EX200 Practice Test 37 — 15 Questions

Question 1

A junior administrator configured a new network interface (ens224) with a static IP address using a configuration file in /etc/sysconfig/network-scripts/ifcfg-ens224. After restarting the network service, the interface comes up but does not get the IP address. The administrator runs 'ip addr show ens224' and sees no IP address assigned. The interface is listed as DOWN. The administrator then runs 'ifup ens224' manually, which succeeds, and the IP address appears. What is the most likely cause?

Accepted Answer

The ONBOOT directive is set to no in the ifcfg file.. Option A is correct. The ONBOOT directive controls whether the interface is brought up automatically at boot or upon network service restart. Setting ONBOOT=no prevents automatic activation, but manual ifup works because the configuration is otherwise correct. Option B is less likely because the network service was restarted, and if ONBOOT=yes, it would have activated the interface. Option C would cause a different error (interface not found). Option D could cause issues, but if NetworkManager is managing the interface, manual ifup might not work as expected, or the configuration would be ignored.

Answer

The network service is not enabled to start at boot.

Answer

The interface name does not match the device file.

Answer

There is a conflict with NetworkManager managing the interface.

Question 2

A developer deploys a container using podman with a bind mount to persist web content. They run: podman run -d --name web -v /webdata:/usr/local/apache2/htdocs:Z -p 8080:80 httpd:latest. The container fails to start. The journal shows SELinux denials for the httpd process inside the container trying to read files with context httpd_sys_content_t, while the process runs in container_t domain. The host directory /webdata exists and contains index.html. The administrator checks that the container image is standard. What is the most likely cause of the failure?

Accepted Answer

The podman command should use :z instead of :Z.. Option C is correct because the `:Z` flag in the bind mount tells Podman to relabel the host directory with a private SELinux context (`container_file_t`) unique to that container, which prevents other containers from accessing it. However, the SELinux denial shows the httpd process inside the container (running in `container_t` domain) cannot read files labeled `httpd_sys_content_t` (the default label for web content on the host). Using `:z` instead of `:Z` would relabel the directory with the shared context `container_file_t`, allowing the container process to read the files while still enforcing SELinux policy.

Answer

The SELinux context on /webdata is incorrect for container use.

Answer

The /webdata directory does not exist.

Answer

The container image is incompatible with the host SELinux policy.

Question 3

A system administrator is troubleshooting a cron job that runs a script as root. The script is located at /root/scripts/backup.sh and has permissions 755. The cron job is defined in /etc/crontab with the line: 0 2 * * * root /root/scripts/backup.sh. However, the script does not run at the scheduled time. The administrator checks the cron logs and finds no errors. The administrator then runs the script manually as root and it executes successfully. What is the most likely cause of the cron job not running?

Accepted Answer

The cron job line uses absolute path to the script but the script requires an environment variable that is not set in cron's minimal environment.. Option A is correct because cron jobs run with a minimal environment, typically lacking user-specific environment variables like PATH, HOME, or custom variables set in shell startup files. The script at /root/scripts/backup.sh may rely on an environment variable (e.g., a database password or directory path) that is defined in root's interactive shell but not in cron's environment. When run manually as root, the variable is available, but cron does not source /root/.bashrc or /root/.bash_profile, causing the script to fail silently or not execute as expected.

Answer

The script is not executable by the root user.

Answer

The cron daemon is not running.

Answer

The /etc/crontab file does not allow running scripts from /root.

Question 4

A junior administrator is tasked with finding all files in the /var/log directory that have been modified within the last 24 hours and are owned by the 'root' user. The administrator runs the command: find /var/log -user root -mtime 0. However, the command returns no output, even though there are files that meet the criteria. What is the most likely issue with the find command?

Accepted Answer

The -mtime 0 argument is incorrect; it should be -mtime -1 to find files modified in the last 24 hours.. Option D is correct because `-mtime 0` matches files modified exactly 24 hours ago (i.e., between 0 and 24 hours ago, but not including the current 24-hour window). To find files modified within the last 24 hours (i.e., less than 24 hours ago), the correct argument is `-mtime -1`, which matches files modified less than 1 day ago. The administrator's command returns no output because no files have a modification time that falls exactly in the 24-hour-old window.

Answer

The /var/log path is not accessible; the administrator should use sudo.

Answer

The -user root argument is invalid; it should be -uid 0.

Answer

The find command requires the -type f argument to search for files only.

Question 5

A Red Hat Enterprise Linux 8 server is used as a file server. It has a 1 TB disk /dev/sdc formatted as XFS and mounted at /srv/files. The /etc/fstab entry uses the device name /dev/sdc. After a hardware replacement, the new disk is detected as /dev/sdd, and the server fails to boot because /srv/files cannot be mounted. The administrator used 'blkid' and found the new disk's filesystem UUID is 'abc-123'. What is the best course of action to ensure reliable mounting after future reboots?

