EX200 Exam Questions and Answers

mkfs -t ext4 /dev/sdb1 && mkdir /data && mount /dev/sdb1 /data && echo '/dev/sdb1 /data ext4 defaults 0 0' >> /etc/fstab

This is the only complete sequence: mkfs -t ext4 /dev/sdb1 (equivalent to mkfs.ext4) creates a fresh ext4 filesystem, mkdir /data provides the required directory mount point, mount /dev/sdb1 /data attaches the filesystem for immediate use, and appending a correctly formatted fstab line ('/dev/sdb1 /data ext4 defaults 0 0') ensures the filesystem is mounted automatically at boot. The fstab line contains the six required fields in the correct order, making this the correct answer.

df -h

df -h — Correct: this command invokes df with human-readable units and reports actual disk space usage per mounted filesystem. It shows total capacity, used space, available space, and use percentage, which is exactly what you need to determine if a slow file server is hitting a full partition. Since full filesystems are a top cause of write performance degradation, df -h is the right first diagnostic.

fdisk /dev/sdd, create partition, then mkswap /dev/sdd1, swapon /dev/sdd1, and add to /etc/fstab.

This is the complete and correct procedure: fdisk creates a 1 GB partition on /dev/sdd (assigned as /dev/sdd1), mkswap writes the swap signature to that partition, swapon activates the swap for immediate use, and adding the line to /etc/fstab ensures automatic activation at boot. The fstab entry alone or the swapon alone would be incomplete, but combining them covers both current-session and persistent swap. The fdisk step also ensures the partition actually exists with the desired size, unlike the other options that assume a preexisting /dev/sdd1.

The filesystem is XFS, and fsck does not repair XFS.

This is correct. XFS is not repairable by fsck; fsck only inspects the XFS log to see whether the filesystem was cleanly unmounted and reports a 'clean' status based on that flag alone, without traversing metadata structures. To actually verify and repair an XFS filesystem you must use the dedicated xfs_repair utility, so a read-only XFS filesystem after a crash would still be reported as 'clean' by fsck while remaining unusable for writes.

Use sfdisk to copy partition table from /dev/sda to /dev/sdb, then 'mdadm --manage /dev/md0 --add /dev/sdb1'

Use 'sfdisk' to clone the partition table from /dev/sda to /dev/sdb, ensuring the new disk has a matching partition layout with the correct RAID partition type and UUIDs. After that, 'mdadm --manage /dev/md0 --add /dev/sdb1' enrolls the freshly partitioned partition as a spare, causing the array to start rebuilding the mirror data. This sequence properly introduces the new disk into the existing RAID1 without disrupting the active array.

mkfs.xfs -L data /dev/nvme0n1p1

Uppercase -L is the mkfs.xfs option for setting the XFS volume label, and `data` becomes that label on /dev/nvme0n1p1. This creates a filesystem that can later be referenced via `-L data` in mount options or by symlinks under /dev/disk/by-label/. The command is correct as written and satisfies the requirement to create a labeled XFS filesystem.

The directory has incorrect SELinux context

Even when the directory's mode and ownership (2775, root:developers) grant Bob write access, SELinux performs a separate mandatory access control check. If /data carries a context type that Bob's domain is not allowed to write to (for example, default_t instead of a type like public_content_rw_t or a domain-specific type), the kernel denies the operation with EACCES. This appears as a permission problem though standard permissions are correct. To fix, restore or apply the correct context, e.g., restorecon -Rv /data or a custom semanage fcontext rule.

find /home -user olduser -exec chown guest {} +

find /home -user olduser -exec chown guest {} + is correct because it searches /home for every file whose owner matches the username olduser (which resolves to the UID) and executes chown guest on them in one batched command, thanks to the + terminator. This directly transfers ownership of each located file to guest, satisfying the policy efficiently. The find approach also covers files outside olduser's home directory that reside anywhere under /home, whereas other options only handle the home directory itself.

