EX200 Practice Test 3 — 25 Questions

Question 1

A web server is running in enforcing mode with SELinux, but Apache cannot read content in a custom directory /web. The directory has been labeled correctly with httpd_sys_content_t. However, access is still denied. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The directory has incorrect permissions of 700.. Even though the SELinux context is correctly set to httpd_sys_content_t, the directory has permissions of 700 (rwx------). This means only the owner (typically root) can read, write, or execute the directory. The Apache httpd process runs as the 'apache' or 'httpd' user, which is not the owner, so it is denied read access. SELinux enforces its own policy, but DAC (Discretionary Access Control) permissions are checked first; if DAC denies access, SELinux never gets to evaluate the context match.

Answer

SELinux boolean httpd_enable_homedirs is off.

Answer

The httpd process is running in permissive mode.

Answer

The files are labeled with default_t.

Question 2

Refer to the exhibit. A web server must also accept HTTPS traffic on port 8443. Which command should the administrator run to permanently open this port?

Accepted Answer

firewall-cmd --add-port=8443/tcp --permanent && firewall-cmd --reload. It uses `--add-port=8443/tcp` to open a non-standard port (8443) for HTTPS traffic, applies the `--permanent` flag to persist the rule across reboots, and then runs `--reload` to activate the change immediately without restarting the firewall service. Without `--reload`, the permanent rule would not take effect until the next firewall reload or system restart.

Answer

firewall-cmd --add-service=8443/tcp --permanent

Answer

firewall-cmd --add-port=8443/tcp

Answer

firewall-cmd --add-port=8443/tcp --zone=public

Question 3

A user complains that the 'ls' command no longer outputs colors. The administrator suspects a change in environment variables. Which command would help diagnose the issue?

Accepted Answer

env. The `env` command displays all current environment variables, which directly affect the behavior of commands like `ls`. The `ls` command uses the `LS_COLORS` environment variable to determine color output; if this variable is missing or altered, colors will not appear. Running `env` allows the administrator to inspect the current environment and identify if `LS_COLORS` has been changed or unset.

Answer

set

Answer

declare

Answer

alias

Question 4

A system administrator needs to allow members of the 'developers' group to run any command as root without being prompted for a password. Which sudoers configuration line should be added?

Accepted Answer

%developers ALL=(ALL) NOPASSWD: ALL. The line `%developers ALL=(ALL) NOPASSWD: ALL` grants all members of the 'developers' group (indicated by the `%` prefix) permission to run any command as any user (including root) via sudo without being prompted for a password. The `NOPASSWD` tag is the key directive that bypasses password authentication, which directly matches the requirement to run commands as root without a password.

Answer

%developers ALL=(root) PASSWD: ALL

Answer

developers ALL=(ALL) NOPASSWD: ALL

Answer

%developers ALL=(ALL) ALL

Question 5

What is the default filesystem type in Red Hat Enterprise Linux 8?

Accepted Answer

XFS. In Red Hat Enterprise Linux 8, the default filesystem type is XFS. XFS is a high-performance 64-bit journaling filesystem that supports large files and filesystems, and it has been the default since RHEL 7. The Anaconda installer selects XFS by default for the root filesystem during a standard installation.

Answer

btrfs

Answer

ZFS

Answer

ext4

Question 6

Which command displays the current system time, timezone, and whether NTP synchronization is active?

Accepted Answer

timedatectl. The `timedatectl` command (option C) is the correct tool in Red Hat Enterprise Linux (RHEL) for querying and configuring system time, timezone, and NTP synchronization status. It displays the current local time, timezone, and whether NTP is active or enabled in a single, clear output, making it the standard utility for these tasks in systemd-based systems.

Answer

ntpq -p

Answer

date

Answer

cal

Question 7

An administrator has an XFS filesystem on a logical volume /dev/vg_data/lv_data mounted at /data. To extend the filesystem by 10GB, which sequence of commands is correct?

Accepted Answer

lvextend -L +10G /dev/vg_data/lv_data; xfs_growfs /data. For XFS filesystems, the logical volume must be extended first with `lvextend`, then the filesystem must be grown online using `xfs_growfs` with the mount point as the argument. XFS does not support shrinking and requires this specific order; `resize2fs` is only for ext2/3/4 filesystems.

