EX200 Practice Exam 4 — 20 Questions

Question 1

A system administrator notices that a RHEL 9 server's /var/log/messages is filling up the /var partition. The administrator wants to ensure log rotation runs daily and keeps 4 weeks of logs. Which configuration file should be modified?

Accepted Answer

/etc/logrotate.d/syslog. Option B is correct because /etc/logrotate.d/syslog is the configuration file that controls log rotation for system log files such as /var/log/messages. By modifying this file, the administrator can set the rotation frequency to daily and specify the number of weeks (e.g., rotate 28 for 4 weeks) to retain logs, directly addressing the requirement.

Answer

/etc/systemd/journald.conf

Answer

/etc/rsyslog.conf

Answer

/etc/cron.daily/logrotate

Question 2

A technician needs to configure a static IPv4 address on a RHEL 9 network interface 'enp1s0' using NetworkManager. Which command should be used to set the IP address?

Accepted Answer

nmcli connection modify enp1s0 ipv4.addresses 192.168.1.100/24. Option A is correct because `nmcli connection modify enp1s0 ipv4.addresses 192.168.1.100/24` is the proper NetworkManager command to set a static IPv4 address on a RHEL 9 interface. This command modifies the connection profile for 'enp1s0' by setting the `ipv4.addresses` property to the specified address and prefix length, which is the standard method for persistent static IP configuration via NetworkManager.

Answer

nmtui edit enp1s0 --ipv4 192.168.1.100/24

Answer

ip addr add 192.168.1.100/24 dev enp1s0

Answer

ifconfig enp1s0 192.168.1.100 netmask 255.255.255.0

Question 3

A system administrator is tasked with configuring a RHEL 9 system to automatically mount an NFS share from 192.168.1.10:/export/data on /mnt/data at boot. Which entry in /etc/fstab is correct?

Accepted Answer

192.168.1.10:/export/data /mnt/data nfs4 defaults 0 0. Option C is correct because the /etc/fstab entry for an NFS mount requires the remote server and export path in the format server:/export, followed by the local mount point, the filesystem type (nfs4 for NFSv4), mount options, dump flag, and fsck order. This matches the standard NFS fstab syntax for automatic mounting at boot.

Answer

192.168.1.10 /export/data /mnt/data nfs4 defaults 0 0

Answer

/mnt/data 192.168.1.10:/export/data nfs4 defaults 0 0

Answer

192.168.1.10:/export/data /mnt/data nfs defaults 0 0

Question 4

A RHEL 9 system has a second disk /dev/sdb that needs to be partitioned with a single partition using all space, formatted with XFS, and mounted persistently at /data. The administrator uses fdisk to create the partition /dev/sdb1. Which filesystem creation command should be used?

Accepted Answer

mkfs.xfs /dev/sdb1. The correct command is mkfs.xfs /dev/sdb1 because the question specifies that the partition must be formatted with XFS. The mkfs.xfs command is the dedicated tool for creating an XFS filesystem on a block device. It directly invokes the mkfs.xfs utility, which writes the XFS superblock and metadata structures to the partition.

Answer

mke2fs /dev/sdb1

Answer

mkfs -t ext4 /dev/sdb1

Answer

mkfs.ext4 /dev/sdb1

Question 5

Which THREE are valid methods to configure network bonding in RHEL 9? (Choose exactly three.)

Accepted Answer

Using a configuration file in /etc/NetworkManager/system-connections/.. Option A is correct because in RHEL 9, NetworkManager stores connection profiles in `/etc/NetworkManager/system-connections/`. You can manually create a bond configuration file in this directory with the proper key-value pairs (e.g., `type=bond`, `bond.options=mode=1,miimon=100`), and NetworkManager will read it on restart or reload. This is a valid method for configuring network bonding.

Answer

Using the teamd service.

Answer

Editing /etc/sysconfig/network-scripts/ifcfg-bond0 directly.

Question 6

A system administrator wants to allow user 'jdoe' to execute any command as root via sudo without being prompted for a password, but only from the host 'client1.example.com'. Which sudoers rule achieves this?

Accepted Answer

jdoe client1.example.com=(root) NOPASSWD: ALL. Option A is correct because the sudoers rule 'jdoe client1.example.com=(root) NOPASSWD: ALL' specifies the user 'jdoe', the host 'client1.example.com' as the source host from which the command is run, the target user '(root)', the NOPASSWD tag to skip password authentication, and the command 'ALL' to allow any command. This matches the requirement exactly: passwordless root access restricted to a specific client host.

Answer

jdoe client1.example.com=(root) ALL

Answer

jdoe ALL=(root) NOPASSWD: ALL

Answer

jdoe ALL=(root) ALL

Question 7

An administrator wants to add the user 'jane' to the supplementary groups 'wheel' and 'docker' without removing her from other groups. Which command should be used?