usermod -aG wheel,docker jane

The -aG form is a compact combined option where -a enables append mode and -G specifies the supplementary group list, so the effect is exactly the same as usermod -a -G. It adds jane to wheel and docker while retaining any other supplementary groups she already has. Although it is less readable than the separated form, it is a fully valid and correct way to accomplish the task.

usermod -a -G wheel,docker jane

Using -a alongside -G directs usermod to append the listed groups to the user's current supplementary groups instead of replacing them. This command explicitly adds jane to both wheel and docker, and because -a is present, all her existing supplementary memberships are left intact. It is the canonical, unambiguous way to satisfy the requirement, and the space between -a and -G is optional but harmless.

Write a script to run 'chage -M 90' for each user in the finance group

A script that calls chage -M 90 for each user in the finance group is the correct approach because chage directly updates the maximum password age field in /etc/shadow for existing user accounts. For example, you can iterate over `getent group finance | cut -d: -f4`, and run chage for each member, which precisely targets the intended accounts and leaves all other users untouched.

usermod -aG

`usermod -aG` adds the user to a supplementary group, not the primary group.

gpasswd -a

`gpasswd -a` adds the user to a supplementary group, not the primary group.

Change the user's shell to /sbin/nologin

Setting jdoe's shell to /sbin/nologin in /etc/passwd makes PAM deny interactive login sessions, typically printing 'This account is currently not available.' FTP daemons such as vsftpd or proftpd authenticate against /etc/shadow without invoking the user's shell, so they still allow file transfers. Because /sbin/nologin only blocks shell access and does not alter the password hash, it is the standard, targeted solution for allowing non-login services while prohibiting interactive logins.

pvcreate /dev/sdb, vgextend vgdata /dev/sdb, lvextend

pvcreate initializes /dev/sdb with LVM metadata, making it a physical volume that LVM can recognize. vgextend then adds that PV to the existing volume group vgdata, increasing its total allocatable space. Only after the VG has free physical extents can lvextend allocate from them to grow a logical volume, followed by a filesystem resize if needed. This dependency chain makes the order mandatory.

To make the kernel re-read the partition table

partprobe, from the parted suite, is specifically designed to make the Linux kernel re-read the partition table from a disk. After partitioning /dev/sdc, the kernel may still have the old view, so partprobe triggers a revalidation so that the new partition appears as a block device (e.g., /dev/sdc1) without requiring a reboot. This is the correct and intended purpose of the command, though in cases where the disk is in use, a reboot or partx may be needed.

lvextend, then xfs_growfs

Extending the logical volume first is required because XFS can only be grown, and the filesystem growth depends on the block device's new capacity. After lvextend allocates the additional storage to the LV, the mounted XFS filesystem is still the old size; running xfs_growfs on the mount point resizes it online to consume the newly available space. This is the only correct sequence for an XFS filesystem on LVM.

mdadm --fail /dev/md0 /dev/sdb

This is the correct command: mdadm --manage --fail /dev/md0 /dev/sdb (the --manage action is implicit when using --fail) marks /dev/sdb as faulty in the RAID 5 array /dev/md0. Once marked, mdadm removes the device from the active array, and the array continues operating in a degraded state because RAID 5 tolerates a single disk failure. You can then remove the failed disk (mdadm --remove) and replace it (mdadm --add) to rebuild redundancy, which is the proper workflow for handling a failing disk.

lvcreate -L 2G -n lvdata vgdata

This is the correct invocation. The -L 2G option explicitly sets the logical volume's size to 2 gigabytes, -n lvdata assigns the logical volume name, and vgdata is the volume group from which the space is allocated. The syntax matches lvcreate(8): lvcreate [options] volume_group.

mkswap /dev/sdb1

mkswap /dev/sdb1 is the correct initial step because it writes the swap signature (UUID and swap superblock) onto the partition, turning it into a usable swap area. Once this initialization is complete, the swap space can be activated with swapon. Without mkswap, the partition lacks the metadata required for the kernel to recognize it as swap.

