EX200 Practice Test 18 — 15 Questions

Question 1

An administrator accidentally deleted the group 'sales' which is the primary group of several users. What is the immediate effect on those users?

Accepted Answer

Their files will show a missing GID in directory listings. When a group is deleted, the system does not retroactively change the GID stored in the /etc/passwd file for users whose primary group was that group. The GID field in /etc/passwd still contains the numeric GID of the deleted group, but since the group no longer exists in /etc/group, the system cannot resolve that GID to a group name. As a result, commands like ls -l will display the numeric GID instead of the group name for files owned by those users, because the GID-to-name mapping fails.

Answer

The system will recreate the group automatically

Answer

Their primary group will be changed to their UID

Answer

They will be unable to log in

Question 2

Which file contains the hashed passwords for local user accounts?

Accepted Answer

/etc/shadow. The /etc/shadow file stores hashed passwords for local user accounts, along with password aging and expiration information. It is readable only by root (or privileged processes) to prevent unauthorized access to password hashes, unlike /etc/passwd which is world-readable.

Answer

/etc/security/passwd

Answer

/etc/passwd

Answer

/etc/gshadow

Question 3

Refer to the exhibit. An administrator extends an XFS filesystem on /data. Which prerequisite step is missing from the output?

Accepted Answer

The filesystem must be mounted before xfs_growfs. The xfs_growfs command requires the XFS filesystem to be mounted because it operates on a live filesystem, resizing it to match the underlying block device. The exhibit shows the administrator running xfs_growfs without first mounting /data, which is the missing prerequisite step. Without mounting, xfs_growfs cannot access the filesystem's superblock to perform the resize.

Answer

The filesystem must be checked with xfs_repair before growing

Answer

The filesystem must be unmounted before xfs_growfs

Answer

The logical volume must be deactivated before xfs_growfs

Question 4

A technician needs to configure a network interface to use a static IP address permanently. Which command should be used in RHEL 9?

Accepted Answer

nmcli. `nmcli` is the primary command-line tool for managing NetworkManager in RHEL 9, and it allows you to configure a static IP address persistently. Using `nmcli con mod` followed by the connection name and IP settings ensures the configuration survives reboots, as NetworkManager stores the settings in its own configuration files.

Answer

ip

Answer

vi /etc/sysconfig/network-scripts/ifcfg-eth0

Answer

ifconfig

Question 5

An organization uses a shell script that runs daily via cron on a central management server to archive logs from 50 remote Red Hat Enterprise Linux servers. The script uses `scp` with SSH key-based authentication (passwordless) to transfer files. Recently, after a security team rotated the SSH host keys on all remote servers, the script started failing with 'Host key verification failed' errors. The administrator needs to restore automated log transfers without compromising security. The remote servers are in a controlled internal network, and the management server's `~/.ssh/known_hosts` file is not centrally managed. Which course of action should the administrator take?

Accepted Answer

Use ssh-keyscan to retrieve the new host keys and add them to the management server's known_hosts file.. Using `ssh-keyscan` to retrieve the new host keys and add them to the management server's `known_hosts` file is the proper method to update host keys without disabling security. This approach maintains SSH host key verification, which prevents man-in-the-middle attacks, while allowing the script to authenticate the remote servers after the key rotation.

Answer

Add the -o StrictHostKeyChecking=no option to the scp command in the script.

Answer

Modify the sshd_config on each remote server to disable host key checking.

Answer

Replace scp with rsync in the script, as rsync uses a different authentication method.

Question 6

A server running Red Hat Enterprise Linux 9 experiences high system load (load average 15 on a 4-core system) and slow response times. The administrator runs 'top' and sees that the 'kworker' processes are consuming significant CPU time. Further investigation reveals that the system is performing heavy I/O operations on the root filesystem, which is formatted as XFS. The administrator wants to reduce the impact of filesystem maintenance tasks on system performance. Which of the following actions should the administrator take?

