EX200 Deploy, configure, and maintain systems — Timed 20 Questions

Question 1

A system administrator is tasked with configuring a RHEL 9 system to automatically mount an NFS share from 192.168.1.10:/export/data on /mnt/data at boot. Which entry in /etc/fstab is correct?

Accepted Answer

192.168.1.10:/export/data /mnt/data nfs4 defaults 0 0. The /etc/fstab entry for an NFS mount requires the remote server and export path in the format server:/export, followed by the local mount point, the filesystem type (nfs4 for NFSv4), mount options, dump flag, and fsck order. This matches the standard NFS fstab syntax for automatic mounting at boot.

Answer

192.168.1.10 /export/data /mnt/data nfs4 defaults 0 0

Answer

/mnt/data 192.168.1.10:/export/data nfs4 defaults 0 0

Answer

192.168.1.10:/export/data /mnt/data nfs defaults 0 0

Question 2

Which TWO statements are true about systemd services in RHEL 9? (Choose exactly two.)

Accepted Answer

'systemctl list-units --type=service' lists all service units.. 'systemctl list-units --type=service' filters the output to show only service units, which are the primary unit type for managing daemons and background processes. Option C is correct because 'systemctl status' displays the current state of a unit, including whether it is active (running), inactive (stopped), or in another state like failed.

Answer

'systemctl enable' starts the service immediately.

Answer

'systemctl mask' disables a service but allows manual start.

Answer

'systemctl disable' stops the service immediately.

Question 3

Refer to the exhibit. The service 'example.service' is created but fails to start. The administrator runs 'systemctl start example.service' and gets no output, but 'systemctl status example.service' shows 'active (exited)'. What is the most likely cause?

Accepted Answer

The script /usr/local/bin/example.sh exits immediately.. The service unit is configured as `Type=oneshot`, which is designed to run a task that exits after completion. When the script `/usr/local/bin/example.sh` exits immediately (as described in answer choice A), systemd correctly reports the service state as `active (exited)`. The `systemctl start` command produces no output because it successfully executed the script. This is the expected behavior for a oneshot service, not an error.

Answer

The Restart=on-failure directive is misconfigured.

Answer

The network.target dependency is not met.

Answer

The administrator forgot to run systemctl daemon-reload after starting.

Question 4

Refer to the exhibit. The administrator wants to add an additional 5GB to the /mnt/data filesystem. There is no unpartitioned space on /dev/sdb. Which is the correct procedure?

Accepted Answer

Use fdisk to delete and recreate /dev/sdb1 with larger size, run partprobe, then xfs_growfs /mnt/data.. The filesystem on /mnt/data is XFS (as shown in the exhibit), and XFS cannot be shrunk; it can only be grown. Since there is no unpartitioned space on /dev/sdb, the partition itself must be resized. The correct procedure is to delete and recreate the partition with a larger size using fdisk, inform the kernel of the change with partprobe, and then grow the XFS filesystem with xfs_growfs /mnt/data.

Answer

Use resize2fs /dev/sdb1 to expand filesystem.

Answer

Add a new disk, create a physical volume, extend volume group, and extend logical volume.

Answer

Use fdisk to delete and recreate /dev/sdb1 with larger size, then mount.

Question 5

An administrator runs 'df -h' and sees the output above. The /data partition is nearly full. Which command will help identify the largest files in /data?

Accepted Answer

du -sch /data/*. The intended answer D is correct because du -sh /data/* lists per-item sizes. However, option A (du -sch /data/*) also lists per-item sizes (and adds a grand total), so it also helps identify the largest files. The original explanation incorrectly implies A is wrong without justification. The question should be revised to avoid ambiguity, e.g., by changing A to 'du -sh /data' or asking for the command that provides per-item sizes without a total.

Answer

du -sh /data

Answer

du -h --max-depth=1 /data

Question 6

Match each SELinux mode to its behavior.

Accepted Answer

Enforcing: SELinux security policy is enforced.. SELinux has three modes: Enforcing (policy enforced, violations blocked), Permissive (policy not enforced, only warnings logged), and Disabled (SELinux turned off). Common confusions involve swapping behaviors between modes.