The journal stores logs in a structured binary format, allowing filtering by fields like _UID or _SYSTEMD_UNIT.

The systemd journal is stored as a compact, indexed binary database, not as text. Each entry includes a rich set of structured metadata fields, such as _UID, _SYSTEMD_UNIT, _PID, and _COMM, which can be used for powerful filtering with journalctl, e.g., journalctl _UID=1000. This design enables more precise querying than plain-text log files.

The journal can forward log messages to rsyslog by setting ForwardToSyslog=yes in /etc/systemd/journald.conf.

By setting ForwardToSyslog=yes in /etc/systemd/journald.conf (in the [Journal] section), journald will forward each log entry it receives to the local syslog service, typically rsyslog. This allows traditional text-based log files like /var/log/messages to continue working alongside the journal. The forwarding is a one-way push from journald to rsyslog, not the other way around.

The system experienced a brute-force attack on the root account originating from IP 192.168.1.100, which eventually succeeded.

This is the classic signature of a brute-force attack: a large number of 'Failed password for root from 192.168.1.100' entries followed by an 'Accepted password for root from 192.168.1.100' entry. The attacker systematically guessed passwords until one succeeded, giving them authenticated root access to the system. The escalation to a successful login after repeated failures confirms that the attack was not just a random scan but a targeted credential-guessing attack that ultimately breached the root account.

ext4: Standard journaling file system for Linux.

ext4 is the default journaling file system on most Linux distributions, building on its predecessor ext3 by adding extents, delayed allocation, and support for volumes up to 1 EiB and files up to 16 TiB. Its journal records metadata transactions before they are committed, which dramatically reduces the risk of corruption after an unclean shutdown. Backward compatibility allows ext2 and ext3 filesystems to be mounted as ext4, making it a straightforward, widely adopted choice for general-purpose storage.

XFS: High-performance file system supporting large files and parallel I/O.

XFS is a 64-bit journaling file system originally developed by SGI, engineered for high scalability and throughput on large files and parallel I/O workloads. It uses allocation groups and b-tree indexing to maintain performance even as the filesystem grows, and supports files up to 8 EiB in size. With features like delayed allocation and preallocation, XFS excels in enterprise servers handling concurrent streaming data, making it the default root filesystem on Red Hat Enterprise Linux 7 and later.

Btrfs: Copy-on-write file system with snapshots, checksums, and compression.

Btrfs is a modern copy-on-write (CoW) file system designed around advanced features rather than pure performance. Its CoW semantics enable instant, space-efficient snapshots and subvolumes, while checksums on every block detect silent data corruption and, when combined with RAID features, can self-heal damaged data. It also offers transparent compression (LZO, zlib, or ZSTD) and online resizing, allowing the filesystem capacity to be grown or shrunk without unmounting the volume.

useradd: Creates a new user account

useradd is the standard low-level utility in the shadow-utils package for creating new user accounts. It adds an entry to /etc/passwd and /etc/shadow, optionally creates the user's home directory, and applies defaults from /etc/login.defs and /etc/default/useradd. However, it does not assign a password; an administrator must run passwd afterward. This is the correct tool for the lifecycle stage of account creation.

usermod: Modifies an existing user account

usermod is the correct utility for changing the attributes of an existing user account, such as the login name (-l), home directory (-d), default shell (-s), primary group (-g), supplementary groups (-aG), and account lock state (-L/-U). It directly modifies the relevant lines in /etc/passwd, /etc/shadow, and /etc/group. usermod should be used whenever an account already exists and its properties need to be updated without deleting or recreating it.

userdel: Deletes a user account

userdel is the correct command for removing a user account from the system. It deletes the entries from /etc/passwd, /etc/shadow, and also removes the user's group membership from /etc/group. Using the -r option additionally removes the user's home directory and mail spool. userdel is the counterpart to useradd and completes the account lifecycle.

groupadd: Creates a new group

groupadd is the correct tool for creating a new group on the system. It adds an entry to /etc/group and /etc/gshadow, either with an administrator-specified GID using -g or an automatically selected GID from the range defined in /etc/login.defs. It does not add members to the group; membership is assigned later with usermod -aG or gpasswd. This is the standard way to establish a new group.