Accepted Answer

Set the dirty ratio sysctl parameters (vm.dirty_ratio and vm.dirty_background_ratio) to lower values.. The high system load is caused by heavy I/O operations, and the kworker processes indicate kernel threads handling writeback. Lowering vm.dirty_ratio and vm.dirty_background_ratio reduces the amount of dirty pages that accumulate before writeback begins, which prevents large bursts of I/O and smooths out disk writes, thereby reducing the impact on system performance.

Answer

Increase the value of the 'nr_requests' queue parameter for the underlying block device.

Answer

Mount the filesystem with the 'noatime' option to reduce metadata updates.

Answer

Schedule filesystem checks (fsck) to run during off-peak hours using a cron job.

Question 7

Put the steps to configure a new swap partition of 2 GiB on /dev/sdc1 and enable it in order.

Accepted Answer

First, run mkswap /dev/sdc1 to format the partition as swap. Then, run swapon /dev/sdc1 to activate it. Finally, add an entry to /etc/fstab to make it persistent across reboots.. Swap configuration involves partitioning, formatting, enabling, and making persistent in fstab.

Answer

First, run swapon /dev/sdc1 to activate the swap. Then, run mkswap /dev/sdc1 to format it. Finally, add an entry to /etc/fstab.

Answer

First, add an entry to /etc/fstab for /dev/sdc1. Then, run mkswap /dev/sdc1. Finally, run swapon /dev/sdc1.

Answer

First, run mkswap /dev/sdc1. Then, add an entry to /etc/fstab. Finally, run swapon /dev/sdc1.

Question 8

A user reports that the Apache web server cannot serve the file /var/www/html/index.html on a RHEL 9 system when SELinux is in enforcing mode. Given the exhibit output, what is the most likely cause?

Accepted Answer

The SELinux context of the file is incorrect for web serving.. The default SELinux context for files served by Apache in /var/www/html is `httpd_sys_content_t`. If the file has a different context (e.g., `unconfined_u:object_r:admin_home_t:s0`), SELinux will deny Apache read access even if standard Linux permissions are permissive. The `ls -Z` output would reveal the mismatch, and `restorecon -v /var/www/html/index.html` would fix it.

Answer

The firewalld service is blocking HTTP traffic on port 80.

Answer

The file is owned by root and Apache cannot read it.

Answer

The file permissions do not allow the apache user to read the file.

Question 9

A system has two logical volumes in the same volume group: 'lv_prod' (100% used) and 'lv_backup' (20% used). The administrator wants to allocate 5 GiB from 'lv_backup' to 'lv_prod' without unmounting any filesystems. Is this possible and why?

Accepted Answer

No, because ext4 filesystems cannot be shrunk online; they must be unmounted.. Ext4 filesystems do not support online shrinking; they must be unmounted before reducing the logical volume. Since the administrator wants to shrink lv_backup (which is only 20% used) to free 5 GiB, the ext4 filesystem on that LV must be unmounted first. Without unmounting, the lvreduce operation would fail, making the scenario impossible as described.

Answer

Yes, use lvreduce and lvextend while mounted; ext4 supports online shrinking.

Answer

No, because LVM does not allow freeing extents from an LV while it is active.

Answer

Yes, use lvresize to move extents between LVs directly.

Question 10

Based on the exhibit, how much free space is available in the volume group vg00?

Accepted Answer

19.98 GiB. The VG free space is calculated from the total number of Physical Extents (PEs) and the PE size. The output shows 5115 PEs and a PE size of 4.00 MiB, so total free space = 5115 × 4 MiB = 20460 MiB = 19.98 GiB (since 20460 ÷ 1024 = 19.98046875). No Logical Volumes are allocated, so all PEs are free. Option B (10235 MiB) is exactly half of 20470 MiB, a common miscalculation. Option C (20.00 GiB) is the raw PV size, ignoring the PE overhead. Option D (19.99 GiB) is a rounding error. Option E (5115 MiB) confuses the PE count with the free space in MiB.