Answer

Enforcing: SELinux logs all actions but does not block them.

Answer

Permissive: SELinux enforces the policy and blocks violations.

Answer

Disabled: SELinux warns but does not block.

Question 7

An administrator needs to ensure that a mounted NFS filesystem is not accessible to users without proper Kerberos authentication, even if the NFS server exports with no_root_squash. Which mount options should be used in /etc/fstab?

Accepted Answer

sec=krb5i,soft. All Kerberos-based sec options (krb5, krb5i, krb5p) require valid Kerberos tickets and thus prevent unauthorized access even with no_root_squash. sec=sys does not use Kerberos. The hard/soft and noexec options are unrelated to authentication. To make D the only correct answer, the question should ask for full encryption/confidentiality, not just authentication.

Answer

sec=sys,ro

Question 8

An administrator needs to add a 2GB swap file to a system that already has swap partitions. Which set of commands will create and activate the swap file correctly?

Accepted Answer

fallocate -l 2G /swapfile; mkswap /swapfile; swapon /swapfile. Both options A and C correctly create a 2GB swap file and activate it. Option A uses `fallocate` which pre-allocates space efficiently without writing zeros, while option C uses `dd` to explicitly write zeros, which is also a valid method. The question does not specify efficiency as a criterion, so both are acceptable.

Answer

mkfile 2G /swapfile; mkswap /swapfile; swapon /swapfile

Answer

touch /swapfile; truncate -s 2G /swapfile; mkswap /swapfile; swapon /swapfile

Question 9

Which TWO commands can be used to display available disk space on mounted filesystems in a human-readable format?

Accepted Answer

df -h. The `df -h` command displays disk space usage for mounted filesystems, with the `-h` flag converting sizes into human-readable units (e.g., KB, MB, GB). This directly meets the requirement of showing available disk space on mounted filesystems in a human-readable format. The `du -sh` command shows the total disk usage of a specific directory or file, not available space on filesystems, so it does not satisfy the question's requirement.

Answer

blkid

Answer

ls -lh

Answer

du -sh

Answer

fdisk -l

Question 10

Refer to the exhibit. Which entry is most likely to cause the system to fail to boot if the NFS server is unavailable?

Accepted Answer

The fourth entry (/mnt). The /mnt entry in /etc/fstab is configured with the default mount options, which include the _netdev option being absent. Without _netdev, the system will attempt to mount the NFS filesystem during the boot process before the network is fully operational. If the NFS server is unavailable, the mount will fail, and because the default mount behavior for non-root filesystems in /etc/fstab is to cause a boot failure if the mount fails (unless the 'nofail' option is specified), the system will drop into emergency mode and fail to complete the boot process.

Answer

The third entry (/home)

Answer

The second entry (/boot)

Answer

The first entry (/)

Question 11

An administrator wants to enable disk quotas for users on an XFS filesystem. Which command initializes the quota database?

Accepted Answer

xfs_quota -x -c 'limit -u bsoft=...' /mount. On XFS filesystems, quotas are not stored in a separate database; they are part of the filesystem metadata. To enable quotas, you must mount the filesystem with the uquota (usrquota) or gquota (grpquota) option (e.g., mount -o uquota ...). After mounting with quota support, the xfs_quota command is used to set and manage quota limits. The command 'xfs_quota -x -c 'limit -u bsoft=...' /mount' sets a soft limit for a user, but it does not initialize a quota database. Running this command before the filesystem is mounted with quota options would fail. Thus, the question is flawed because no command initializes an XFS quota database; initialization happens at mount time.

Answer

edquota -u user

Answer

quotacheck -cug /mount

Answer

quotaon /mount

Question 12

Which TWO commands can be used to display the current SELinux mode?

Accepted Answer

sestatus. The `sestatus` command displays the current SELinux mode (enforcing, permissive, or disabled) along with other SELinux status information. The `getenforce` command specifically returns only the current SELinux mode as a string (Enforcing, Permissive, or Disabled). Both are standard tools for checking the SELinux operational state.