Accepted Answer

Change the /etc/fstab entry to use UUID=abc-123 and run mount -a. Option B is correct because using the filesystem UUID in /etc/fstab provides a persistent identifier that remains constant regardless of the device name assigned by the kernel. After the hardware replacement, the disk is detected as /dev/sdd, but its UUID ('abc-123') is unchanged. Changing the fstab entry to UUID=abc-123 ensures the system can reliably mount the filesystem on every boot, as the UUID is tied to the filesystem itself, not the kernel's device enumeration order.

Answer

Add the 'nofail' option to the /etc/fstab entry and reboot

Answer

Create a symbolic link /dev/sdc pointing to /dev/sdd

Answer

Use PARTUUID instead of UUID in /etc/fstab

Question 6

A RHEL 8 system has an ext4 filesystem on /dev/sdb1 mounted at /backup. The admin runs out of space and wants to extend the filesystem. He adds a new disk /dev/sdc, creates a partition /dev/sdc1 (all space), adds it to LVM by creating a PV and extending the VG that contains the LV for /backup. He then extends the logical volume with lvextend -L+20G /dev/vg_backup/lv_backup. The command succeeds, but the filesystem still shows the old size. What did he forget to do?

Accepted Answer

Resize the filesystem using resize2fs.. When extending an LVM logical volume, the `lvextend` command only expands the logical volume's block device, not the filesystem residing on it. After extending the LV, the admin must run `resize2fs` (for ext4) to resize the filesystem to match the new LV size. Without this step, the kernel still sees the old filesystem metadata, so `df -h` reports the original size.

Answer

Reboot the system to recognize the new space.

Answer

Run lvchange -ay to activate the logical volume.

Answer

Unmount the filesystem before extending the LV.

Question 7

A system administrator is managing a Red Hat Enterprise Linux 9 web server running Apache httpd. The server hosts a custom application that stores its files in /var/www/custom. The administrator has set ownership to apache:apache and file permissions to 755. However, when users access the web application, they receive a 'Forbidden' error. The httpd service is running, and SELinux is in enforcing mode. The administrator checks the SELinux context of the /var/www/custom directory and sees 'unconfined_u:object_r:default_t:s0'. What should the administrator do to resolve the issue without disabling SELinux?

Accepted Answer

Use semanage fcontext to set the SELinux type to httpd_sys_content_t and run restorecon. The SELinux type 'default_t' prevents httpd from reading the files. The correct approach is to change the context type to 'httpd_sys_content_t' persistently using semanage fcontext and then apply it with restorecon. Using chcon is temporary and will not survive a file system relabel.

Answer

Set SELinux to permissive mode

Answer

Use chcon to set the SELinux type to httpd_sys_content_t

Answer

Add the apache user to the group that owns the directory

Question 8

A company runs a web application on a Red Hat Enterprise Linux 8 server. The application is served by Apache HTTPD, and it requires read/write access to a custom directory /var/www/app_data. The SELinux context for the directory is set to httpd_sys_rw_content_t. Apache runs in enforcing mode. Recently, a new feature was added that requires Apache to connect to a database on the same server via a Unix socket. The database serves on /var/run/mysqld/mysqld.sock. After the feature deployment, the web application fails to connect to the database. The error logs show permission denied on the socket file. The socket file has permissions 660 and is owned by mysql:mysql. SELinux audit logs show AVC denials for httpd_t trying to connect to mysqld_var_run_t. Which of the following solutions should the administrator implement to allow Apache to read the database socket while maintaining security?

Accepted Answer

Enable the SELinux boolean httpd_can_connect_db using setsebool -P httpd_can_connect_db on.. The correct solution is to enable the SELinux boolean httpd_can_connect_db. This boolean allows Apache to connect to a local database socket. Option A changes context to a file type for content, not sockets. Option C is for network databases. Option D disables SELinux enforcement partially, which reduces security.

Answer

Change the SELinux context of the socket file to httpd_sys_rw_content_t using chcon.

Answer

Enable the SELinux boolean httpd_can_network_connect_db using setsebool -P httpd_can_network_connect_db on.

Answer

Use semanage to add a context mapping for the socket file to httpd_var_run_t and set the httpd to permissive mode.

Question 9

A server running Red Hat Enterprise Linux 9 experiences high system load (load average 15 on a 4-core system) and slow response times. The administrator runs 'top' and sees that the 'kworker' processes are consuming significant CPU time. Further investigation reveals that the system is performing heavy I/O operations on the root filesystem, which is formatted as XFS. The administrator wants to reduce the impact of filesystem maintenance tasks on system performance. Which of the following actions should the administrator take?