Restart=always

Restart=always is the correct systemd directive for automatically restarting a service after it exits, regardless of the exit status. Placed in the [Service] section, it tells systemd to unconditionally restart the process, covering crashes, normal exits, and signals. This provides a high degree of availability, though it may also restart after intentional stops; more granular control can be achieved with variants like Restart=on-failure.

systemctl is-active

systemctl is-active directly queries the systemd manager over the D-Bus interface for the unit's current runtime state and prints a single word such as 'active', 'inactive', 'activating', or 'failed'. Its exit code is also set to 0 only when the service is active, making it the ideal tool for shell conditionals and monitoring scripts because it requires no output parsing or filtering.

Add 'blacklist usb_storage' to /etc/modprobe.d/blacklist.conf

This is the standard and correct approach: /etc/modprobe.d/ contains configuration consumed by modprobe, and the 'blacklist' directive instructs it to ignore any request to load usb_storage from automatic discovery (e.g., udev or coldplug). Files in this directory follow a .conf naming convention, so blacklist.conf is a conventional choice. This prevents the module from being loaded by alias, though a user could still force it with an explicit full-name modprobe command.

lvextend -L 15G /dev/vg_data/lv_data; resize2fs /dev/vg_data/lv_data

lvextend -L 15G /dev/vg_data/lv_data; resize2fs /dev/vg_data/lv_data — This is the correct order. lvextend first expands the logical volume by adding physical extents from the volume group, making a larger block device available to the filesystem. Only after that can resize2fs safely grow the ext4 filesystem into the newly available space; attempting filesystem growth first would have no extra capacity to claim.

nmcli connection modify enp1s0 ipv4.addresses 192.168.1.100/24

`nmcli connection modify` writes the static address into the NetworkManager connection profile for `enp1s0`, satisfying the requirement to configure it through NetworkManager rather than editing ifcfg files or using `ip addr`. The `ipv4.addresses` property accepts the address with prefix length, and the change persists across reboots once the connection is reactivated.

/etc/logrotate.d/syslog

This is a logrotate drop-in configuration file located under /etc/logrotate.d. logrotate reads this file when it runs, and it lists /var/log/messages (along with /var/log/secure, cron, etc.) with directives for rotation frequency, number of retained rotated logs, and a postrotate command to signal rsyslog with HUP. Editing this file is the correct way to change how those syslog files are rotated.

The user account is intentionally disabled for login.

An intentionally disabled login account is typically configured with /sbin/nologin as the user's login shell or by locking the account in /etc/shadow with an '!' or '*' in the encrypted password field. This prevents the user from starting an interactive shell while still potentially allowing non-login services like POP3 or FTP, depending on PAM configuration. Because the problem is isolated to one user and no other users are affected, an administrative disablement is the most precise cause. The system administrator can verify this with the 'chsh -l' or by inspecting the last field of /etc/passwd.

dnf list available httpd

dnf list available httpd asks DNF to query the enabled repository metadata and display only packages that are not yet installed and whose name exactly matches 'httpd'. The output shows the version and repository source, proving availability. Because it targets the exact package name and filters to available packages, it is the most precise way to verify httpd can be installed.

podman run --security-opt label=type:container_t -v /host/data:/data myimage

`--security-opt label=type:container_t` directly instructs the container runtime to apply the SELinux type `container_t` to the container's processes and files, which is the proper way to set a SELinux context in Podman. This option is processed by the OCI runtime and translates into the appropriate SELinux labeling call, ensuring the container is confined by the targeted policy. It is the correct method because it leverages the intended `security-opt` mechanism for SELinux type selection.