Answer

10235 MiB

Answer

20.00 GiB

Answer

19.99 GiB

Answer

5115 MiB

Question 11

A system administrator is trying to compress the contents of the directory /home/user/project into a tarball named project_backup.tar.gz using the command: tar -czf project_backup.tar.gz /home/user/project. The command completes without errors, but when the administrator tries to list the contents of the tarball using tar -tzf project_backup.tar.gz, it shows a leading slash (/) in the paths, like /home/user/project/file1. The administrator wants to create the tarball with relative paths instead. What change should be made to the tar command?

Accepted Answer

Use tar -czf project_backup.tar.gz -C /home/user project. The `-C` option changes the working directory to `/home/user` before archiving, so the argument `project` is interpreted as a relative path. This strips the leading slash and stores paths like `project/file1` instead of absolute paths. The `-C` option is the standard way to create tarballs with relative paths in a single command.

Answer

Use tar -czf project_backup.tar.gz --absolute-names /home/user/project

Answer

Use tar -czf project_backup.tar.gz -P /home/user/project

Answer

Use tar -czf project_backup.tar.gz -h /home/user/project

Question 12

A system administrator needs to find all files modified in the last 24 hours under /var/log. Which command accomplishes this?

Accepted Answer

find /var/log -mtime -1. `find /var/log -mtime -1` searches for files under `/var/log` whose modification time (`mtime`) is less than 1 day ago (i.e., modified within the last 24 hours). The `-mtime` flag checks the last modification time of file content, which is the standard criterion for 'modified' files.

Answer

find /var/log -ctime -1

Answer

find /var/log -atime -1

Answer

find /var/log -mmin 1440

Question 13

A system administrator needs to replace all occurrences of 'enabled' with 'disabled' in /etc/ssh/sshd_config, but only on lines that do not start with '#'. Which sed command accomplishes this?

Accepted Answer

sed '/^#/!s/enabled/disabled/g' /etc/ssh/sshd_config. It uses an address range `/^#/!` to negate lines starting with `#` (comments), then applies the substitution `s/enabled/disabled/g` only to non-comment lines. The `!` operator inverts the match, so the command acts on lines that do NOT match the pattern, which is exactly what the requirement specifies.

Answer

sed 's/enabled/disabled/g' /etc/ssh/sshd_config

Answer

sed -n '/^#/!s/enabled/disabled/gp' /etc/ssh/sshd_config

Answer

sed '/^#/s/enabled/disabled/g' /etc/ssh/sshd_config

Question 14

A database container crashes repeatedly. The administrator wants to see the last 10 lines of the container's logs before it exited. Which command should be used?

Accepted Answer

podman logs --tail 10 . The `podman logs --tail 10 ` command retrieves the last 10 lines of the container's log output, which is exactly what the administrator needs to see the final log entries before the container exited. The `--tail` flag specifies the number of lines from the end of the log, making it ideal for troubleshooting a crash without viewing the entire log history.

Answer

podman logs -f <container>

Answer

podman logs --since 10m <container>

Answer

podman inspect <container>

Question 15

Refer to the exhibit. An administrator wants to add the HTTP service (port 80) to the internal zone permanently. Which sequence of commands should be used?

Accepted Answer

firewall-cmd --zone=internal --add-service=http --permanent; firewall-cmd --reload. It uses the --permanent flag to make the rule persistent across reboots, and then runs firewall-cmd --reload to apply the permanent configuration to the running runtime environment without restarting the firewalld service. This sequence ensures the HTTP service is added to the internal zone permanently while maintaining active connections.

Answer

firewall-cmd --add-service=http --zone=internal; firewall-cmd --reload

Answer

firewall-cmd --permanent --add-service=http --zone=internal; systemctl restart firewalld

Answer

firewall-cmd --zone=internal --add-service=http; firewall-cmd --runtime-to-permanent