EX200 Practice Exam 1 — 20 Questions

Question 1

Which TWO methods are considered best practices for securing SSH access to a server? (Select exactly two.)

Accepted Answer

Disable root login by setting PermitRootLogin no.. Disabling root login by setting `PermitRootLogin no` in `/etc/ssh/sshd_config` prevents direct SSH access as the root user, forcing administrators to log in as a regular user and then use `sudo` or `su` to escalate privileges. This reduces the attack surface by eliminating a high-value target for brute-force attacks and ensures all actions are auditable via the regular user's session.

Answer

Use only password authentication for simplicity.

Answer

Change the default SSH port to a high-numbered port.

Answer

Allow SSH access for all users in the system.

Question 2

An administrator wants to run a container with --user 1001:1001 to avoid running as root. After starting, the container cannot write to a bind-mounted directory owned by root. What is the best practice to allow write access?

Accepted Answer

Use 'podman unshare chown 1001:1001 /host/dir' to change host directory ownership.. `podman unshare chown 1001:1001 /host/dir` changes the ownership of the host directory to UID/GID 1001, matching the container's user. This is the best practice in rootless Podman environments, as it avoids running the container with elevated privileges while ensuring the container user can write to the bind-mounted directory.

Answer

Run the container with --privileged.

Answer

Add the user 1001 on the host to the root group.

Answer

Set setuid bit on the host directory.

Question 3

An administrator needs to combine two physical network interfaces into a single logical interface for redundancy. Which RHEL tool is recommended to configure this in RHEL 8/9?

Accepted Answer

nmcli. In RHEL 8/9, NetworkManager is the default networking service, and `nmcli` is its command-line tool. For bonding (combining two physical interfaces into a single logical interface for redundancy or increased throughput), the recommended approach is to use `nmcli` to create a bond connection, which uses the Linux kernel bonding driver. The `teamd` service was deprecated in RHEL 8 and removed in RHEL 9, making `nmcli` the correct and supported method.

Answer

teamd

Answer

ip link

Answer

brctl

Question 4

A system administrator needs to restore the default SELinux security context on all files under /var/www/html after a misconfiguration. Which command should be used?

Accepted Answer

restorecon -R /var/www/html. The `restorecon -R /var/www/html` command restores the default SELinux security contexts on all files under /var/www/html by reading the file contexts defined in the SELinux policy (typically from /etc/selinux/targeted/contexts/files/file_contexts). The `-R` flag ensures recursive operation, making it the correct tool to fix misconfigured contexts without manually specifying a type.

Answer

setfiles -R /var/www/html

Answer

fixfiles -R /var/www/html

Answer

chcon -R -t httpd_sys_content_t /var/www/html

Question 5

A system fails to boot with an error about a missing ext4 filesystem. From the rescue environment, which command should be run to attempt automatic repair of all filesystems?

Accepted Answer

fsck -A -y. `fsck -A -y` automatically checks all filesystems listed in `/etc/fstab` (the `-A` flag) and answers 'yes' to any repair prompts (the `-y` flag), making it the most appropriate command for automatic repair of all filesystems from a rescue environment. The error indicates a missing ext4 filesystem, and this command will attempt to repair any ext4 (or other) filesystem issues without manual intervention.

Answer

fsck /dev/sda1

Answer

debugfs -R 'repair'

Answer

e2fsck -p

Question 6

An administrator needs to measure the execution time of the command 'backup.sh'. Which command prefix should be used?

Accepted Answer

time. The 'time' command is the correct prefix to measure the execution time of a command in Linux. When placed before 'backup.sh', it runs the script and then outputs the real, user, and system time consumed, providing the precise measurement the administrator needs.

Answer

date

Answer

watch

Answer

timeout

Question 7

A system administrator needs to verify that the filesystem on /dev/sdb1 is ext4 before adding it to /etc/fstab. Which command provides this information?

Accepted Answer

lsblk -f /dev/sdb1. The `lsblk -f /dev/sdb1` command displays the filesystem type (FSTYPE) for the specified block device, such as ext4. This is the most direct and reliable way to verify the filesystem on a specific partition before adding it to /etc/fstab.

Answer

mount -a

Answer

df -Th /dev/sdb1

Answer

fdisk -l /dev/sdb1

Question 8

A storage administrator is asked to increase the size of an ext4 filesystem mounted at /data. The underlying logical volume /dev/mapper/vg01-lv01 is currently 10GB and the volume group has 5GB of free extents. After extending the logical volume by 2GB using lvextend -L +2G /dev/mapper/vg01-lv01, what command must be run to resize the filesystem?