Accepted Answer

usermod -aG wheel,docker jane. Option B is correct because the `usermod -aG` command appends the user 'jane' to the supplementary groups 'wheel' and 'docker' without removing her from any existing supplementary groups. The `-a` (append) flag must be used with `-G` to avoid overwriting the current group membership list, which is the default behavior of `-G` alone.

Answer

groupmems -a jane -g wheel,docker

Answer

usermod -a -G wheel,docker jane

Answer

usermod -G wheel,docker jane

Question 8

Which TWO commands can change the primary group of an existing user?

Accepted Answer

usermod -aG. The `usermod -g` command (not `-aG`, which adds supplementary groups) changes the primary group of an existing user. The `gpasswd -a` command adds a user to a group, but it does not change the primary group; it only affects supplementary group membership. Therefore, neither option A nor B is correct for changing the primary group. The correct commands are `usermod -g` (to set the primary group) and `usermod -G` (to set supplementary groups, but not the primary).

Answer

vigr

Answer

groupmems -a

Answer

useradd -G

Question 9

Refer to the exhibit. A web server (httpd) is unable to serve files from a user's home directory. What is the most appropriate single command to resolve the issue?

Accepted Answer

semanage fcontext -a -t httpd_sys_content_t '/home/user/www(/.*)?' && restorecon -Rv /home/user/www. Option C is correct because it uses `semanage fcontext` to set the default SELinux file context for the `/home/user/www` directory tree to `httpd_sys_content_t`, then applies it with `restorecon`. This is the proper way to persistently label custom web content directories so that httpd can serve them, as SELinux policy by default blocks httpd from reading user home directories.

Answer

chcon -u system_u /home/user/www/index.html

Answer

setsebool -P httpd_enable_homedirs on

Answer

chcon -r object_r /home/user/www/index.html

Question 10

An administrator runs 'getenforce' and sees 'Enforcing'. They then run 'setenforce 0' but SELinux still denies access to a custom application. What is the most likely reason?

Accepted Answer

The issue is due to file permissions or ACLs, not SELinux.. Option C is correct because `setenforce 0` switches SELinux to permissive mode, which logs but does not enforce denials. If access is still denied after this command, the issue is not caused by SELinux enforcement but by traditional Linux file permissions (DAC) or ACLs. The administrator should check `ls -l` and `getfacl` to verify the file's ownership and permissions.

Answer

SELinux is in enforcing mode and the policy is misconfigured.

Answer

The application's SELinux context is incorrect and needs relabeling.

Answer

The change requires a reboot to take effect.

Question 11

A junior admin needs to ensure that the 'apache' user (UID 48) cannot log in via SSH or console. Which command achieves this?

Accepted Answer

usermod -s /sbin/nologin apache. Option A is correct because setting the user's login shell to `/sbin/nologin` prevents the user from obtaining an interactive shell via SSH or console login. When the user attempts to log in, the system executes `/sbin/nologin`, which prints a polite message and exits immediately, effectively denying shell access while leaving other services (e.g., Apache) functional.

Answer

passwd -l apache

Answer

chage -l apache

Answer

usermod -e 1 apache

Question 12

An administrator needs to ensure that a container always runs with a specific SELinux context for security reasons. The container uses a volume mount from the host. Which command should be used to start the container?

Accepted Answer

podman run --security-opt label=type:container_t -v /host/data:/data myimage. Option D is correct because `--security-opt label=type:container_t` explicitly sets the SELinux type for the container process to `container_t`, ensuring the container runs with the required SELinux context. This is the proper way to assign a specific SELinux type when using `podman run`, especially when volume mounts are involved, as it avoids permission conflicts with the host's SELinux policy.

Answer

podman run --label selinux_context=container_t -v /host/data:/data myimage

Answer

podman run --privileged -v /host/data:/data myimage

Answer

podman run --selinux-context container_t -v /host/data:/data myimage

Question 13

An administrator needs to compress a directory 'data' into an archive named backup.tar.gz using gzip compression. Which command should they use?

Accepted Answer

tar -czf backup.tar.gz data. Option D is correct because the `tar -czf` command creates a compressed archive: `-c` creates a new archive, `-z` filters the archive through gzip compression, `-f` specifies the archive filename `backup.tar.gz`, and `data` is the directory to archive. This produces a tarball compressed with gzip, matching the requirement exactly.

Answer

gzip -r data > backup.tar.gz

Answer

tar -cjf backup.tar.gz data

Answer

tar -xzf backup.tar.gz data

Question 14

A user reports that a script in their home directory fails to execute. The script has permissions -rw-r--r-- and is owned by the user. Which command will allow execution for the owner?

Accepted Answer

chmod u+x script.sh. The script currently has permissions `-rw-r--r--`, meaning the owner has read and write but not execute. To allow the owner to execute it, you need to add the execute permission for the owner only. `chmod u+x script.sh` adds the execute bit for the user (owner) without affecting group or others, which is the precise requirement.

