EX200 Practice Test 25 — 15 Questions

Question 1

Which TWO commands can be used to add a user to an existing supplementary group without removing them from other groups?

Accepted Answer

usermod -a -G group user. The `usermod -a -G group user` command appends the user to the specified supplementary group without affecting their membership in other groups. The `-a` (append) flag must be used with `-G` to add the user to additional groups; without `-a`, the `-G` option replaces all supplementary group memberships with the listed groups.

Answer

groupmod -a user group

Answer

usermod -g group user

Answer

usermod -G group user

Question 2

A system administrator wants to run a container as a systemd service that restarts automatically after a system reboot. Which approach follows Red Hat best practices?

Accepted Answer

Use 'podman generate systemd --new --name mycontainer' and enable the generated service.. `podman generate systemd --new --name mycontainer` creates a systemd unit file that defines the container as a transient service with `Restart=always` and `WantedBy=multi-user.target`, ensuring the container starts automatically after a reboot. This approach aligns with Red Hat best practices for managing containers as systemd services, leveraging systemd's native dependency and restart capabilities rather than relying on legacy or non-standard methods.

Answer

Create a cron job that checks if the container is running and starts it if not.

Answer

Create a sysvinit script that calls podman commands.

Answer

Add 'podman run ...' to /etc/rc.local.

Question 3

Refer to the exhibit. An administrator tries to mount the partition /dev/sdc1 and gets a superblock error. What is the most likely cause?

Accepted Answer

The filesystem has not been created; mkfs.xfs was not run. The superblock error indicates that the kernel cannot read the filesystem metadata at the start of the partition. This most commonly occurs when no filesystem has been created on the partition — i.e., mkfs.xfs was never run on /dev/sdc1. Without a valid filesystem superblock, the mount command fails with a 'wrong fs type, bad option, bad superblock' message.

Answer

The filesystem is not recognized; need to install xfsprogs

Answer

The partition table is corrupted

Answer

The mount point /mnt/backup does not exist

Question 4

Based on the exhibit, what is the most likely cause of the failure?

Accepted Answer

Another process is already listening on port 22.. The failure message indicates that the SSH daemon cannot start because port 22 is already in use. Option B is correct because the error 'Address already in use' or 'bind to port 22 failed' directly points to another process occupying the port, preventing sshd from binding. This is a common port conflict scenario, not a configuration syntax or service enablement issue.

Answer

The SSH daemon is already running on another port.

Answer

The sshd configuration file has a syntax error.

Answer

The service is not enabled.

Question 5

Refer to the exhibit. An administrator needs to free up space in the /backup filesystem. Which of the following actions would be MOST effective?

Accepted Answer

Remove unnecessary files in /backup. The most direct way to free up space in the /backup filesystem is to remove unnecessary files stored there. This action immediately reclaims available space without altering the underlying logical volume or affecting other filesystems.

Answer

Increase the size of the logical volume

Answer

Delete old log files in /var/log

Answer

Use lvreduce to shrink the logical volume

Question 6

Refer to the exhibit. A web server is serving content from /var/www/html. SELinux is in enforcing mode. The web client reports 'Forbidden'. What is the most likely cause?

Accepted Answer

The directory /var/www/html may have incorrect context or permissions preventing Apache from listing files.. The most likely cause of a 'Forbidden' error when SELinux is enforcing is that the directory or file lacks the correct SELinux context (e.g., httpd_sys_content_t) or the permissions do not allow the Apache user (apache) to read or traverse the directory. Even if file permissions are 644, SELinux can block access if the context is wrong, such as being set to default_t or user_home_t. The error indicates Apache cannot access the content, which is typically resolved by restoring the correct context with restorecon or setting it with chcon.

Answer

The file is owned by root, and Apache runs as apache user, so it cannot read.

Answer

The file permissions are 644, which restricts access.

Answer

The file has an incorrect SELinux context; it should be httpd_user_content_t.

Question 7

Which TWO commands can be used to list block devices and their attributes? (Choose exactly two.)

Accepted Answer

lsblk. B (lsblk) is correct because it lists all block devices (e.g., /dev/sda, /dev/nvme0n1) and displays their attributes such as size, type, mount point, and model in a tree-like format by reading the sysfs filesystem. E (blkid) is correct because it shows block device attributes like UUID, filesystem type, and LABEL by querying the libblkid library, which reads metadata directly from the device.

Answer

fdisk -l

Answer

du

Answer

df

Question 8

A company runs a web application on a Red Hat Enterprise Linux 8 server. The application is served by Apache HTTPD, and it requires read/write access to a custom directory /var/www/app_data. The SELinux context for the directory is set to httpd_sys_rw_content_t. Apache runs in enforcing mode. Recently, a new feature was added that requires Apache to connect to a database on the same server via a Unix socket. The database serves on /var/run/mysqld/mysqld.sock. After the feature deployment, the web application fails to connect to the database. The error logs show permission denied on the socket file. The socket file has permissions 660 and is owned by mysql:mysql. SELinux audit logs show AVC denials for httpd_t trying to connect to mysqld_var_run_t. Which of the following solutions should the administrator implement to allow Apache to read the database socket while maintaining security?