Answer

checkmodule

Answer

seinfo

Answer

setenforce

Question 13

An administrator needs to set up an automount point for NFS shares from server nfs.example.com:/exports/backup. The mount point should be /backup and should mount on access. Which configuration is correct?

Accepted Answer

Add to /etc/auto.master: /backup /etc/auto.backup and in /etc/auto.backup: backup -fstype=nfs4 nfs.example.com:/exports/backup. To automount the NFS share at exactly /backup, use a direct map: in /etc/auto.master add '/- /etc/auto.backup', and in /etc/auto.backup add '/backup -fstype=nfs4 nfs.example.com:/exports/backup'. Option C uses an indirect map, placing the export at /backup/backup, contradicting the requirement that the mount point be /backup.

Answer

Install autofs and create /etc/auto.master.d/backup.autofs with the same content

Answer

Use systemd-mount with automount options

Answer

Add an entry to /etc/fstab: nfs.example.com:/exports/backup /backup nfs4 defaults 0 0

Question 14

A system administrator wants to permanently allow incoming HTTP traffic on RHEL 9 using firewalld. Which two commands will achieve this? (Choose two.)

Accepted Answer

firewall-cmd --add-port=80/tcp --permanent. Option B is correct because 'firewall-cmd --add-port=80/tcp --permanent' writes the rule directly into the permanent configuration, and since HTTP listens on TCP port 80, this persistently allows incoming HTTP traffic. Option E is correct because 'firewall-cmd --add-service=http --permanent' adds the predefined http service (TCP port 80) to the permanent configuration, which is the canonical way to allow HTTP persistently. Option D is correct because 'firewall-cmd --add-service=http' adds the service to the runtime configuration and the chained 'firewall-cmd --runtime-to-permanent' then copies the entire runtime configuration into the permanent configuration, achieving persistence. Option A is wrong because 'firewall-cmd --add-service=http' without --permanent only affects the runtime configuration and is lost on reload or reboot. Option C is wrong because 'firewall-cmd --runtime-to-permanent' alone only saves whatever is already in the runtime config; without first adding the http service, no HTTP rule exists to make permanent.

Answer

firewall-cmd --add-service=http

Answer

firewall-cmd --runtime-to-permanent

Question 15

A developer deploys a container using podman with a bind mount to persist web content. They run: podman run -d --name web -v /webdata:/usr/local/apache2/htdocs:Z -p 8080:80 httpd:latest. The container fails to start. The journal shows SELinux denials for the httpd process inside the container trying to read files with context httpd_sys_content_t, while the process runs in container_t domain. The host directory /webdata exists and contains index.html. The administrator checks that the container image is standard. What is the most likely cause of the failure?

Accepted Answer

The podman command should use :z instead of :Z.. The `:Z` flag in the bind mount tells Podman to relabel the host directory with a private SELinux context (`container_file_t`) unique to that container, which prevents other containers from accessing it. However, the SELinux denial shows the httpd process inside the container (running in `container_t` domain) cannot read files labeled `httpd_sys_content_t` (the default label for web content on the host). Using `:z` instead of `:Z` would relabel the directory with the shared context `container_file_t`, allowing the container process to read the files while still enforcing SELinux policy.

Answer

The SELinux context on /webdata is incorrect for container use.

Answer

The /webdata directory does not exist.

Answer

The container image is incompatible with the host SELinux policy.

Question 16

A Red Hat Enterprise Linux 9 server has a new 20 GB block device /dev/vdb. The administrator must configure a persistent swap space on this device that activates automatically at boot. Which sequence of commands will accomplish this?

Accepted Answer

mkswap /dev/vdb ; swapon /dev/vdb ; echo '/dev/vdb swap swap defaults 0 0' >> /etc/fstab. Persistent swap on a block device requires initializing the device with mkswap, activating it with swapon, and adding an fstab entry that specifies the device, swap type, and swap options. This makes systemd generate a swap unit at boot. The other sequences either use non-existent tools, omit required fstab fields, or attempt to mount swap as a filesystem, none of which yield working persistent swap.

