EX200 Practice Test 13 — 15 Questions

Question 1

Refer to the exhibit. A security analyst reviews the journal output for sshd.service. Which of the following best describes the observed pattern of events?

Accepted Answer

The system experienced a brute-force attack on the root account originating from IP 192.168.1.100, which eventually succeeded.. The journal output shows repeated failed authentication attempts for the root user from IP 192.168.1.100, followed by a successful login. This pattern is characteristic of a brute-force attack where an attacker tries many passwords until one works. The final 'Accepted password for root' line confirms the attack succeeded, making D correct.

Answer

The system is under a denial-of-service attack because the connections are being closed before authentication.

Answer

The SSH service is malfunctioning and dropping connections due to a configuration error.

Answer

Multiple hosts are attempting to connect to the SSH service simultaneously, causing connection errors.

Question 2

Which TWO of the following are true about creating simple shell scripts in Red Hat Enterprise Linux?

Accepted Answer

The shebang line (e.g., #!/bin/bash) is used to specify the interpreter.. Option A is correct because the shebang line (e.g., #!/bin/bash) tells the kernel which interpreter to use when executing the script. Without it, the shell may fall back to the default interpreter (often /bin/sh) or fail to run the script correctly. This is a fundamental requirement for any interpreted script in Linux.

Answer

Scripts must be stored in /usr/local/bin to be found by the shell.

Answer

A script must be compiled before it can be run.

Answer

A script must have a .sh file extension to be executable.

Question 3

A system administrator writes a shell script to monitor disk usage and send an alert if any partition exceeds 80%. Which TWO of the following are best practices for implementing this script?

Accepted Answer

Include error handling to check for missing commands and exit gracefully.. Option B is correct because robust shell scripts should always include error handling to verify that required commands (e.g., `df`, `awk`, `grep`) are available before proceeding. This prevents the script from failing silently or producing misleading output, and allows it to exit gracefully with a meaningful error message, which is a key best practice for production scripts.

Answer

Use `cat /proc/partitions` to retrieve partition sizes.

Answer

Send alerts only via syslog (logger command).

Answer

Use `du -h /` and parse the output.

Question 4

A system administrator writes the script shown. The /etc directory contains .conf files with spaces in their names (e.g., "my config.conf"). What is the most accurate description of the script's behavior?

Accepted Answer

The script will split filenames with spaces into multiple words, causing errors.. Option D is correct because the script uses a for loop with `for file in /etc/*.conf`, which relies on shell globbing. When the glob expands, filenames with spaces (e.g., "my config.conf") are treated as separate words due to word splitting, causing the loop to iterate over each word rather than each file. This results in errors when commands like `echo` or `cp` receive broken paths.

Answer

The script will correctly process all .conf files, including those with spaces.

Answer

The script will only process the first .conf file and then exit.

Answer

The script will not execute because of a syntax error.

Question 5

The administrator wants to reduce the file system size to 40GB. Which command sequence should be used?

Accepted Answer

It is not possible to shrink an XFS file system. XFS is a high-performance 64-bit journaling file system that does not support online or offline shrinking. Once an XFS file system is created, its size cannot be reduced; the only way to reclaim space is to back up the data, destroy the file system, recreate it at the desired size, and restore the data. Therefore, any attempt to shrink an XFS file system using lvreduce or similar tools will corrupt the file system.

Answer

xfs_repair; lvreduce

Answer

umount /mnt/data; lvreduce -L 40G; mount; xfs_growfs

Answer

lvreduce -L 40G /dev/vg00/lvol0; xfs_growfs

Question 6

Which three of the following actions are required when adding a new swap device to the system? (Choose three.)

Accepted Answer

Use mkswap to set up the swap signature. Option C is correct because `mkswap` writes a swap signature (UUID and label) to the device, which is required before the kernel can use it as swap space. Without this signature, the device is not recognized as a swap area.

Answer

Mount the device to a swap directory

Answer

Create a filesystem using mkfs

Question 7

Refer to the exhibit. An administrator is unable to write to /tmp because the filesystem is full. What is the most likely cause?

Accepted Answer

The root filesystem is nearly full at 90% usage. The exhibit shows that the root filesystem (/) is at 90% usage, while /tmp is not a separate filesystem but a directory under the root. Since /tmp resides on the root filesystem, when the root filesystem is nearly full, there is no space left for writing to /tmp, causing the write failure.

Answer

The /tmp is a separate filesystem

Answer

There is a filesystem quota enabled

Answer

The /boot partition is too small

Question 8

A user wants to set an environment variable named 'EDITOR' to the value '/usr/bin/vim' so that it is available in all future login sessions. Which file should the user add the export command to?

Accepted Answer

~/.bash_profile. The ~/.bash_profile file is executed for login shells, making it the correct place to set environment variables like EDITOR that should persist across all future login sessions. Adding 'export EDITOR=/usr/bin/vim' to this file ensures the variable is defined each time the user logs in.

