EX200 Deploy, configure, and maintain systems Practice Test 2 — 15 Questions

Question 1

Match each SELinux mode to its behavior.

Accepted Answer

Enforcing: SELinux security policy is enforced.. SELinux has three modes: Enforcing (policy enforced, violations blocked), Permissive (policy not enforced, only warnings logged), and Disabled (SELinux turned off). Common confusions involve swapping behaviors between modes.

Answer

Enforcing: SELinux logs all actions but does not block them.

Answer

Permissive: SELinux enforces the policy and blocks violations.

Answer

Disabled: SELinux warns but does not block.

Question 2

A user is unable to log in via SSH. The administrator checks /var/log/secure and sees 'Authentication refused: bad ownership or modes' for the user's home directory. What is the most likely cause?

Accepted Answer

The user's home directory is owned by root. The error 'Authentication refused: bad ownership or modes' includes the path of the offending file. When the log message references the user's home directory, it means the home directory itself has incorrect ownership or permissions. SSH's StrictModes requires the home directory to be owned by the user and not writable by group or others. If the home directory is owned by root, sshd refuses authentication. The correct answer is D.

Answer

The sshd service is not running

Answer

The SELinux context is wrong

Answer

The .ssh/authorized_keys file has incorrect permissions

Question 3

A system has a new disk /dev/sdb that needs to be used as an LVM physical volume for an existing volume group 'vg_data'. Which sequence of commands is correct?

Accepted Answer

pvcreate /dev/sdb; vgextend vg_data /dev/sdb. The disk /dev/sdb must first be initialized as a physical volume using pvcreate, then added to the existing volume group vg_data using vgextend. This sequence properly extends the volume group with the new physical volume, as required by LVM.

Answer

vgcreate vg_data /dev/sdb; pvcreate /dev/sdb

Answer

lvextend vg_data /dev/sdb

Answer

pvcreate /dev/sdb; vgcreate vg_data /dev/sdb

Question 4

A cron job runs a script every hour and leaves many log files. The administrator wants to clean up log files older than 7 days in /var/log/myapp/. Which command should be added to a weekly cron job?

Accepted Answer

find /var/log/myapp -type f -mtime +7 -delete. `-mtime +7` matches files whose modification time is older than 7 days, and `-delete` safely removes them. This is the most efficient and standard approach for cleaning up old log files in a cron job, as it avoids spawning a separate process for each file.

Answer

find /var/log/myapp -type f -atime +7 -delete

Answer

find /var/log/myapp -type f -mtime +7 -exec rm {} \;

Answer

find /var/log/myapp -type f -ctime +7 -delete

Question 5

An administrator needs to ensure that a mounted NFS filesystem is not accessible to users without proper Kerberos authentication, even if the NFS server exports with no_root_squash. Which mount options should be used in /etc/fstab?

Accepted Answer

sec=krb5i,soft. All Kerberos-based sec options (krb5, krb5i, krb5p) require valid Kerberos tickets and thus prevent unauthorized access even with no_root_squash. sec=sys does not use Kerberos. The hard/soft and noexec options are unrelated to authentication. To make D the only correct answer, the question should ask for full encryption/confidentiality, not just authentication.

Answer

sec=sys,ro

Question 6

An administrator wants to temporarily disable the firewalld service for troubleshooting. Which command will stop the service and prevent it from starting on subsequent boots?

Accepted Answer

systemctl disable --now firewalld. `systemctl disable --now firewalld` both stops the service immediately (via `--now`) and disables it from starting automatically on subsequent boots. This meets the requirement of temporarily disabling the service for troubleshooting while preventing it from starting after reboot.

Answer

systemctl stop --now firewalld

Answer

systemctl mask firewalld

Answer

systemctl stop firewalld

Answer

systemctl disable firewalld

Question 7

An administrator needs to add a 2GB swap file to a system that already has swap partitions. Which set of commands will create and activate the swap file correctly?

Accepted Answer

fallocate -l 2G /swapfile; mkswap /swapfile; swapon /swapfile. Both options A and C correctly create a 2GB swap file and activate it. Option A uses `fallocate` which pre-allocates space efficiently without writing zeros, while option C uses `dd` to explicitly write zeros, which is also a valid method. The question does not specify efficiency as a criterion, so both are acceptable.

Answer

mkfile 2G /swapfile; mkswap /swapfile; swapon /swapfile

Answer

touch /swapfile; truncate -s 2G /swapfile; mkswap /swapfile; swapon /swapfile

Question 8

An administrator needs to configure a static IP address on an interface that will persist across reboots using NetworkManager. Which TWO commands or files can be used to achieve this?