Accepted Answer

Set the dirty ratio sysctl parameters (vm.dirty_ratio and vm.dirty_background_ratio) to lower values.. Option B is correct. Lowering vm.dirty_background_ratio and vm.dirty_ratio causes the kernel to begin writing dirty pages sooner and more frequently, preventing large bursts of I/O that can cause high load and slow responses. Option A (noatime) reduces metadata updates but is not the primary cause. Option C (increasing nr_requests) can improve I/O queue depth but may increase memory pressure and does not directly reduce kworker CPU usage. Option D (scheduling fsck) is unrelated to the current issue.

Answer

Increase the value of the 'nr_requests' queue parameter for the underlying block device.

Answer

Mount the filesystem with the 'noatime' option to reduce metadata updates.

Answer

Schedule filesystem checks (fsck) to run during off-peak hours using a cron job.

Question 10

You are a junior administrator at a company that uses Red Hat Enterprise Linux 8. The HR department has a shared directory /hr/data that should be accessible to all members of the 'hr' group. The directory is currently owned by root:root with permissions 755. You need to configure the system so that new files created in /hr/data are automatically owned by the group 'hr' and the group has read-write permissions. Additionally, you need to ensure that user 'jane' (who is a member of 'hr') can create files in the directory. However, after adding 'jane' to the 'hr' group, she still cannot create files, receiving 'Permission denied'. Which of the following is the best course of action to resolve this issue?

Accepted Answer

Change the directory permissions to 2775 and set the SGID bit using chmod 2775 /hr/data. Option A is correct. The directory needs to have the SGID bit set (chmod g+s) so that new files inherit the group ownership, and group write permission must be granted (chmod g+w). Setting permissions to 2775 sets both the SGID bit and group write permissions. Option B is incorrect because granting sudo access is unnecessary and a security risk. Option C is incorrect because changing ownership to jane:hr would not enforce group ownership for new files and would break other users' access. Option D is incorrect; the sticky bit (chmod +t) is used to prevent users from deleting others' files, not to manage group permissions or inheritance.

Answer

Change the directory ownership to jane:hr

Answer

Use sudo to grant 'jane' full access to the directory

Answer

Set the sticky bit on the directory using chmod +t /hr/data

Question 11

Your organization has a shared directory /data/projects with permissions 2770 owned by root:projectmanagers. The directory is used by a team of developers who are all members of the 'developers' group. However, you need to ensure that any file created inside /data/projects automatically belongs to the 'developers' group, not the user's primary group. Additionally, you need to ensure that developers can delete only their own files, not those of others. Your IT security policy also requires that all user passwords must expire every 90 days and that new users should have a warning period of 7 days before expiration. Given the following options, which one describes the correct set of actions to achieve all these requirements?

Accepted Answer

Set setgid bit on /data/projects (chmod g+s), set sticky bit using chmod +t, use chage -M 90 -W 7 for each user, and ensure useradd defaults in /etc/login.defs have PASS_MAX_DAYS 90 and PASS_WARN_AGE 7.. Option A is correct. Setting the setgid bit (chmod g+s) on /data/projects ensures new files inherit the directory's group (developers). Setting the sticky bit (chmod +t) prevents users from deleting files they don't own. For password aging, using chage -M 90 -W 7 for each user sets the maximum password age and warning period. Additionally, setting defaults in /etc/login.defs (PASS_MAX_DAYS 90 and PASS_WARN_AGE 7) ensures new users automatically get these settings. Option B omits setgid, uses direct shadow editing which is error-prone, and does not cover password aging defaults. Option C uses a cron job unnecessarily and pam_tally2 for account locking, not aging. Option D uses umask changes (affects permissions, not group inheritance) and only sets max days, not warning; also does not address sticky bit.

Answer

Modify the umask of all users to 002, use chage -M 90 for all users, and set the setgid bit.

Answer

Use ACLs to set default group permissions, enable password aging by editing /etc/shadow directly, and set the sticky bit on the directory.

Answer

Set the setgid bit, create a cron job to change group ownership, and enforce password policy through pam_tally2.

Question 12

A Red Hat Enterprise Linux 9 system enforces a security policy that user accounts must be disabled after 90 days of inactivity. The system administrator has configured /etc/shadow accordingly with the proper fields. User 'bob' has been on leave for 95 days. When bob returns and tries to log in, he is unable to do so. The administrator checks the shadow file and sees that bob's password expiration date has passed and the account is locked due to inactivity (the inactivity period has exceeded). The administrator wants to immediately reactivate bob's account without changing the password, and also wants to set the account to expire in 30 days from now (relative to the current date). Which set of commands should the administrator run to achieve this goal?

