EX200 Practice Test 25 — 15 Questions

Question 1

An administrator is migrating user accounts to a new system. They want to preserve the user's primary group name and GID. Which commands should be used in sequence?

Accepted Answer

groupadd --gid && useradd -g . Option D is correct: first create the group with the specific GID using groupadd -g, then create the user with that group using useradd -g. Option A will fail if the group doesn't exist. Option B uses -g for groupadd and -g for useradd, but the order is wrong. Option C sets only UID, not group.

Answer

useradd -u -g

Answer

useradd -g <group> <user>

Answer

groupadd -g then useradd -g

Question 2

A helpdesk ticket states that user 'bob' cannot write to his own home directory. The directory /home/bob has permissions drwxr-xr-x and is owned by root:root. What command will fix this?

Accepted Answer

chown bob:bob /home/bob. Option A is correct: changing ownership to bob:bob gives him full control. Option B changes permissions but does not address ownership. Option C changes the home directory but not ownership. Option D uses ACLs, which is not the most straightforward fix.

Answer

setfacl -m u:bob:rwx /home/bob

Answer

usermod -d /home/bob bob

Answer

chmod 755 /home/bob

Question 3

Which TWO of the following are valid methods to set a user's password expiration date?

Accepted Answer

chage -E 2025-12-31 username. Options A and C are correct. chage -E sets the account expiration date, and usermod -e also sets the account expiration date. passwd -e forces password change at next login, does not set expiration. chage -M sets maximum password age, not expiration date. useradd -e only works at user creation.

Answer

chage -M 90 username

Answer

useradd -e 2025-12-31 username

Answer

passwd -e username

Question 4

An administrator needs to create a user account that will be used by an application service. The account should not have a valid shell or home directory. Which command correctly creates such an account?

Accepted Answer

useradd -r -s /sbin/nologin -M appuser. Option D is correct because it combines -r (system account), -s /sbin/nologin (invalid shell), and -M (no home directory). Option A lacks -M, Option B lacks -r, Option C uses /bin/false which is not a standard nologin shell.

Answer

useradd -r -M -s /bin/false appuser

Answer

useradd -r -s /sbin/nologin appuser

Answer

useradd -s /bin/false -M appuser

Question 5

A user jdoe, who is a member of the group staff, reports they cannot access the directory /shared. The administrator runs getfacl /shared and receives the output shown. Which of the following explains the issue?

Accepted Answer

An ACL entry denies all permissions for jdoe. Option B is correct: the ACL has an explicit deny entry for jdoe (user:jdoe:---) that overrides the group permissions. Option A is incorrect because group staff has rwx. Option C is incorrect because the owner has rwx. Option D is incorrect because the mask is rwx and does not limit group.

Answer

The group staff does not have execute permission

Answer

The mask entry restricts group permissions

Answer

The directory is read-only for the owner

Question 6

During an audit, it is discovered that a critical file /etc/shadow has permissions 644 and is owned by root:shadow. The administrator needs to secure it. What is the correct action?

Accepted Answer

chmod 600 /etc/shadow. Option A is correct: permissions 600 (owner read/write only) is the standard. Option B would also work but changes group to root unnecessarily. Option C (000) is too restrictive and may break PAM. Option D (640) allows shadow group read access, which is less secure.

Answer

chown root:root /etc/shadow && chmod 600

Answer

chmod 640 /etc/shadow

Answer

chmod 000 /etc/shadow

Question 7

An administrator wants to modify the default expiration settings for new user passwords. Which file should be modified?

Accepted Answer

/etc/login.defs. Option B is correct: /etc/login.defs contains the default password aging parameters like PASS_MAX_DAYS and PASS_WARN_AGE. Option A (/etc/shadow) stores per-user values, not defaults. Option C is for password quality. Option D is for PAM configuration.

Answer

/etc/shadow

Answer

/etc/pam.d/passwd

Answer

/etc/security/pwquality.conf

Question 8

Alice tries to run 'sudo less /var/log/messages' and gets 'Sorry, user alice is not allowed to execute /usr/bin/less /var/log/messages as root on this host.' Why?

Accepted Answer

The sudoers allows only specific commands with specific arguments. Option B is correct: the sudoers entry allows only specific commands with specific arguments. The entry '/usr/bin/less /var/log/secure' allows less only with that exact argument. Option A is about path matching but the path is fine. Option C is not the issue. Option D is incorrect because secure_path is not relevant.

