EX200 Practice Test 2 — 25 Questions

Question 1

A Red Hat Enterprise Linux server has been configured with a custom repository for offline updates. The administrator runs 'yum repolist' and the custom repository is not listed. Which command should be used to verify that the repository configuration file is valid and located in the correct directory?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

cat /etc/yum.repos.d/custom.repo. The most direct way to verify that a repository configuration file is valid and located in the correct directory is to check its presence and syntax using 'cat /etc/yum.repos.d/custom.repo'. The repository configuration files must reside in /etc/yum.repos.d/ and have a .repo extension; if the file is missing or malformed, 'yum repolist' will not list the repository. This command simply reads the file, allowing the administrator to confirm its location and inspect its contents for errors.

Answer

yum repoinfo

Answer

yum check-repo

Answer

yum-config-manager --dump

Question 2

Order the steps to configure firewall rules to allow HTTP and HTTPS traffic using firewalld.

Accepted Answer

1. Add HTTP service: firewall-cmd --permanent --add-service=http
2. Add HTTPS service: firewall-cmd --permanent --add-service=https
3. Reload firewall: firewall-cmd --reload
4. Verify: firewall-cmd --list-services. Firewalld rules are added with --permanent flag and then reloaded to take effect.

Answer

1. Reload firewall: firewall-cmd --reload
2. Add HTTP service: firewall-cmd --permanent --add-service=http
3. Add HTTPS service: firewall-cmd --permanent --add-service=https
4. Verify: firewall-cmd --list-services

Answer

1. Add HTTP service: firewall-cmd --add-service=http (without --permanent)
2. Add HTTPS service: firewall-cmd --add-service=https (without --permanent)
3. Reload firewall: firewall-cmd --reload
4. Verify: firewall-cmd --list-services

Answer

1. Add HTTP service: firewall-cmd --permanent --add-service=http
2. Reload firewall: firewall-cmd --reload
3. Add HTTPS service: firewall-cmd --permanent --add-service=https
4. Verify: firewall-cmd --list-services

Question 3

The administrator wants to mount a new filesystem on /dev/sdb1 with the label 'backup' and mount it at /mnt/backup. Which commands achieve this?

Accepted Answer

mkfs.xfs /dev/sdb1 && xfs_admin -L backup /dev/sdb1 && mount -L backup /mnt/backup. Both options B and C correctly create an XFS filesystem with the label 'backup' on /dev/sdb1 and mount it to /mnt/backup. Option B uses mkfs.xfs, then sets the label with xfs_admin, then mounts by label (mount -L works without fstab). Option C creates the filesystem with the label in one step and mounts by device path. Options A and D are incorrect: A includes an unnecessary parted command and uses ext4? Actually A creates an XFS partition but then mounts? Wait A: parted ... mkpart primary xfs ... && mkfs.xfs -L backup /dev/sdb1. It doesn't mount, so incomplete. D uses ext4, not XFS. Thus B and C are both valid.

Answer

parted /dev/sdb mkpart primary xfs 0% 100% && mkfs.xfs -L backup /dev/sdb1

Answer

mkfs.ext4 -L backup /dev/sdb1 && echo '/dev/sdb1 /mnt/backup ext4 defaults 0 0' >> /etc/fstab

Question 4

Refer to the exhibit. A container named 'db' is running on the host. An administrator runs `podman inspect db` and sees the above output snippet. What can be concluded about the container's network configuration?

Accepted Answer

The container's port 3306 is bound to all host interfaces.. The output snippet from `podman inspect db` shows `"Ports": {"3306/tcp": [{"HostIp": "0.0.0.0", "HostPort": "3306"}]}`. This indicates that the container's port 3306 is mapped to port 3306 on all host interfaces (0.0.0.0), which is the default bridge networking port binding behavior. Therefore, option C is correct.

Answer

The container is using host networking mode.

Answer

The container cannot be reached from other containers.

Answer

The container is using bridge networking with a static IP.

Question 5

An administrator needs to ensure that a container always runs with a specific SELinux context for security reasons. The container uses a volume mount from the host. Which command should be used to start the container?

Accepted Answer

podman run --security-opt label=type:container_t -v /host/data:/data myimage. `--security-opt label=type:container_t` explicitly sets the SELinux type for the container process to `container_t`, ensuring the container runs with the required SELinux context. This is the proper way to assign a specific SELinux type when using `podman run`, especially when volume mounts are involved, as it avoids permission conflicts with the host's SELinux policy.