Accepted Answer

Enable the SELinux boolean httpd_can_connect_db using setsebool -P httpd_can_connect_db on.. The correct solution is to enable the SELinux boolean `httpd_can_connect_db` using `setsebull -P httpd_can_connect_db on`. This boolean specifically allows the `httpd_t` domain to connect to MySQL/MariaDB databases via Unix sockets, which is exactly the scenario described: Apache needs to connect to a local database socket with context `mysqld_var_run_t`. The AVC denial confirms that the default policy blocks this socket connection, and enabling this boolean grants the necessary permission without weakening other security controls.

Answer

Change the SELinux context of the socket file to httpd_sys_rw_content_t using chcon.

Answer

Enable the SELinux boolean httpd_can_network_connect_db using setsebool -P httpd_can_network_connect_db on.

Answer

Use semanage to add a context mapping for the socket file to httpd_var_run_t and set the httpd to permissive mode.

Question 9

A system administrator needs to view the last 10 lines of the log file /var/log/messages in real time as new lines are added. Which command should be used?

Accepted Answer

tail -f /var/log/messages. The `tail -f /var/log/messages` command displays the last 10 lines of the file by default and then continues to output new lines as they are appended, providing real-time monitoring. The `-f` (follow) option keeps the file open and polls for changes, making it the correct tool for live log watching.

Answer

less /var/log/messages

Answer

head -n 10 /var/log/messages

Answer

cat /var/log/messages

Question 10

A security policy requires that all files in /home have the default SELinux context for user home directories. Which command recursively restores the default context?

Accepted Answer

restorecon -Rv /home. `restorecon -Rv /home` recursively resets the SELinux context of all files under `/home` to the default type defined in the SELinux policy for user home directories (typically `user_home_t`). The `-R` flag enables recursion, and `-v` provides verbose output, ensuring compliance with the security policy requirement.

Answer

semanage fcontext -a -t user_home_t /home

Answer

chcon -Rv default_t /home

Answer

setfiles -Rv /home

Question 11

Which command displays the UUID of a filesystem on /dev/sda1?

Accepted Answer

blkid /dev/sda1. The `blkid` command is specifically designed to locate and print block device attributes, including the UUID (Universally Unique Identifier) of a filesystem. Running `blkid /dev/sda1` queries the device's superblock and outputs the UUID, filesystem type, and other metadata, making it the correct tool for this task.

Answer

df -h

Answer

mount

Answer

fdisk -l /dev/sda

Question 12

An administrator extends a logical volume by 5GB. The filesystem is XFS. Which command must be run to make the additional space available?

Accepted Answer

xfs_growfs /mount. After extending a logical volume with lvresize, the XFS filesystem does not automatically recognize the new space. The xfs_growfs command must be run on the mounted filesystem to expand it to fill the enlarged logical volume. This command can target the mount point directly and works online without unmounting.

Answer

mount -o remount /mount

Answer

resize2fs /dev/vg/lv_root

Answer

lvresize -L +5G /dev/vg/lv_root

Question 13

Which TWO commands can be used to view the contents of a compressed file named 'archive.tar.gz' without extracting it?

Accepted Answer

tar -tzf archive.tar.gz. `tar -tzf archive.tar.gz` lists the contents of a gzip-compressed tar archive without extracting it. The `-t` option tells tar to list the table of contents, `-z` filters the archive through gzip decompression, and `-f` specifies the archive file. This command reads the archive metadata directly without writing any files to disk.

Answer

gzip -d archive.tar.gz

Answer

gunzip -c archive.tar.gz

Answer

tar -xf archive.tar.gz

Question 14

A company has a RHEL 9 server that hosts a critical application. The server has two network interfaces: enp1s0 (192.168.1.100/24) and enp2s0 (10.0.0.100/24). The default gateway is 192.168.1.1. The application listens on a TCP port 8080 and should be accessible from both networks. Recently, the administrator noticed that clients on the 10.0.0.0/24 network can ping the server's 10.0.0.100 address but cannot connect to port 8080. Clients on 192.168.1.0/24 can connect fine. The firewall is configured with the default zone (public) and the service 'http' is allowed, but port 8080 is not specifically allowed. The administrator checks 'firewall-cmd --list-all' and sees that only services 'ssh' and 'http' are listed. The application is running and listening on 0.0.0.0:8080. What is the most likely cause and the correct course of action?

Accepted Answer

Add a firewall rule to open TCP port 8080 in the public zone using 'firewall-cmd --add-port=8080/tcp --permanent' and reload.. The firewall is blocking incoming connections to port 8080 because only services 'ssh' (port 22) and 'http' (port 80) are allowed in the public zone. Since the application listens on 0.0.0.0:8080, it is reachable from both networks at the IP level, but the firewall drops packets destined for port 8080. Adding a permanent rule to open TCP port 8080 and reloading the firewall configuration resolves the issue.

Answer

Disable SELinux to allow the application to accept connections.

Answer

Change the application to listen only on the 10.0.0.100 interface.

Answer

Add a static route for the 10.0.0.0/24 network via the 10.0.0.1 gateway.

Question 15

Which three statements about firewalld zones are correct? (Choose three.)

Accepted Answer

The default zone can be changed using firewall-cmd.. The default zone in firewalld can be changed using the 'firewall-cmd --set-default-zone=<zone>' command. This command updates the runtime and permanent configuration, ensuring that all new network interfaces are automatically assigned to the specified zone unless explicitly overridden.

Answer

A network interface can be assigned to multiple zones simultaneously.

Answer

Zones can have a default target of only 'DROP' or 'ACCEPT'.