The user must have entries in /etc/subuid and /etc/subgid for user namespace mapping.

For rootless containers, every UID and GID used inside the container must be mapped to an unprivileged range on the host, and those ranges are defined in /etc/subuid and /etc/subgid. The container engine such as Podman calls newuidmap and newgidmap to apply the subordinate ID mapping, and without at least one range assigned to the user, the kernel cannot establish the user namespace and the container fails to launch. A typical entry allocates a starting UID and a count, for example 1000:100000:65536, to give the container up to 65,536 IDs to work with.

podman volume create dbdata && podman run -v dbdata:/var/lib/mysql mydb

This is the correct approach because podman volume create dbdata allocates a dedicated, managed volume in Podman's storage area, and the -v dbdata:/var/lib/mysql flag uses the non-absolute source to identify it as a named volume rather than a host path. Podman handles all lifecycle operations, permissions are configured correctly for the container's user, and the volume persists across container restarts and even after the container is removed. You can inspect it with podman volume inspect and reuse it with other containers, making it the right choice for durable database data.

A container is a running or stopped instance of an image with a writable layer.

A container is the runtime instance produced when an image is instantiated, and it always has its own thin writable layer placed on top of the read-only image layers. This layer captures all file system changes made by the container, regardless of whether the container is currently executing or has been stopped. The writable layer remains associated with the container object until the container itself is deleted, so both running and stopped containers are considered instances with that writable layer.

A container image is a read-only template used to create containers.

Container images are immutable templates consisting of one or more read-only layers that hold the application code, runtime, libraries, and configuration. Because every layer is read-only, an image can be used to spawn any number of containers without the risk of the template being altered. Any modifications made during a container's life are written to a separate, ephemeral writable layer, leaving the underlying image untouched. This read-only design underpins image caching and content-addressable storage.

Ensure the user has a running systemd user instance (loginctl enable-linger).

Rootless Podman relies on a per-user systemd instance to manage the lifecycle of container processes and services. `loginctl enable-linger` ensures that this user instance starts automatically at boot and persists after the user logs out, which is essential for containers running in the background. Without linger, containers may be terminated when the user session ends.

Configure subordinate UID and GID ranges for the user in /etc/subuid and /etc/subgid.

Rootless containers need a range of sub-UIDs and sub-GIDs to map a non-root user to root inside the container namespace. Entries in /etc/subuid and /etc/subgid allocate these ranges; `useradd` can set them via --subuid-start or they can be edited manually. If no range is defined, Podman cannot perform the necessary UID/GID mapping and rootless operation fails.

Enable user namespaces in the kernel if not already enabled.

User namespaces are a kernel feature that allows unprivileged users to map their UID to root inside a container, which is fundamental to rootless Podman. While most distributions compile CONFIG_USER_NS=y, some hardened kernels disable it or subsume it behind the `kernel.unprivileged_userns_clone` sysctl. If user namespaces are disabled or restricted, even with correct subuid/subgid configuration, rootless container creation will fail.

podman run -d -p 8080:80 nginx

The -d flag detaches the container, keeping it running in the background even after your shell exits. The -p flag publishes a port mapping in the form host:container, so -p 8080:80 exposes the container's port 80 (where nginx serves HTTP) on the host's port 8080. This meets the requirement of a persistent, reachable container. Because the mapping order is correct, startup will succeed and traffic to localhost:8080 reaches nginx.

usermod -s /sbin/nologin apache

Setting the login shell to /sbin/nologin blocks interactive SSH and console sessions for apache while leaving the account valid for service processes. This satisfies the requirement to deny login without deleting the UID 48 account.

The issue is due to file permissions or ACLs, not SELinux.