Answer

mkswap /dev/vdb ; swapon /dev/vdb ; systemctl enable swap.target

Answer

mkswap /dev/vdb ; mount -t swap /dev/vdb /swap ; echo '/dev/vdb /swap swap defaults 0 0' >> /etc/fstab

Answer

mkfs.swap /dev/vdb ; swapon /dev/vdb ; echo '/dev/vdb swap defaults 0 0' >> /etc/fstab

Question 17

A system administrator needs to ensure that a specific kernel module 'usb_storage' is not loaded automatically during boot on a RHEL 9 system. Which configuration file should be modified to blacklist this module?

Accepted Answer

Add 'blacklist usb_storage' to /etc/modprobe.d/blacklist.conf. On RHEL 9, the recommended way to prevent a kernel module from loading automatically is to add a 'blacklist' directive in a file under /etc/modprobe.d/. The file /etc/modprobe.d/blacklist.conf is a conventional location for such blacklist entries. When modprobe processes this file, it will ignore the specified module during boot and when loading modules manually, effectively preventing usb_storage from being loaded.

Answer

Add 'blacklist usb_storage' to /etc/modules-load.d/usb_storage.conf

Answer

Add 'install usb_storage /bin/false' to /etc/sysconfig/modules/

Answer

Add 'blacklist usb_storage' to /etc/init.d/rc.local

Question 18

A Red Hat Enterprise Linux 9 system has a logical volume 'lv_data' in the volume group 'vg_data' that needs to be resized from 10G to 15G. The underlying physical volumes have enough free space. Which sequence of commands correctly resizes the logical volume and the ext4 filesystem?

Accepted Answer

lvextend -L 15G /dev/vg_data/lv_data; resize2fs /dev/vg_data/lv_data. To resize an ext4 filesystem on a logical volume, you must first extend the logical volume with `lvextend -L 15G /dev/vg_data/lv_data` to allocate the additional 5G from the volume group, then use `resize2fs /dev/vg_data/lv_data` to grow the filesystem to fill the enlarged block device. This order ensures the underlying block device has sufficient capacity before the filesystem resize operation.

Answer

resize2fs /dev/vg_data/lv_data; lvextend -L 15G /dev/vg_data/lv_data

Answer

lvextend -L 15G /dev/vg_data/lv_data; xfs_growfs /dev/vg_data/lv_data

Answer

lvreduce -L 15G /dev/vg_data/lv_data; resize2fs /dev/vg_data/lv_data

Question 19

A technician needs to configure a static IPv4 address on a RHEL 9 network interface 'enp1s0' using NetworkManager. Which command should be used to set the IP address?

Accepted Answer

nmcli connection modify enp1s0 ipv4.addresses 192.168.1.100/24. `nmcli connection modify enp1s0 ipv4.addresses 192.168.1.100/24` is the proper NetworkManager command to set a static IPv4 address on a RHEL 9 interface. This command modifies the connection profile for 'enp1s0' by setting the `ipv4.addresses` property to the specified address and prefix length, which is the standard method for persistent static IP configuration via NetworkManager.

Answer

nmtui edit enp1s0 --ipv4 192.168.1.100/24

Answer

ip addr add 192.168.1.100/24 dev enp1s0

Answer

ifconfig enp1s0 192.168.1.100 netmask 255.255.255.0

Question 20

A system administrator notices that a RHEL 9 server's /var/log/messages is filling up the /var partition. The administrator wants to ensure log rotation runs daily and keeps 4 weeks of logs. Which configuration file should be modified?

Accepted Answer

/etc/logrotate.d/syslog. /etc/logrotate.d/syslog is the configuration file that controls log rotation for system log files such as /var/log/messages. By modifying this file, the administrator can set the rotation frequency to daily and specify the number of weeks (e.g., rotate 28 for 4 weeks) to retain logs, directly addressing the requirement.

Answer

/etc/systemd/journald.conf

Answer

/etc/rsyslog.conf

Answer

/etc/cron.daily/logrotate