Accepted Answer

nmcli con mod eth0 ipv4.addresses 192.168.1.10/24. The `nmcli con mod` command modifies the NetworkManager connection profile for the interface, setting a static IPv4 address that is stored persistently in the connection configuration. Option D is correct because editing the `/etc/sysconfig/network-scripts/ifcfg-eth0` file directly defines the static IP address in the ifcfg format, which NetworkManager reads on boot to apply persistent settings.

Answer

systemctl restart network

Answer

nmcli con up eth0

Answer

ip addr add 192.168.1.10/24 dev eth0

Question 9

On a default Red Hat Enterprise Linux 8 installation, which THREE tools or files can be used to configure time synchronization?

Accepted Answer

chronyc. On a default Red Hat Enterprise Linux 8 installation, `chronyd` is the default NTP daemon, and its configuration file is `/etc/chrony.conf`. The `chronyc` command is the command-line interface for interacting with the `chronyd` daemon, allowing you to monitor and adjust time synchronization. `timedatectl` is the systemd-based tool for managing system time and date settings, including enabling NTP synchronization via `chronyd`.

Answer

ntpq

Answer

/etc/ntp.conf

Question 10

A technician needs to configure a network interface to use a static IP address permanently. Which command should be used in RHEL 9?

Accepted Answer

nmcli. `nmcli` is the primary command-line tool for managing NetworkManager in RHEL 9, and it allows you to configure a static IP address persistently. Using `nmcli con mod` followed by the connection name and IP settings ensures the configuration survives reboots, as NetworkManager stores the settings in its own configuration files.

Answer

ip

Answer

vi /etc/sysconfig/network-scripts/ifcfg-eth0

Answer

ifconfig

Question 11

An administrator wants to enable disk quotas for users on an XFS filesystem. Which command initializes the quota database?

Accepted Answer

xfs_quota -x -c 'limit -u bsoft=...' /mount. On XFS filesystems, quotas are not stored in a separate database; they are part of the filesystem metadata. To enable quotas, you must mount the filesystem with the uquota (usrquota) or gquota (grpquota) option (e.g., mount -o uquota ...). After mounting with quota support, the xfs_quota command is used to set and manage quota limits. The command 'xfs_quota -x -c 'limit -u bsoft=...' /mount' sets a soft limit for a user, but it does not initialize a quota database. Running this command before the filesystem is mounted with quota options would fail. Thus, the question is flawed because no command initializes an XFS quota database; initialization happens at mount time.

Answer

edquota -u user

Answer

quotacheck -cug /mount

Answer

quotaon /mount

Question 12

A user reports that they cannot start a service. Which command would an administrator use to view the service's journal logs since last boot?

Accepted Answer

journalctl -u service -b. `journalctl -u service -b` combines the `-u` flag to filter logs for a specific systemd unit (the service) with the `-b` flag to show only logs from the current boot. This is the precise command an administrator would use to view a service's journal logs since the last system start, directly addressing the user's inability to start the service.

Answer

journalctl -b

Answer

journalctl service

Answer

dmesg | grep service

Question 13

A system has a disk that may be failing. Which tool can be used to check the health of a SATA disk using SMART monitoring?

Accepted Answer

smartctl. smartctl is the correct tool because it directly interfaces with the Self-Monitoring, Analysis, and Reporting Technology (SMART) built into modern SATA and ATA drives. It can query the drive's internal health metrics, such as reallocated sector counts and temperature, to predict potential failure. The other options do not access SMART data.

Answer

fsck

Answer

dd

Answer

badblocks

Question 14

An administrator needs to configure system tuning profiles for a database server. Which command is used to set the 'throughput-performance' profile?

Accepted Answer

tuned-adm profile throughput-performance. The `tuned-adm profile throughput-performance` command is correct because Tuned is the system tuning service on Red Hat Enterprise Linux, and `tuned-adm` is the command-line tool used to activate predefined tuning profiles. The 'throughput-performance' profile optimizes the system for maximum network and disk throughput by disabling power-saving features and tuning kernel parameters.

Answer

powertop --set-profile=throughput-performance

Answer

sysctl -w kernel.throughput=1

Answer

systemctl set-profile throughput-performance

Question 15

A technician needs to create a new group named 'developers' with GID 5000. Which command accomplishes this?

Accepted Answer

groupadd -g 5000 developers. The `groupadd -g 5000 developers` command explicitly sets the GID to 5000 for the new group named 'developers'. The `-g` option specifies the numeric group ID, which is required to meet the technician's exact requirement.

Answer

groupadd -r developers

Answer

useradd -g developers

Answer

groupadd developers