Because the administrator has already switched SELinux to permissive mode and the access is still refused, the remaining blocker must be from Linux's discretionary access control (DAC) layer — the classic Unix permissions (owner/group/others) or POSIX ACLs. SELinux is a mandatory access control (MAC) system layered on top of DAC, so it can only deny what DAC would otherwise permit; in permissive mode it adds no denials. Inspect ls -l, getfacl, and ownership to find the real permission or ACL problem.

jdoe client1.example.com=(root) NOPASSWD: ALL

This is the correct rule. It confines the privilege to client1.example.com, specifies that commands run as root via (root), and uses the NOPASSWD tag so jdoe is not prompted for a password. The syntax exactly matches the sudoers grammar: user host_list = (runas) TAG: command_list, so it satisfies the requirement without unnecessary wildcards.

The rule was added with --permanent but firewall-cmd --reload was not run.

Rules added with `--permanent` are written to the on-disk configuration but not loaded into the running firewalld instance. Without `firewall-cmd --reload`, the active ruleset never includes the HTTPS allowance, so clients remain blocked despite the saved rule.

stat -c %C

The `stat -c %C` option is correct because the `stat` command's `%C` format specifier directly prints the SELinux security context of the specified file, such as `system_u:object_r:etc_t:s0`. This works on any filesystem object and is a precise, scriptable way to retrieve only the context string.

ls -Z

The `ls -Z` option is correct because it displays the SELinux security context of each listed file in the output, alongside the file name and other metadata. It is the most common and convenient command for quickly viewing file contexts in a directory.

Add 'alice web1.example.com=(root) NOPASSWD: /usr/bin/systemctl restart httpd' to /etc/sudoers.d/alice.

This entry precisely scopes alice's sudo privilege to the exact systemctl invocation required to restart httpd, with NOPASSWD so the service can be restarted without interactive password entry. The command path /usr/bin/systemctl is verified as a literal command; arguments are permitted as given. This meets the stated requirement of minimal access while allowing the action.

No .log files exist in /var/log/myapp at the time of script execution, causing the glob to match nothing.

In a non-interactive shell, an unmatched glob like /var/log/myapp/*.log is not expanded and is passed literally to cp. cp then attempts to copy a file named `*.log`, which does not exist, producing a 'No such file or directory' error and creating no backup. Unless the script checks the glob result or has error handling, this failure can be silent, especially if cron's stderr output is not inspected.

Quote variables when used in commands, e.g., "$file" instead of $file.

Unquoted variable expansions are subject to word splitting and pathname expansion, so a filename like 'My File.txt' would be split into two arguments, and a value containing '*' could expand to multiple files. Quoting, as in "$file", preserves the variable's value as one literal argument, preventing these transformations. This is essential when handling user input, file paths, or any value with whitespace or glob characters.

Start the script with a shebang line, e.g., #!/bin/bash.

A shebang line, such as #!/bin/bash, tells the operating system kernel which interpreter to invoke when the script is executed directly, and it must be the first line of the file. Without it, execution may fail with 'permission denied' or fall back to the current shell, which may not support the script's syntax. Choosing the correct shebang ensures the script runs in a predictable environment and that bash-specific features are available.

Include set -e at the beginning of the script to exit on any error.

set -e makes the script abort immediately when any command or simple pipeline returns a non-zero exit status, so errors do not silently cascade. This is a common reliability safeguard, but it has caveats: it is ignored in conditional contexts like if or while tests, and commands whose failure is expected must be explicitly handled. Used thoughtfully, it improves deterministic behavior and simplifies debugging.

The shebang line (e.g., #!/bin/bash) is used to specify the interpreter.

The shebang line is a special two-byte sequence (0x23 0x21) followed by an absolute path to an interpreter, such as #!/bin/bash. When the kernel tries to execute a script directly, it reads the first line, sees the shebang, and launches the specified interpreter with the script as its argument. If the interpreter path is invalid, the script fails with a "bad interpreter" error, so the shebang is essential for scripts executed as standalone commands. However, a script can omit the shebang if it is explicitly run as the argument to an interpreter, e.g., bash script.sh.