Answer

lvextend -L +10G /dev/vg_data/lv_data; resize2fs /dev/vg_data/lv_data

Answer

xfs_growfs /data; lvextend -L +10G /dev/vg_data/lv_data

Answer

resize2fs /dev/vg_data/lv_data; lvextend -L +10G /dev/vg_data/lv_data

Question 8

Which THREE of the following are valid and recommended practices when writing shell scripts for RHEL?

Accepted Answer

Using 'local' keyword for variable declarations inside functions.. The 'local' keyword restricts a variable's scope to the function where it is declared, preventing unintended side effects on global variables. This is a recommended practice in RHEL shell scripting to maintain modularity and avoid namespace pollution.

Answer

Using 'set -e' to exit on non-zero exit codes.

Answer

Using the 'source' command instead of '.' for readability.

Question 9

During boot, a custom application fails because the /data file system is not mounted. Upon investigation, the administrator sees an error 'UUID=abc123 not found' in the logs. Which command should the administrator use to correct the /etc/fstab entry?

Accepted Answer

blkid /dev/sdb1. The error 'UUID=abc123 not found' indicates that the /etc/fstab entry for /data references a UUID that does not match any block device. The administrator needs to find the correct UUID of the actual partition (e.g., /dev/sdb1) and update the fstab entry. The `blkid /dev/sdb1` command displays the UUID (and filesystem type) of that specific device, allowing the administrator to copy the correct UUID into /etc/fstab.

Answer

mount -a

Answer

xfs_info /dev/sdb1

Answer

fdisk -l /dev/sdb1

Answer

lsblk -f /dev/sdb1

Question 10

A Red Hat Enterprise Linux system has a second disk /dev/sdb with a single partition /dev/sdb1 that was formatted as XFS and mounted at /mnt/backup. The administrator wants to change the filesystem on /dev/sdb1 to ext4 without losing existing data. Which steps should be taken in order?

Accepted Answer

Backup data, unmount, mkfs.ext4, remount, restore data. You cannot convert an XFS filesystem to ext4 in place; the only safe method is to back up the data, unmount the partition, create a new ext4 filesystem with mkfs.ext4, remount, and then restore the data. XFS and ext4 have fundamentally different on-disk structures (e.g., allocation groups vs. block groups, different journaling formats), so no in-place conversion tool exists.

Answer

Unmount, mkfs.ext4 /dev/sdb1, then mount

Answer

Use xfs_admin to change type

Answer

Use fsck.ext4 to convert in place

Question 11

Refer to the exhibit. An administrator runs lsblk and sees the above output. The administrator wants to mount /dev/sdb1 at /mnt/data. What should be done first?

Accepted Answer

Create the directory /mnt/data and then run mount. Before mounting a filesystem, the mount point directory must exist. Option A correctly instructs to create /mnt/data with mkdir -p /mnt/data and then run mount /dev/sdb1 /mnt/data. Without the directory, the mount command will fail with a 'mount point does not exist' error.

Answer

Run mount /dev/sdb1 /mnt/data

Answer

Run partprobe to detect the partition

Answer

Run mkfs.xfs /dev/sdb1

Answer

Edit /etc/fstab and add an entry

Question 12

Which TWO commands can be used to display the contents of a compressed log file without decompressing it first?

Accepted Answer

bzless /var/log/messages.bz2. `bzless` is a utility specifically designed to view bzip2-compressed files without decompressing them first. It decompresses the file on the fly and pipes the output to a pager, allowing you to scroll through the content. Similarly, option B is correct because `zcat` reads a gzip-compressed file and writes the decompressed data to standard output, effectively displaying the contents without permanently decompressing the file.

Answer

grep 'error' /var/log/messages.gz

Answer

vim /var/log/messages.gz

Answer

less /var/log/messages.gz

Question 13

Which command creates a 2GB logical volume named 'lvdata' in the volume group 'vgdata'?