Accepted Answer

chage -E $(date -d +30days +%Y-%m-%d) bob; chage -I -1 bob. Option B is correct. The chage -E command sets the account expiration date, and the -I option sets the inactivity period; setting -I to -1 disables the inactivity lock. This reactivates the account and sets a new expiration date 30 days from now. Option A is incorrect because usermod -e cannot accept a relative date without shell expansion, and passwd -u only unlocks the password, not the account inactivity lock. Option C is incorrect because it uses a hardcoded date and passwd -S only shows status; it does not reactivate. Option D is incorrect; chage -d 0 forces immediate password change and usermod -L locks the account, which is the opposite of what is needed.

Answer

usermod -e 2024-12-31 bob; passwd -S bob

Answer

chage -d 0 bob; usermod -L bob

Answer

usermod -e $(date -d +30days +%Y-%m-%d) bob; passwd -u bob

Question 13

A system administrator receives alerts that the /var/log partition is 100% full. The partition is on /dev/mapper/vg_log-lv_var_log, formatted with XFS, and is mounted at /var/log. The volume group vg_log has 10GB of free space available. The administrator runs the command `lvextend -L +10G /dev/mapper/vg_log-lv_var_log` successfully, but then `df -h` still shows 100% full. What is the next step the administrator should take to use the newly added space?

Accepted Answer

Run xfs_growfs /var/log. After extending the logical volume with `lvextend`, the underlying block device has more space, but the XFS filesystem does not automatically recognize it. The correct next step is to run `xfs_growfs /var/log` to expand the filesystem to fill the newly available space. Unlike ext4, XFS cannot be resized while mounted with `resize2fs`; it requires the XFS-specific `xfs_growfs` command, which can operate on a mounted filesystem.

Answer

Run resize2fs /dev/mapper/vg_log-lv_var_log

Answer

Reboot the system to remount the filesystem

Answer

Run fsck /dev/mapper/vg_log-lv_var_log

Question 14

A systems administrator is managing a RHEL 9 server that hosts a custom web application on Apache. The application writes log files to /var/log/myapp/ and runs as the apache user. The administrator has set the directory permissions to 755 and ownership to apache:apache. SELinux is in enforcing mode. Despite these settings, the application fails to write logs. The audit log contains multiple AVC denials with the message 'avc:  denied  { write } for pid=1234 comm="httpd" name="myapp.log" dev="dm-0" ino=5678 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file'. The administrator has verified that the file exists and that SElinux booleans related to httpd are at their default values. Which of the following steps should the administrator take to resolve the issue while maintaining security?

Accepted Answer

Use audit2allow to generate and install a custom policy module that permits httpd_t to write to files with a specific type (e.g., httpd_log_t).. Option D is correct because the AVC denial shows httpd_t is denied write access to a file with the var_log_t type. The proper solution is to create a custom SELinux policy module using audit2allow that permits httpd_t to write to files with a specific type (e.g., httpd_log_t), which confines the permission to only the necessary files and maintains security. This approach follows the principle of least privilege by not broadly relaxing SELinux controls.

Answer

Run restorecon -R /var/log/myapp/ to restore the default SELinux context.

Answer

Set the SELinux boolean httpd_unified on to allow httpd_t to write to all types.

Answer

Change the context of the /var/log/myapp/ directory to var_log_t using chcon.

Question 15

You are managing a Red Hat Enterprise Linux 8 server that hosts backup scripts. A user named 'backup' (UID 1005) is a member of the 'backup' group. The directory /var/backups is owned by root:backup with permissions 775. The 'backup' user needs to create files in this directory. However, when the user attempts to create a file, they receive 'Permission denied'. You verify that 'backup' is indeed listed in the backup group in /etc/group. The user's current shell was started after their last login. Which of the following is the most likely cause and solution?

Accepted Answer

The user needs to log out and log back in to refresh their group membership.. The user 'backup' is already a member of the 'backup' group in /etc/group, but the current shell session was started before the group membership was added or refreshed. On Linux, group membership is determined at login time by the PAM modules; simply adding a user to a group does not affect already running processes. The user must log out and log back in (or start a new login shell) to acquire the new group membership via the initgroups() system call, which populates the process's supplementary group list.

Answer

The directory lacks the setgid bit; set it with 'chmod g+s /var/backups'.

Answer

The user's umask is too restrictive, preventing file creation. Change the umask to 002.

Answer

The user should use 'newgrp backup' to switch to the backup group temporarily.