Answer

podman run --label selinux_context=container_t -v /host/data:/data myimage

Answer

podman run --privileged -v /host/data:/data myimage

Answer

podman run --selinux-context container_t -v /host/data:/data myimage

Question 6

A database server experiences high disk I/O wait times. The administrator runs 'iostat -x 1' and sees that the avgqu-sz for /dev/sda is 25 and await is 200 ms. The disk is a single 7200 RPM SATA drive. Which action is most likely to improve performance?

Accepted Answer

Replace the drive with an SSD or add additional drives in RAID 10. The high avgqu-sz (25) and await (200 ms) indicate the single 7200 RPM SATA drive is saturated, as its maximum IOPS is typically around 75-100 random I/O operations per second. Replacing it with an SSD (which can handle thousands of IOPS) or adding drives in RAID 10 (which increases IOPS through parallelism) directly addresses the hardware bottleneck. No software tuning can overcome the physical limitations of a single spinning disk under heavy I/O load.

Answer

Increase the read-ahead buffer using blockdev --setra

Answer

Change the I/O scheduler from CFQ to noop

Answer

Run 'fsck -f' on the filesystem to check for fragmentation

Question 7

A system administrator has created a new group named 'ops'. The administrator wants to add the existing user 'alice' to this group as a supplementary group without affecting her current group memberships. Which command should be used?

Accepted Answer

usermod -aG ops alice. The `-a` (append) flag combined with `-G` (supplementary groups) in `usermod` adds the user 'alice' to the 'ops' group without removing her from any existing supplementary groups. Without `-a`, the `-G` flag alone would replace the user's current supplementary group list with only the specified groups, which would remove her from any other groups she already belongs to.

Answer

usermod -G ops alice

Answer

groupadd ops alice

Answer

usermod -g ops alice

Question 8

Refer to the exhibit. An administrator wants to mount /dev/sdc1 on /mnt/storage. What must be done first?

Accepted Answer

Create a partition on /dev/sdc. The exhibit shows that /dev/sdc has no partition table (it is a raw disk). Before you can mount a filesystem on /dev/sdc1, you must first create a partition on /dev/sdc using a tool like fdisk or parted. Without a partition, the block device /dev/sdc1 does not exist, so any mount attempt would fail with a 'no such device' error.

Answer

Mount /dev/sdc directly

Answer

Add an entry to /etc/fstab

Answer

Run mkfs.xfs /dev/sdc1

Question 9

An administrator wants to mount an existing ext4 filesystem from /dev/sdb1 to /mnt/data at boot time. What entry should be added to /etc/fstab?

Accepted Answer

/dev/sdb1  /mnt/data  ext4  defaults  0  0. It specifies the correct device (/dev/sdb1), the correct mount point (/mnt/data), the correct filesystem type (ext4), and the correct mount options (defaults) for an ext4 filesystem to be mounted at boot. The /etc/fstab entry must include all six fields in order: device, mount point, filesystem type, options, dump, and pass.

Answer

/dev/sdb1  /mnt/data  xfs  defaults  0  0

Answer

LABEL=data  ext4  defaults  0  0

Answer

/dev/sdb1  /data  ext4  defaults  0  0

Question 10

A system administrator is configuring a new RHEL 9 server with two 500GB SSDs. The requirement: create a 200GB XFS filesystem for /srv/data that is resilient to disk failure. The admin decides to create a RAID 1 (mirror) using mdadm with partitions on each disk: /dev/sda1 and /dev/sdb1, each 200GB. He creates the partitions with fdisk, then runs: mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sda1 /dev/sdb1. The array is created and synced. He then creates a physical volume, volume group, and logical volume on top of /dev/md0, formats with XFS, and mounts. Later, a disk fails. After replacing the failed disk, he recreates the partition with identical size and runs: mdadm /dev/md0 --add /dev/sdb1. The command fails with 'Device /dev/sdb1 is busy'. What is the most likely cause?