Answer

~/.bash_logout

Answer

/etc/bashrc

Answer

~/.bashrc

Question 9

An administrator notices that the /tmp directory is filling up quickly. They want to find all files in /tmp that are larger than 100 MB and owned by user 'ftp', then delete them. The administrator runs: find /tmp -type f -size 100M -user ftp -exec rm {} \;. However, this command deletes only files that are exactly 100 MB, not larger. Which find expression should be used instead?

Accepted Answer

find /tmp -type f -size +100M -user ftp -exec rm {} \;. Option B is correct because the `find` command uses `+` before a size value to match files larger than that size, not exactly equal. The original command omitted the `+`, so it matched only files exactly 100 MB. Adding `+100M` correctly selects files larger than 100 MB.

Answer

find /tmp -type f -size 100M -user ftp -exec rm {} \;

Answer

find /tmp -type f -size +100M ! -size 100M -user ftp -exec rm {} \;

Answer

find /tmp -type f -size +100M -size -100M -user ftp -exec rm {} \;

Question 10

An administrator is configuring an NFS mount in /etc/fstab to mount from server:/export to /mnt/data. The mount must use the 'hard' and 'nosuid' options. Which line is correct?

Accepted Answer

server:/export /mnt/data nfs nosuid,hard 0 0. Option E is correct because it specifies the NFS filesystem type and includes both required mount options: 'nosuid' (disallows set-user-identifier/set-group-identifier bits) and 'hard' (retries NFS requests indefinitely until the server responds). The syntax follows the correct /etc/fstab format: :/ .

Answer

server:/export /mnt/data nfs defaults,noexec,nodev 0 0

Answer

server:/export /mnt/data nfs nosuid,hard,defaults 0 0

Answer

server:/export /mnt/data ext4 defaults 0 0

Answer

server:/export /mnt/data nfs suid,soft 0 0

Question 11

Which command displays the UUID of all file systems on the system?

Accepted Answer

blkid. The `blkid` command is the correct choice because it is specifically designed to locate and display block device attributes, including the UUID, filesystem type, and label, for all filesystems on the system. It reads data from the `/dev/disk/by-uuid/` directory and the `udev` database, making it the most direct and reliable tool for querying UUIDs without requiring root privileges for basic output.

Answer

dumpe2fs -h

Answer

lsblk

Answer

fdisk -l

Question 12

A system administrator runs 'mount -a' and receives an error: 'mount: /mnt/nfs: mount point does not exist'. The /etc/fstab entry is: server:/export /mnt/nfs nfs defaults 0 0. What is the most likely cause?

Accepted Answer

The directory /mnt/nfs does not exist. The error message 'mount: /mnt/nfs: mount point does not exist' explicitly indicates that the directory /mnt/nfs is missing. The 'mount -a' command processes all entries in /etc/fstab, and for each filesystem, it requires the mount point directory to exist before the mount can succeed. Since the directory is absent, the mount fails immediately, regardless of the NFS server status or filesystem type.

Answer

The 'defaults' option does not include '_netdev'

Answer

The filesystem type should be 'nfs4'

Answer

The NFS server is unreachable

Question 13

The root filesystem is at 90% capacity. Which command increases available space without unmounting?

Accepted Answer

lvextend -L +5G /dev/mapper/vg_root-lv_root && xfs_growfs /. Option B is correct because it first extends the logical volume with `lvextend -L +5G`, then grows the XFS filesystem online with `xfs_growfs /` to utilize the new space without unmounting. This is the proper procedure for XFS filesystems, which require `xfs_growfs` (not `resize2fs`) to expand while mounted.

Answer

fstrim /

Answer

resize2fs /dev/mapper/vg_root-lv_root

Answer

lvextend -L +5G /dev/mapper/vg_root-lv_root

Question 14

Which file contains the list of filesystems to be mounted at system startup?

Accepted Answer

/etc/fstab. The /etc/fstab file is the system configuration file that defines static filesystem information, including devices, mount points, filesystem types, mount options, dump frequency, and fsck pass order. During system startup, the mount -a command (typically run by systemd or init scripts) reads /etc/fstab to mount all filesystems listed there, making it the definitive source for automatic mounting at boot.

Answer

/etc/rc.local

Answer

/etc/filesystems

Answer

/etc/mtab

Question 15

Which TWO commands can be used to create a physical volume for LVM? (Choose exactly two.)

Accepted Answer

pvcreate /dev/sdb1. The `pvcreate` command initializes a block device (such as a partition or an entire disk) for use as a physical volume in LVM. Option B targets a partition `/dev/sdb1`, and option C targets the whole disk `/dev/sdb` — both are valid devices that can be initialized as physical volumes, as LVM can operate on either.

Answer

mkfs.ext4

Answer

lvcreate

Answer

vgcreate

EX200 Practice Test 13 — 15 Questions

Exhibit

EX200 Practice Test 13 — 15 Questions

Exhibit