The script file must have execute permission (chmod +x) to be run directly.

To run a script directly as a command, the file must have one of its execute bits set (user, group, or other). The chmod +x command adds execute permission for all users, and without that bit the kernel refuses to execute the file, returning a "Permission denied" error even if the script's shebang and syntax are correct. This is because the kernel's execve() system call checks the file's mode bits for execute permission prior to starting the interpreter. Interestingly, a script without execute permission can still be run indirectly by invoking the interpreter itself, such as bash script.sh, but that bypasses direct execution.

Add the execute permission to the script using 'chmod +x /home/devops/deploy.sh'.

The correct action is to grant execute permission explicitly. The chmod +x command adds the execute bit (x) to the file's mode for the user, group, and others, which is required for the kernel to allow execve to run the script directly. Without this bit, the shell returns 'Permission denied' even though the user can read and write the file. Since the devops user already owns the file and has read/write permissions, adding the execute bit is the minimal, sufficient fix to make the script runnable.

Create snapshot using lvcreate -s, Mount snapshot to a directory, Perform operations on snapshot, Unmount snapshot, Remove snapshot

This is the correct order for using a logical volume snapshot. First create the snapshot, then mount it to access the data, perform operations (like backups), unmount when done, and finally remove the snapshot to free space.

It exits the script immediately if a command fails

This is the exact purpose of `set -e`, also known as `errexit`. When enabled, the shell immediately exits if any simple command, pipeline, or compound command (outside of contexts like `if`, `while`, `until`, `!`, or `&&`/`||` left operands) returns a non-zero status. This halts the script at the first error rather than continuing with unchecked failures.

find /var/log -mmin -120

The `-mmin -120` predicate is the correct choice because it directly tests modification time in minutes. A leading minus sign means "less than," so `-120` matches any file whose data was last modified within the last 120 minutes (i.e., less than two hours ago). This precisely answers the requirement to find files in `/var/log` that have been modified in the last two hours.

env

The `env` command, when run without arguments, prints the complete environment that will be passed to child processes, making it the most direct way to verify whether `LS_COLORS` is defined and what its value is. Because `ls` relies on the `LS_COLORS` environment variable to know which color codes to use (assuming color output is enabled), `env` immediately exposes whether that variable is missing, empty, or malformed. It also allows filtering, e.g., `env | grep LS_COLORS`, for a concise check.

sudo ss -tlnp

sudo ss -tlnp is the correct modern command because ss is part of iproute2 and is the standard socket inspection utility in RHEL. The flags -t limit output to TCP, -l show only listening sockets, -n display numeric ports, and -p attach the PID and process name to each entry; sudo is required because process ownership information is only visible to root for sockets belonging to other users. This command directly reads kernel socket tables via /proc and gives a clean, complete list of all TCP listeners.

man ls and then type /color

This is the correct approach because man ls opens the ls manual page in a pager (typically less), and typing the slash key (/) invokes the pager's interactive search function. Entering /color immediately jumps to the first occurrence of the string 'color' in the fully formatted page, and pressing 'n' cycles through subsequent matches. This lets you quickly locate the --color option's description right where it appears in the manual.

kill -9 3456

SIGKILL (signal 9) is the only signal that the Linux kernel delivers directly, bypassing any user-space signal handler in process 3456. Because neither the process nor its threads can catch, block, or ignore SIGKILL, the kernel immediately terminates the process and reaps its resources, making it the correct last resort for a hung process that has failed to respond to SIGTERM.

--exclude=/tmp

The --exclude=/tmp option is correct because it directly tells GNU tar to skip the entire /tmp directory tree when creating the archive. The argument after --exclude is a shell glob pattern (or literal path) that tar matches against absolute paths while traversing the filesystem, so /tmp (and everything beneath it) will not be included. This is the standard, dedicated mechanism for omitting a directory from a backup.