Accepted Answer

resize2fs /dev/mapper/vg01-lv01. After extending the logical volume with `lvextend`, the filesystem does not automatically recognize the new space. For ext4 filesystems, the `resize2fs` command must be run to resize the filesystem to use the additional logical volume capacity. This command can be executed online (while the filesystem is mounted) and will expand the filesystem to fill the available space in the logical volume.

Answer

lvextend -r -L +2G /dev/mapper/vg01-lv01

Answer

xfs_growfs /data

Answer

fsck -f /dev/mapper/vg01-lv01

Question 9

Which THREE statements about container storage in podman are correct? (Choose THREE.)

Accepted Answer

The --storage-opt flag can be used to set options for the container's writable layer.. The `--storage-opt` flag in Podman allows you to pass options directly to the container's storage driver, such as setting the size of the container's writable layer (e.g., `--storage-opt size=10G`). This is a feature of the container storage stack (containers/storage) that Podman uses, enabling fine-grained control over the writable layer's behavior without affecting the image layers.

Answer

Podman volumes can only be managed by podman volume commands, not manually.

Answer

Rootless containers cannot use the overlay filesystem driver.

Question 10

The /data filesystem is at 99% capacity. The LVM setup shows that the volume group has 50GB free space, but the logical volume is only 100GB. What is the correct sequence of commands to increase the filesystem to use all available space in the volume group?

Accepted Answer

lvextend -L +50G /dev/mapper/vg01-data && xfs_growfs /data. The volume group has 50GB free space, so you need to extend the logical volume by +50GB (not to 50GB) using `lvextend -L +50G`, and then grow the XFS filesystem with `xfs_growfs /data` (the mount point, not the block device). The `+` sign indicates an addition to the current size, while omitting it would set an absolute size.

Answer

lvextend -L 50G /dev/mapper/vg01-data && xfs_growfs /dev/mapper/vg01-data

Answer

lvextend -L +50G /dev/mapper/vg01-data && resize2fs /dev/mapper/vg01-data

Answer

xfs_growfs /dev/mapper/vg01-data && lvextend -L +50G /dev/mapper/vg01-data

Question 11

Which two are required to create a logical volume? (Choose two.)

Accepted Answer

Physical volume. A physical volume (PV) is required because it is the underlying storage device (e.g., a disk or partition) that LVM uses as a building block. Without a PV, there is no raw storage to allocate to a volume group. The volume group (VG) is then created from one or more PVs, and logical volumes (LVs) are carved from the VG. Both are mandatory steps in the LVM workflow.

Answer

Mount point

Answer

Filesystem

Answer

Partition

Question 12

Which TWO commands can be used to check the UUID of a filesystem on /dev/sda1?

Accepted Answer

lsblk -o UUID /dev/sda1. The `blkid` command directly queries the UUID of a block device from the libblkid cache or by reading the filesystem superblock, and `lsblk -o UUID` filters the lsblk output to show only the UUID column for the specified device. Both commands reliably retrieve the UUID of /dev/sda1.

Answer

e2label /dev/sda1

Answer

findmnt /dev/sda1

Answer

file -s /dev/sda1

Question 13

An administrator wants to add the user 'jane' to the supplementary groups 'wheel' and 'docker' without removing her from other groups. Which command should be used?

Accepted Answer

usermod -aG wheel,docker jane. Both `usermod -aG wheel,docker jane` and `usermod -a -G wheel,docker jane` are valid commands to append the user to the specified supplementary groups without removing her from other groups. The `-a` (append) flag can be combined with `-G` as `-aG` or provided separately (`-a -G`); both forms work identically. Option D (`usermod -G`) without `-a` would overwrite all supplementary groups, which is incorrect. Option A uses `groupmems`, which is not the standard command for this task and has incorrect syntax.

Answer

groupmems -a jane -g wheel,docker

Answer

usermod -G wheel,docker jane

Question 14

A company requires that SSH access from the external network (10.0.1.0/24) only be allowed to port 2222, and all other incoming traffic on the firewall should be dropped. Which firewalld rule should be applied to the external zone?

Accepted Answer

firewall-cmd --zone=external --add-rich-rule='rule family="ipv4" source address="10.0.1.0/24" port port="2222" protocol="tcp" accept' --permanent. It uses a rich rule to explicitly allow incoming TCP traffic on port 2222 from the 10.0.1.0/24 source network, which matches the requirement. The default target for the external zone is 'drop', so only explicitly permitted traffic is allowed; this rule ensures SSH on port 2222 is accepted while all other incoming traffic is dropped.