Accepted Answer

The kernel still sees the old partition table; need to run partprobe to reread the partition table.. After replacing a failed disk and recreating the partition, the kernel's in-memory partition table still reflects the old state. The `mdadm --add` command fails with 'Device busy' because the kernel sees the old partition layout and may still hold references to the old partition. Running `partprobe` (or `partx -a`) forces the kernel to reread the partition table from the disk, clearing the stale state and allowing the new partition to be added to the RAID array.

Answer

The replacement disk was not initialized with an mdadm superblock before adding.

Answer

The /dev/md0 array is still in a clean state and does not need the disk yet.

Answer

The /dev/sdb1 partition is already part of another md array.

Question 11

A server uses firewalld with the default zone set to 'drop'. SSH is allowed only for the 192.168.1.0/24 subnet via a rich rule in the 'internal' zone. After a reboot, SSH connections from that subnet are refused. What is the most likely cause?

Accepted Answer

The network interface is not assigned to the 'internal' zone.. After a reboot, firewalld applies the default zone to all interfaces not explicitly assigned to another zone. Since the rich rule allowing SSH from 192.168.1.0/24 is defined in the 'internal' zone, the network interface must be assigned to that zone for the rule to take effect. If the interface is not assigned (e.g., it remains in the default 'drop' zone), all incoming traffic, including SSH from the allowed subnet, is dropped by default.

Answer

The subnet 192.168.1.0/24 is not a valid source for rich rules.

Answer

The rich rule was not made permanent.

Answer

The SSH service is not enabled in the default zone.

Question 12

A team wants to run a container as a non-root user inside the container for security. Which instruction should be included in the Containerfile?

Accepted Answer

USER. The USER instruction in a Containerfile (Dockerfile) sets the user name or UID to use when running the container and for any subsequent RUN, CMD, or ENTRYPOINT instructions. By default, containers run as root (UID 0), which poses a security risk. Using USER to switch to a non-root user (e.g., USER 1001) ensures the container process runs with reduced privileges, aligning with the principle of least privilege.

Answer

PODMAN_USER

Answer

ENV USER

Answer

RUN useradd

Question 13

A Red Hat Enterprise Linux 9 server has an LVM volume group 'vg01' that contains two physical volumes: /dev/sda2 and /dev/sdb1. After a reboot, the system fails to activate the volume group. The administrator runs 'pvdisplay' and sees one physical volume as 'unknown device'. What is the most likely cause?

Accepted Answer

The LVM filter in /etc/lvm/lvm.conf is excluding /dev/sdb1. The LVM filter in /etc/lvm/lvm.conf controls which devices LVM scans during activation. If the filter excludes /dev/sdb1, LVM will not recognize that physical volume, causing the volume group to fail activation. The 'unknown device' status indicates LVM cannot access the device metadata, not that the device is missing or corrupted.

Answer

The physical volume is corrupted and needs to be restored from backup

Answer

The filesystem on the logical volume has become corrupted, preventing LVM metadata access

Answer

The UUID of the physical volume has changed due to a disk replacement

Question 14

A container needs to share the host's network namespace for performance monitoring. Which podman run option achieves this?

Accepted Answer

--network host. `--network host` makes the container use the host's network stack directly, bypassing any network namespace isolation. This allows performance monitoring tools inside the container to see the host's actual network interfaces, IP addresses, and traffic without NAT or port mapping overhead.

Answer

--network slirp4netns

Answer

--network bridge

Answer

--network none

Question 15

Refer to the exhibit. A system administrator wants to add an additional mount option 'noexec' to the /boot filesystem permanently. Which step is necessary before remounting?

Accepted Answer

Edit /etc/fstab to add 'noexec' to the /boot entry, then run mount -o remount /boot. To make the 'noexec' mount option persistent for /boot, you must first edit /etc/fstab to add the option to the /boot entry. Then, running 'mount -o remount /boot' will remount the filesystem with the new options from fstab without needing to unmount it. This ensures the change survives reboots and is applied correctly.

Answer

Run mount -o remount,noexec /boot without editing /etc/fstab

Answer

Run umount /boot, edit /etc/fstab to add 'noexec', then mount /boot

Answer

Edit /etc/fstab to add 'noexec' to the /boot entry, then run mount -a

Question 16

The root filesystem is at 90% capacity. Which command increases available space without unmounting?