Answer

chmod u+r script.sh

Answer

chmod a+x script.sh

Answer

chmod u-x script.sh

Question 15

A system administrator needs to configure a firewall using firewalld to allow incoming HTTPS traffic and deny incoming SSH traffic from a specific source IP 192.168.1.100. Which two commands should be run? (Choose two.)

Accepted Answer

firewall-cmd --add-service=https --permanent. Option C is correct because `firewall-cmd --add-service=https --permanent` adds the HTTPS service (TCP port 443) to the permanent firewall configuration, which is required to allow incoming HTTPS traffic persistently across reboots. The `--permanent` flag ensures the rule survives a reload or restart, and the `--add-service` option uses predefined service definitions from firewalld to simplify rule creation.

Answer

firewall-cmd --runtime-to-permanent

Answer

firewall-cmd --add-rich-rule='rule family=ipv4 source address=192.168.1.100 service name=ssh reject' --permanent

Answer

firewall-cmd --add-service=http --permanent

Question 16

Which TWO statements about Logical Volume Manager (LVM) metadata are correct?

Accepted Answer

The 'pvck' command can be used to check physical volume metadata.. Option A is correct because the 'pvck' command is specifically designed to check the metadata of physical volumes in LVM. It verifies the consistency and integrity of the PV metadata, including the volume group descriptor area (VGDA), without making changes. This is a diagnostic tool used before attempting repairs.

Answer

The 'pvs' command can repair corrupted metadata.

Answer

The 'fsck' tool is used to verify LVM metadata.

Answer

LVM metadata is stored in /etc/lvm directory.

Question 17

An administrator wants to add the two 2G disks (sdc and sdd) as physical volumes, extend the 'data' logical volume in volume group 'vg' by 2G, and grow the filesystem. Which sequence of commands should be used?

Accepted Answer

pvcreate /dev/sdc /dev/sdd; vgextend vg /dev/sdc /dev/sdd; lvextend -L +2G /dev/vg/lv_data; xfs_growfs /data. Option D is correct because it follows the correct sequence: create physical volumes on both disks, extend the volume group with both disks in a single command, extend the logical volume by exactly 2G using the `+` sign, and then grow the XFS filesystem using `xfs_growfs` with the mount point `/data`. The `+` in `lvextend -L +2G` is critical to add 2G rather than resize to 2G total, and `xfs_growfs` requires the mount point (or a block device) for XFS filesystems.

Answer

pvcreate /dev/sdc /dev/sdd; vgextend vg /dev/sdc /dev/sdd; lvresize -L 2G /dev/vg/lv_data; xfs_growfs /data

Answer

pvcreate /dev/sdc /dev/sdd; vgextend vg /dev/sdc /dev/sdd; lvextend -L +2G /dev/vg/lv_data; resize2fs /dev/vg/lv_data

Answer

pvcreate /dev/sdc /dev/sdd; vgextend vg /dev/sdc; vgextend vg /dev/sdd; lvextend -L +2G /dev/vg/lv_data; xfs_growfs /dev/vg/lv_data

Question 18

Which TWO commands can be used to add the user 'alice' to the supplementary group 'developers'?

Accepted Answer

gpasswd -a alice developers. Option A is correct because `gpasswd -a alice developers` adds the user 'alice' to the supplementary group 'developers' by appending her to the group's member list in /etc/group. Option C is correct because `usermod -aG developers alice` appends 'alice' to the supplementary group 'developers' without removing her from other supplementary groups, which is the intended behavior for adding a user to an additional group.

Answer

useradd -g developers alice

Answer

groupmod -a alice developers

Answer

usermod -g developers alice

Question 19

An administrator runs 'df -h' and sees the output above. The /data partition is nearly full. Which command will help identify the largest files in /data?

Accepted Answer

du -sh /data/*. Option D is correct because 'du -sh /data/*' calculates the total disk usage of each top-level item (files and directories) within /data, showing human-readable sizes. The asterisk expands to all immediate children, allowing the administrator to identify which specific files or directories consume the most space, which is exactly what is needed when /data is nearly full.

Answer

du -sch /data/*

Answer

du -sh /data

Answer

du -h --max-depth=1 /data

Question 20

A system administrator needs to run a container that remains running in the background and executes a web server. Which podman command will correctly run the container detached and map host port 8080 to container port 80?

Accepted Answer

podman run -d -p 8080:80 nginx. Option A is correct because `podman run -d` runs the container in detached mode (background), and `-p 8080:80` maps host port 8080 to container port 80, which is the standard port for the nginx web server. This allows external traffic on host port 8080 to be forwarded to the nginx service inside the container.

Answer

podman run -d -p 80:8080 nginx

Answer

podman run -d --expose 80 nginx

Answer

podman run -d -P 8080:80 nginx