Answer

firewall-cmd --zone=external --add-service=ssh --permanent

Answer

firewall-cmd --zone=external --add-port=2222/tcp --permanent

Answer

firewall-cmd --zone=external --add-rich-rule='rule family="ipv4" source address="10.0.1.0/24" service name="ssh" accept' --permanent

Question 15

A user executes the script shown in the exhibit with './export_script.sh' and then runs 'echo $MY_VAR' in the same terminal. The output is empty. Why does this happen?

Accepted Answer

The script runs in a sub-shell, so exported variables are not available to the parent shell. When a script is executed with './export_script.sh', it runs in a sub-shell (a child process). The 'export' command within the script makes the variable available to that sub-shell and its own child processes, but not to the parent shell that invoked the script. Therefore, after the script exits, the variable MY_VAR is not defined in the parent shell's environment, resulting in an empty output from 'echo $MY_VAR'.

Answer

The script lacks execute permissions

Answer

The 'export' command is incorrectly placed after the variable assignment

Answer

The variable name should be in uppercase for it to be inherited

Question 16

Refer to the exhibit. The script produces the error shown. What is the most likely cause?

Accepted Answer

The variable $var is empty or unset.. The error 'unary operator expected' occurs in bash when the `[ ]` test command encounters an empty or unset variable on the left side of a comparison operator. Since `$var` is empty, the expression `[ $var = 'value' ]` expands to `[ = 'value' ]`, which is syntactically invalid because the `=` operator expects a left operand. Option D correctly identifies this as the root cause.

Answer

The = operator should be == for string comparison.

Answer

The string 'value' contains spaces.

Answer

The script is missing a valid shebang.

Question 17

Which two commands can be used to create a new partition on a disk without erasing existing partitions? (Choose two.)

Accepted Answer

fdisk. The `fdisk` command is a disk partitioning tool that allows you to create, delete, and modify partitions on a disk without erasing existing partitions, as long as there is unallocated space. It operates on the MBR or GPT partition table and writes changes only when explicitly saved, preserving existing partition entries.

Answer

mkswap

Answer

dd

Answer

wipefs

Question 18

An administrator wants to enable user disk quotas on an XFS filesystem mounted at /home. Which steps are required?

Accepted Answer

Add 'uquota' to /etc/fstab, remount, then run xfs_quota -x -c 'limit -u bsoft=500m bhard=1g user1' /home. XFS uses its own quota management tools, not the traditional `quotacheck`/`edquota` tools used by ext4. The correct procedure is to add the `uquota` mount option to `/etc/fstab`, remount the filesystem, and then use `xfs_quota` to set limits. The `xfs_quota` command with the `-x` (expert) flag and `-c` (command) flag allows setting user quotas directly, and the path `/home` specifies the filesystem.

Answer

Add 'usrquota' to /etc/fstab, remount, then run quotacheck and edquota

Answer

Quotas are not supported on XFS filesystems

Answer

Use mount -o uquota /home, then setquota -u user1 500M 1G /home

Question 19

Refer to the exhibit. An administrator runs 'mount -o remount,ro /data' and then 'mount' shows /data as read-only. Later, the system is rebooted. What is the state of /data after reboot?

Accepted Answer

/data will be mounted read-write because fstab specifies defaults (rw).. The `mount -o remount,ro /data` command changes the mount state only for the current session; it does not modify the `/etc/fstab` entry. The `defaults` mount option in fstab implies `rw` (read-write). After a reboot, the system reads fstab and mounts `/data` according to its persistent configuration, which is read-write.

Answer

/data will be mounted read-only because the remount persists across reboots.

Answer

/data will not be mounted because the filesystem is marked as read-only.

Answer

/data will be mounted read-only because the kernel remembers the last mount state.

Question 20

An administrator wants to allow user 'alice' to SSH into the server using key-based authentication only. Which configuration change is required?

Accepted Answer

Add alice's public key to ~alice/.ssh/authorized_keys and set PubkeyAuthentication yes in sshd_config.. SSH key-based authentication requires the user's public key to be placed in the user's `~/.ssh/authorized_keys` file, and the SSH daemon must have `PubkeyAuthentication yes` set in `/etc/ssh/sshd_config` to allow public key authentication. This configuration ensures that only users with the corresponding private key can authenticate as 'alice'.

Answer

Add alice's private key to /etc/ssh/authorized_keys.

Answer

Set PasswordAuthentication no in /etc/ssh/sshd_config and restart sshd.

Answer

Set PermitRootLogin prohibit-password.