Answer

The command path must exactly match, including arguments

Answer

The secure_path does not include /usr/bin

Answer

The /var/log/messages file does not exist

Question 9

A user 'carol' is in group 'staff'. The directory /shared has permissions drwxrwx--- and group staff. Carol can create files but cannot delete other users' files. What is missing?

Accepted Answer

Set the sticky bit with 'chmod +t /shared'. Option A is correct: setting the sticky bit (+t) on the directory prevents users from deleting files they do not own. Option B (setgid) affects group inheritance, not deletion. Option C is not about directory. Option D is already not world-writable.

Answer

Change carol's umask

Answer

Set the setgid bit with 'chmod g+s /shared'

Answer

Change directory permissions to 770

Question 10

Which TWO commands can be used to add a user to an existing supplementary group without removing them from other groups?

Accepted Answer

usermod -a -G group user. Options A and B are correct. usermod -a -G group user appends the group to existing supplementary groups. gpasswd -a user group adds the user to the group. Option C replaces all supplementary groups. Option D is not a valid command. Option E changes the primary group.

Answer

groupmod -a user group

Answer

usermod -g group user

Answer

usermod -G group user

Question 11

Which THREE conditions must be met for a user to effectively use the 'sudo' command to execute commands with root privileges?

Accepted Answer

User must be in the wheel group. Options A, C, and D are correct. The user must be listed in the sudoers file (A), the sudoers file must be edited with visudo to avoid syntax errors (C), and on RHEL, being in the wheel group is a common requirement (D). Option B (password) is not required if NOPASSWD is set. Option E is not a condition for the user.

Answer

The target command must be executable by root

Answer

User must have a password set

Question 12

A system administrator needs to ensure that the user 'jdoe' can read files in the shared directory /project/data which is owned by group 'project'. The user 'jdoe' is currently not a member of the 'project' group. Which TWO steps should the administrator take to add 'jdoe' to the 'project' group? (Choose two.)

Accepted Answer

gpasswd -a jdoe project. The correct options are A and B. usermod -aG project jdoe appends the user to the supplementary group without removing existing group memberships. gpasswd -a jdoe project also adds the user to the group. Option C (useradd -G) is incorrect because useradd is for creating new users, not modifying existing ones; using it would require the -M option and still is not appropriate. Option D (groupmod -A) is invalid syntax; groupmod does not have an -A option. Option E (vigr) is for manually editing group files, but it is not a direct command to add a user to a group; it would require manual file editing which is error-prone and not recommended.

Answer

groupmod -A jdoe project

Answer

vigr to add jdoe to project group

Answer

useradd -G project jdoe

Question 13

Refer to the exhibit. What is the most likely cause of the httpd service failure?

Accepted Answer

SELinux context on /var/www/html/index.html is incorrect.. The httpd service fails because SELinux enforces a security context on the web content files. If the context of /var/www/html/index.html is not set to httpd_sys_content_t, the Apache process (running under the httpd_t domain) is denied read access to the file, even if file permissions are correct. This causes the service to start but fail to serve the page, often logged as a 'Permission denied' error in /var/log/audit/audit.log.

Answer

The httpd service is disabled.

Answer

The Apache configuration has a syntax error.

Answer

The /var/www/html directory does not exist.

Question 14

Which THREE filesystem types are natively supported in RHEL 8/9 for local storage? (Choose exactly three.)

Accepted Answer

vfat. A is correct because vfat (FAT32) is natively supported in RHEL 8/9 for local storage, primarily for compatibility with UEFI boot partitions and removable media. The kernel includes the vfat module, and mkfs.vfat is available from the dosfstools package, allowing creation and mounting of FAT32 filesystems without additional software.

Answer

ntfs

Answer

btrfs

Question 15

An administrator wants to ensure that any new user accounts created on the system have a default primary group matching the username. What change is needed?

Accepted Answer

Set USERGROUPS_ENAB to yes in /etc/login.defs. Option C is correct because setting USERGROUPS_ENAB to yes in /etc/login.defs instructs the useradd command to automatically create a private group with the same name as the new user and assign it as the user's primary group. This is the default behavior in Red Hat Enterprise Linux and ensures that each new user has a matching primary group without manual intervention.

Answer

Set GROUP to same name in /etc/default/useradd

Answer

Set USERGROUPS_ENAB to no; then create user with -g

Answer

Set CREATE_HOME to yes in /etc/login.defs