EX200 Practice Questions 2 — 50 Questions

Question 1

During a security audit, an administrator needs to list all TCP ports on which the system is listening, showing only the port numbers and the associated process names. Which command best achieves this?

Accepted Answer

sudo ss -tlnp. Option C is correct because `sudo ss -tlnp` lists TCP listening sockets with numeric port numbers and process names. The `-t` flag filters for TCP, `-l` shows only listening sockets, `-n` displays numeric addresses/ports (avoiding DNS resolution), and `-p` reveals the process name. This command requires root privileges to see process information, hence `sudo`.

Answer

netstat -tulpn

Answer

nmap -sT localhost

Answer

lsof -i TCP:1-65535

Question 2

A user complains that the 'ls' command no longer outputs colors. The administrator suspects a change in environment variables. Which command would help diagnose the issue?

Accepted Answer

env. Option C is correct because the `env` command displays all current environment variables, which directly affect the behavior of commands like `ls`. The `ls` command uses the `LS_COLORS` environment variable to determine color output; if this variable is missing or altered, colors will not appear. Running `env` allows the administrator to inspect the current environment and identify if `LS_COLORS` has been changed or unset.

Answer

set

Answer

declare

Answer

alias

Question 3

Which THREE commands can be used to check the disk space usage of the /home partition?

Accepted Answer

df -h /home. Option A is correct because `df -h /home` displays the disk space usage of the /home filesystem in human-readable format (e.g., GB, MB). The `df` command reports the total, used, and available space for mounted filesystems, making it the standard tool for checking partition-level disk usage.

Answer

fdisk -l /dev/sda

Answer

parted /dev/sda print

Question 4

An administrator has created a RAID 1 array using mdadm with two 1TB disks. After a disk failure, the array is in a degraded state. Which command should be used to replace the failed disk with a new one?

Accepted Answer

mdadm --manage /dev/md0 --fail /dev/sdb --remove /dev/sdb --add /dev/sdc. Option B is correct because it uses the `--manage` subcommand to first mark the failed disk (`/dev/sdb`) as failed with `--fail`, then remove it with `--remove`, and finally add the replacement disk (`/dev/sdc`) with `--add`. This is the proper sequence in mdadm to replace a failed disk in a RAID 1 array while the array is degraded.

Answer

mdadm --add /dev/md0 /dev/sdc

Answer

mdadm --remove /dev/md0 /dev/sdb --add /dev/sdc

Answer

mdadm --replace /dev/md0 --with /dev/sdc

Question 5

An administrator suspects a disk failure in /dev/md0. Which command would be used to simulate a failure on /dev/sdb and then remove it from the array?

Accepted Answer

mdadm /dev/md0 -f /dev/sdb -r /dev/sdb. Option C is correct because the `mdadm` command with the `-f` (fail) and `-r` (remove) flags in a single command line first marks /dev/sdb as faulty in the /dev/md0 array, then immediately removes it. This is the standard syntax for simulating a failure and removing the disk in one step, as tested in the EX200 exam.

Answer

mdadm --manage /dev/md0 --fail /dev/sdb --remove /dev/sdc

Answer

mdadm --fail /dev/md0 /dev/sdb; mdadm --remove /dev/md0 /dev/sda

Answer

mdadm --manage /dev/md0 --fault /dev/sdb --remove /dev/sdb

Question 6

A file server is experiencing slow write performance. The admin suspects the filesystem is nearly full. Which command should be used to check disk usage per partition?

Accepted Answer

df -h. The `df -h` command displays disk space usage for all mounted filesystems in human-readable format (e.g., GB, MB). This directly answers the admin's need to check per-partition usage and identify if a filesystem is nearly full, which can cause slow write performance due to lack of free space.

Answer

df -i

Answer

du -h --max-depth=1 /

Answer

du -sh /

Question 7

A system has two 500GB disks in a RAID1 (mirror) using mdadm. One disk fails. After replacement, what is the correct procedure to restore redundancy?

Accepted Answer

Use sfdisk to copy partition table from /dev/sda to /dev/sdb, then 'mdadm --manage /dev/md0 --add /dev/sdb1'. Option D is correct because when replacing a failed disk in a RAID1 array managed by mdadm, the new disk must have a partition table that matches the surviving disk. Using sfdisk to copy the partition table from /dev/sda to /dev/sdb ensures that the partition layout (e.g., partition type 0xFD for Linux RAID autodetect) is identical, which is required before adding the partition (e.g., /dev/sdb1) to the array with mdadm --manage --add. Simply adding the raw disk without a proper partition table would fail because mdadm expects a partition with the correct RAID superblock and partition type.