Accepted Answer

lvcreate -L 2G -n lvdata vgdata. The `lvcreate` command with `-L 2G` specifies the size in gigabytes, `-n lvdata` sets the logical volume name, and `vgdata` is the volume group in which the logical volume is created. This syntax follows the standard LVM2 command structure for creating a logical volume of a specified size within an existing volume group.

Answer

lvcreate -n vgdata -L 2G lvdata

Answer

lvcreate -n lvdata -s 2G vgdata

Answer

lvcreate -l 2G -n lvdata vgdata

Question 14

Which file contains the list of filesystems to be mounted at system startup?

Accepted Answer

/etc/fstab. The /etc/fstab file is the system configuration file that defines static filesystem information, including devices, mount points, filesystem types, mount options, dump frequency, and fsck pass order. During system startup, the mount -a command (typically run by systemd or init scripts) reads /etc/fstab to mount all filesystems listed there, making it the definitive source for automatic mounting at boot.

Answer

/etc/rc.local

Answer

/etc/filesystems

Answer

/etc/mtab

Question 15

A user needs to view the last 15 lines of a log file that is constantly being updated. Which command should they use?

Accepted Answer

tail -n 15 /var/log/messages. The `tail -n 15 /var/log/messages` command displays the last 15 lines of the specified log file without following it. This meets the requirement to view the last 15 lines of a file that is constantly being updated, as it provides a static snapshot of the most recent entries.

Answer

tail -f /var/log/messages

Answer

cat /var/log/messages

Answer

head -15 /var/log/messages

Question 16

Refer to the exhibit. Why does the 'bin' user have /sbin/nologin as its shell?

Accepted Answer

The user is a system account that should not log in interactively.. The /sbin/nologin shell is explicitly assigned to system accounts like 'bin' to prevent interactive logins. This shell prints a message and exits, ensuring that the account can only be used for non-interactive system processes, such as owning files or running daemons, without providing a login session.

Answer

The user's home directory is missing.

Answer

The user is locked.

Answer

The shell is not installed.

Question 17

A system administrator needs to configure a firewall using firewalld to allow incoming HTTPS traffic and deny incoming SSH traffic from a specific source IP 192.168.1.100. Which two commands should be run? (Choose two.)

Accepted Answer

firewall-cmd --add-service=https --permanent. `firewall-cmd --add-service=https --permanent` adds the HTTPS service (TCP port 443) to the permanent firewall configuration, which is required to allow incoming HTTPS traffic persistently across reboots. The `--permanent` flag ensures the rule survives a reload or restart, and the `--add-service` option uses predefined service definitions from firewalld to simplify rule creation.

Answer

firewall-cmd --runtime-to-permanent

Answer

firewall-cmd --add-rich-rule='rule family=ipv4 source address=192.168.1.100 service name=ssh reject' --permanent

Answer

firewall-cmd --add-service=http --permanent

Question 18

What does the 's' in the owner execute position indicate?

Accepted Answer

SetUID. In Linux file permissions, the 's' in the owner execute position (e.g., `-rwsr-xr-x`) indicates the SetUID (Set User ID) special permission. When set on an executable file, it allows the process to run with the effective user ID of the file's owner (typically root), rather than the user who launched it. This is why option E is correct.

Answer

Mandatory access control

Answer

SetGID

Answer

Sticky bit

Answer

No special permission

Question 19

Which three of the following actions are required when adding a new swap device to the system? (Choose three.)

Accepted Answer

Use mkswap to set up the swap signature. `mkswap` writes a swap signature (UUID and label) to the device, which is required before the kernel can use it as swap space. Without this signature, the device is not recognized as a swap area.

Answer

Mount the device to a swap directory

Answer

Create a filesystem using mkfs

Question 20

Which TWO statements are true regarding container images and containers in Podman?

Accepted Answer

A container is a running or stopped instance of an image with a writable layer.. A container in Podman is an instantiation of an image that adds a writable layer on top of the image's read-only layers. This writable layer persists changes made during the container's runtime, even after the container is stopped, unless explicitly removed.

Answer

A container can only be created from an image that is stored locally.

Answer

When a container is stopped, its writable layer is automatically removed.

Answer

A container image must be built using a Dockerfile.