do not start with '#'. Which sed command accomplishes this?
30A user wants to display the contents of a file in reverse line order. Which command should be used?
31An administrator needs to measure the execution time of the command 'backup.sh'. Which command prefix should be used?
32A user is unable to delete a file named '-f' in the current directory. Which command will successfully remove it?
33An administrator wants to create a symbolic link named 'link_to_hosts' in /tmp that points to /etc/hosts. Which command is correct?
34An administrator needs to list the permissions, owner, group, and filenames of all files in /var/log, including hidden files, in a human-readable format. Which command does this?
35Which THREE actions will create a new empty file named 'testfile' in the current directory? (Choose three.)
36Which THREE commands can be used to monitor real-time process status and update the display every 2 seconds? (Choose three.)
37Refer to the exhibit. What does the file permission -rw------- indicate about /etc/shadow?
38Refer to the exhibit. Why did the sshd service fail?
39Refer to the exhibit. The backup script runs every 5 minutes but generates errors. What is the most likely cause?
40A system administrator needs to view the last 10 lines of the log file /var/log/messages in real time as new lines are added. Which command should be used?
41A system administrator runs the command 'ls -l' and sees that a file has permissions '-rwxr-xr-x'. The administrator wants to remove execute permission for the group and others while keeping it for the owner. Which chmod command should be used?
42An administrator receives an alert that a process named 'apache2' is consuming excessive CPU. The administrator needs to identify the PID of the process and then change its priority to the lowest possible value (least favorable scheduling). Which sequence of commands should be used?
43A company policy requires that all cron jobs run by non-root users must be logged to a specific file /var/log/usercron.log. The system administrator decides to use rsyslog to capture these messages. Which configuration directive should be added to /etc/rsyslog.conf or a file in /etc/rsyslog.d/ to achieve this?
44A user wants to set an environment variable named 'EDITOR' to the value '/usr/bin/vim' so that it is available in all future login sessions. Which file should the user add the export command to?
45An administrator needs to compress a directory containing subdirectories and files into a single archive file, with maximum compression, and exclude all '*.tmp' files. Which command should be used?
46Which TWO commands can be used to view the contents of a compressed file named 'data.log.gz' without decompressing it permanently? (Choose exactly two.)
47Which THREE of the following are valid methods to schedule a recurring task in Red Hat Enterprise Linux 8? (Choose exactly three.)
48Which TWO of the following are valid examples of using redirection and pipes in bash to append the output of a command to a file while also displaying it on the terminal? (Choose exactly two.)
49A system administrator has created a new group named 'ops'. The administrator wants to add the existing user 'alice' to this group as a supplementary group without affecting her current group memberships. Which command should be used?
50A system is experiencing high CPU usage. The administrator suspects a process is stuck in an infinite loop. Which command can be used to identify the most CPU-intensive process in real-time?
51An administrator needs to schedule a script to run every Monday, Wednesday, and Friday at 2:30 PM. Which cron expression should be used?
52A Red Hat Enterprise Linux server has been configured with a custom repository for offline updates. The administrator runs 'yum repolist' and the custom repository is not listed. Which command should be used to verify that the repository configuration file is valid and located in the correct directory?
53Which two commands can be used to display the contents of a compressed .tar.gz archive without extracting it? (Choose two)
54Which three of the following are valid methods to view the manual page for the 'ls' command? (Choose three)
55A system administrator is trying to compress the contents of the directory /home/user/project into a tarball named project_backup.tar.gz using the command: tar -czf project_backup.tar.gz /home/user/project. The command completes without errors, but when the administrator tries to list the contents of the tarball using tar -tzf project_backup.tar.gz, it shows a leading slash (/) in the paths, like /home/user/project/file1. The administrator wants to create the tarball with relative paths instead. What change should be made to the tar command?
56An administrator notices that the /tmp directory is filling up quickly. They want to find all files in /tmp that are larger than 100 MB and owned by user 'ftp', then delete them. The administrator runs: find /tmp -type f -size 100M -user ftp -exec rm {} \;. However, this command deletes only files that are exactly 100 MB, not larger. Which find expression should be used instead?
57A system administrator is troubleshooting a cron job that runs a script as root. The script is located at /root/scripts/backup.sh and has permissions 755. The cron job is defined in /etc/crontab with the line: 0 2 * * * root /root/scripts/backup.sh. However, the script does not run at the scheduled time. The administrator checks the cron logs and finds no errors. The administrator then runs the script manually as root and it executes successfully. What is the most likely cause of the cron job not running?
58Which TWO commands can be used to view the kernel ring buffer?
59What does the 's' in the owner execute position indicate?
60A system administrator notices that a server is responding slowly. The administrator runs `top` and sees a process named `backup_script` consuming 95% CPU. The process runs as root and is supposed to run nightly backups. However, the system load average is low. The administrator wants to investigate without killing the process. Which of the following is the best course of action?
Redirect output with >, >>, 2>, and pipes, then process text using grep, sed, awk, cut, and sort; find files with find and locate, archive with tar and gzip, and create hard and symbolic links with ln. Get absolute versus relative path handling right.
The Courseiva EX200 question bank contains 60 questions in the Essential Tools domain, covering the 11% of the exam attributed to this domain in the official Red Hat blueprint. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Essential Tools domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included