Answer

Run 'mdadm --manage /dev/md0 --add /dev/sdb'

Answer

Remove the failed disk with 'mdadm /dev/md0 --fail /dev/sdb1' then add new.

Answer

Run 'mdadm --assemble --scan' to rebuild the array automatically.

Question 8

A filesystem is reported as 'read-only' after a system crash. The admin runs fsck and sees 'clean' status. What is the most likely reason it remains read-only?

Accepted Answer

fsck detected errors but did not fix them automatically.. Option D is correct because when fsck reports a filesystem as 'clean' but the system still shows it as read-only, it typically means fsck detected errors during the check but did not automatically repair them. By default, fsck runs in non-interactive mode on boot and may require the '-y' flag or manual intervention to apply fixes. The 'clean' status can be misleading if the journal indicates no corruption, but underlying metadata inconsistencies remain unaddressed.

Answer

fsck cannot fix errors on ext4 filesystems.

Answer

The filesystem is still mounted; fsck cannot fix it while mounted.

Answer

The filesystem is XFS, and fsck does not repair XFS.

Question 9

Which command creates an XFS filesystem on /dev/nvme0n1p1 and sets the label to 'data'?

Accepted Answer

mkfs.xfs -L data /dev/nvme0n1p1. Option C is correct because the `-L` flag in `mkfs.xfs` is used to set the filesystem label. The command `mkfs.xfs -L data /dev/nvme0n1p1` creates an XFS filesystem on the specified partition and assigns it the label 'data'.

Answer

mkfs.xfs -l data /dev/nvme0n1p1

Answer

mkfs.xfs -f /dev/nvme0n1p1

Answer

mkfs.xfs -n data /dev/nvme0n1p1

Question 10

Which TWO commands can be used to check the UUID of a filesystem on /dev/sda1?

Accepted Answer

lsblk -o UUID /dev/sda1. The `blkid` command directly queries the UUID of a block device from the libblkid cache or by reading the filesystem superblock, and `lsblk -o UUID` filters the lsblk output to show only the UUID column for the specified device. Both commands reliably retrieve the UUID of /dev/sda1.

Answer

e2label /dev/sda1

Answer

findmnt /dev/sda1

Answer

file -s /dev/sda1

Question 11

A system administrator notices that a RHEL 9 server's /var/log/messages is filling up the /var partition. The administrator wants to ensure log rotation runs daily and keeps 4 weeks of logs. Which configuration file should be modified?

Accepted Answer

/etc/logrotate.d/syslog. Option B is correct because /etc/logrotate.d/syslog is the configuration file that controls log rotation for system log files such as /var/log/messages. By modifying this file, the administrator can set the rotation frequency to daily and specify the number of weeks (e.g., rotate 28 for 4 weeks) to retain logs, directly addressing the requirement.

Answer

/etc/systemd/journald.conf

Answer

/etc/rsyslog.conf

Answer

/etc/cron.daily/logrotate

Question 12

A technician needs to configure a static IPv4 address on a RHEL 9 network interface 'enp1s0' using NetworkManager. Which command should be used to set the IP address?

Accepted Answer

nmcli connection modify enp1s0 ipv4.addresses 192.168.1.100/24. Option A is correct because `nmcli connection modify enp1s0 ipv4.addresses 192.168.1.100/24` is the proper NetworkManager command to set a static IPv4 address on a RHEL 9 interface. This command modifies the connection profile for 'enp1s0' by setting the `ipv4.addresses` property to the specified address and prefix length, which is the standard method for persistent static IP configuration via NetworkManager.

Answer

nmtui edit enp1s0 --ipv4 192.168.1.100/24

Answer

ip addr add 192.168.1.100/24 dev enp1s0

Answer

ifconfig enp1s0 192.168.1.100 netmask 255.255.255.0

Question 13

A system administrator is tasked with configuring a RHEL 9 system to automatically mount an NFS share from 192.168.1.10:/export/data on /mnt/data at boot. Which entry in /etc/fstab is correct?

Accepted Answer

192.168.1.10:/export/data /mnt/data nfs4 defaults 0 0. Option C is correct because the /etc/fstab entry for an NFS mount requires the remote server and export path in the format server:/export, followed by the local mount point, the filesystem type (nfs4 for NFSv4), mount options, dump flag, and fsck order. This matches the standard NFS fstab syntax for automatic mounting at boot.

Answer

192.168.1.10 /export/data /mnt/data nfs4 defaults 0 0

Answer

/mnt/data 192.168.1.10:/export/data nfs4 defaults 0 0

Answer

192.168.1.10:/export/data /mnt/data nfs defaults 0 0

Question 14

A RHEL 9 system has a second disk /dev/sdb that needs to be partitioned with a single partition using all space, formatted with XFS, and mounted persistently at /data. The administrator uses fdisk to create the partition /dev/sdb1. Which filesystem creation command should be used?