Accepted Answer

lvextend -L +5G /dev/mapper/vg_root-lv_root && xfs_growfs /. It first extends the logical volume with `lvextend -L +5G`, then grows the XFS filesystem online with `xfs_growfs /` to utilize the new space without unmounting. This is the proper procedure for XFS filesystems, which require `xfs_growfs` (not `resize2fs`) to expand while mounted.

Answer

fstrim /

Answer

resize2fs /dev/mapper/vg_root-lv_root

Answer

lvextend -L +5G /dev/mapper/vg_root-lv_root

Question 17

An administrator receives an alert that a process named 'apache2' is consuming excessive CPU. The administrator needs to identify the PID of the process and then change its priority to the lowest possible value (least favorable scheduling). Which sequence of commands should be used?

Accepted Answer

pidof apache2; renice -n 19 -p . `pidof apache2` retrieves the PID of the apache2 process, and `renice -n 19 -p ` sets the priority to the lowest possible (least favorable) scheduling value. In Linux, `renice` accepts nice values from -20 (highest priority) to 19 (lowest priority), so 19 is the correct value for the least favorable scheduling.

Answer

pidof apache2; renice -n 20 -p <PID>

Answer

ps -C apache2 -o pid=; renice -n -20 -p <PID>

Answer

ps aux | grep apache2; nice -n 19 <PID>

Question 18

A production server runs RHEL 8 with a software RAID 5 array (/dev/md0) composed of three disks: /dev/sda, /dev/sdb, /dev/sdc. The array is used to store database files. The server experiences a disk failure on /dev/sdc. The admin replaces /dev/sdc with an identical disk and wants to rebuild the array. He runs: mdadm /dev/md0 --add /dev/sdc. The command completes without error, but the array shows a degraded state after several hours. What should the admin do next?

Accepted Answer

Run mdadm --detail /dev/md0 to check the status and rebuild progress.. After adding a replacement disk to a RAID 5 array, the rebuild process begins automatically but may take hours depending on disk size and I/O load. Running `mdadm --detail /dev/md0` allows the admin to check the current state, rebuild progress (e.g., percentage complete), and any errors that might have stalled the rebuild. This is the first diagnostic step to determine if the rebuild is still ongoing, has failed, or is degraded for another reason.

Answer

Rebuild will happen automatically; just wait longer.

Answer

Recreate the array using mdadm --create with the same parameters.

Answer

Format /dev/sdc with a filesystem before adding to the array.

Question 19

A junior admin receives a ticket: 'The /var partition is filling up quickly. The server has an extra 100GB disk /dev/sdb. The /var filesystem is on logical volume lv_var in volume group vg_system. Currently, vg_system has no free extents. The admin's plan: create a new physical volume on /dev/sdb, extend vg_system, extend lv_var, and resize the filesystem. He runs: pvcreate /dev/sdb; vgextend vg_system /dev/sdb; lvextend -L+100G /dev/vg_system/lv_var; resize2fs /dev/vg_system/lv_var. The system reports error: 'resize2fs: Invalid argument while trying to open /dev/vg_system/lv_var'. What is the most likely mistake?

Accepted Answer

He used resize2fs instead of xfs_growfs because /var is typically XFS.. The error 'resize2fs: Invalid argument while trying to open /dev/vg_system/lv_var' indicates that the filesystem on lv_var is not ext2/3/4 but likely XFS. RHEL 8/9 defaults to XFS for /var, and XFS requires xfs_growfs (which operates on a mount point, not a block device) instead of resize2fs. Using resize2fs on an XFS filesystem produces this exact error.

Answer

He should have used lvresize instead of lvextend.

Answer

He forgot to run partprobe after pvcreate.

Answer

The lvextend command failed because vg_system has no free extents.

Question 20

A system has a new disk /dev/sdb that needs to be used as an LVM physical volume for an existing volume group 'vg_data'. Which sequence of commands is correct?

Accepted Answer

pvcreate /dev/sdb; vgextend vg_data /dev/sdb. The disk /dev/sdb must first be initialized as a physical volume using pvcreate, then added to the existing volume group vg_data using vgextend. This sequence properly extends the volume group with the new physical volume, as required by LVM.

Answer

vgcreate vg_data /dev/sdb; pvcreate /dev/sdb

Answer

lvextend vg_data /dev/sdb

Answer

pvcreate /dev/sdb; vgcreate vg_data /dev/sdb