Accepted Answer

mkfs.xfs /dev/sdb1. The correct command is mkfs.xfs /dev/sdb1 because the question specifies that the partition must be formatted with XFS. The mkfs.xfs command is the dedicated tool for creating an XFS filesystem on a block device. It directly invokes the mkfs.xfs utility, which writes the XFS superblock and metadata structures to the partition.

Answer

mke2fs /dev/sdb1

Answer

mkfs -t ext4 /dev/sdb1

Answer

mkfs.ext4 /dev/sdb1

Question 15

Which THREE are valid methods to configure network bonding in RHEL 9? (Choose exactly three.)

Accepted Answer

Using a configuration file in /etc/NetworkManager/system-connections/.. Option A is correct because in RHEL 9, NetworkManager stores connection profiles in `/etc/NetworkManager/system-connections/`. You can manually create a bond configuration file in this directory with the proper key-value pairs (e.g., `type=bond`, `bond.options=mode=1,miimon=100`), and NetworkManager will read it on restart or reload. This is a valid method for configuring network bonding.

Answer

Using the teamd service.

Answer

Editing /etc/sysconfig/network-scripts/ifcfg-bond0 directly.

Question 16

A system administrator wants to allow user 'jdoe' to execute any command as root via sudo without being prompted for a password, but only from the host 'client1.example.com'. Which sudoers rule achieves this?

Accepted Answer

jdoe client1.example.com=(root) NOPASSWD: ALL. Option A is correct because the sudoers rule 'jdoe client1.example.com=(root) NOPASSWD: ALL' specifies the user 'jdoe', the host 'client1.example.com' as the source host from which the command is run, the target user '(root)', the NOPASSWD tag to skip password authentication, and the command 'ALL' to allow any command. This matches the requirement exactly: passwordless root access restricted to a specific client host.

Answer

jdoe client1.example.com=(root) ALL

Answer

jdoe ALL=(root) NOPASSWD: ALL

Answer

jdoe ALL=(root) ALL

Question 17

An administrator wants to add the user 'jane' to the supplementary groups 'wheel' and 'docker' without removing her from other groups. Which command should be used?

Accepted Answer

usermod -aG wheel,docker jane. Option B is correct because the `usermod -aG` command appends the user 'jane' to the supplementary groups 'wheel' and 'docker' without removing her from any existing supplementary groups. The `-a` (append) flag must be used with `-G` to avoid overwriting the current group membership list, which is the default behavior of `-G` alone.

Answer

groupmems -a jane -g wheel,docker

Answer

usermod -a -G wheel,docker jane

Answer

usermod -G wheel,docker jane

Question 18

Which TWO commands can change the primary group of an existing user?

Accepted Answer

usermod -aG. The `usermod -g` command (not `-aG`, which adds supplementary groups) changes the primary group of an existing user. The `gpasswd -a` command adds a user to a group, but it does not change the primary group; it only affects supplementary group membership. Therefore, neither option A nor B is correct for changing the primary group. The correct commands are `usermod -g` (to set the primary group) and `usermod -G` (to set supplementary groups, but not the primary).

Answer

vigr

Answer

groupmems -a

Answer

useradd -G

Question 19

Refer to the exhibit. A web server (httpd) is unable to serve files from a user's home directory. What is the most appropriate single command to resolve the issue?

Accepted Answer

semanage fcontext -a -t httpd_sys_content_t '/home/user/www(/.*)?' && restorecon -Rv /home/user/www. Option C is correct because it uses `semanage fcontext` to set the default SELinux file context for the `/home/user/www` directory tree to `httpd_sys_content_t`, then applies it with `restorecon`. This is the proper way to persistently label custom web content directories so that httpd can serve them, as SELinux policy by default blocks httpd from reading user home directories.

Answer

chcon -u system_u /home/user/www/index.html

Answer

setsebool -P httpd_enable_homedirs on

Answer

chcon -r object_r /home/user/www/index.html

Question 20

An administrator runs 'getenforce' and sees 'Enforcing'. They then run 'setenforce 0' but SELinux still denies access to a custom application. What is the most likely reason?

Accepted Answer

The issue is due to file permissions or ACLs, not SELinux.. Option C is correct because `setenforce 0` switches SELinux to permissive mode, which logs but does not enforce denials. If access is still denied after this command, the issue is not caused by SELinux enforcement but by traditional Linux file permissions (DAC) or ACLs. The administrator should check `ls -l` and `getfacl` to verify the file's ownership and permissions.

Answer

SELinux is in enforcing mode and the policy is misconfigured.

Answer

The application's SELinux context is incorrect and needs relabeling.

Answer

The change requires a reboot to take effect.