EX200 Hard Questions — 25 Difficult Questions

Question 1

A system administrator needs to ensure that a specific process continues to run even if it crashes. The process is started by a systemd service unit. Which approach ensures the process is automatically restarted by systemd, with a delay of 30 seconds after each crash, and does not count restarts towards the failure limit?

Accepted Answer

Restart=always, RestartSec=30, StartLimitIntervalSec=0, StartLimitBurst=0. Option A is correct because it combines `Restart=always` to restart the process unconditionally, `RestartSec=30` to introduce a 30-second delay between restarts, and `StartLimitIntervalSec=0` with `StartLimitBurst=0` to disable the start rate limiting entirely. This ensures the service restarts indefinitely after each crash without ever being considered as having failed, which matches the requirement exactly.

Answer

Restart=on-failure and RestartSec=30

Answer

Restart=always, RestartSec=30, StartLimitIntervalSec=0

Answer

Restart=always and RestartSec=30

Question 2

Refer to the exhibit. A web server runs as user 'apache'. The directory /var/www/html is owned by root:root with permissions 755. The administrator wants to allow the user 'webuser' to upload files to /var/www/html via SFTP. Which step is necessary to achieve this?

Accepted Answer

Change group ownership of /var/www/html to a group that includes webuser and add group write permission. Option B is correct because the directory /var/www/html is owned by root:root with permissions 755, meaning only root can write. To allow webuser to upload files via SFTP, the directory needs group write permission. Changing the group ownership to a group that includes webuser and adding group write permission (e.g., chgrp webgroup /var/www/html && chmod g+w /var/www/html) grants the necessary write access without altering ownership or security contexts.

Answer

Change webuser's shell to /bin/bash to allow SFTP login

Answer

Change the SELinux context of /var/www/html to httpd_sys_rw_content_t

Answer

Set an ACL on /var/www/html to grant webuser write access

Question 3

A backup script uses tar to create an archive, but the administrator wants to exclude the /tmp directory from the backup. Which tar option should be added?

Accepted Answer

--exclude=/tmp. Option A is correct because the `--exclude=PATTERN` option in tar tells the command to skip files or directories matching the given pattern. By specifying `--exclude=/tmp`, the tar archive will omit the /tmp directory and all its contents, which is exactly what the administrator needs for the backup script.

Answer

--ignore-failed-read

Answer

--exclude-from=/tmp

Answer

-X /tmp

Question 4

You are a system administrator for a company running Red Hat Enterprise Linux 8. A developer reports that a script which runs daily at 2 AM is failing. The script is located at /opt/scripts/backup.sh and is owned by root. The developer says the script runs fine when executed manually with './backup.sh' from the /opt/scripts directory. The script is scheduled via a root crontab entry: '0 2 * * * /opt/scripts/backup.sh'. However, the script fails because it cannot find a configuration file located at './config.ini'. What is the most likely cause and the correct solution?

Accepted Answer

Cron uses a different PATH. Modify the script to use absolute paths for all files, including config.ini.. The script fails because cron jobs run with a minimal environment, including a restricted PATH that typically does not include the script's directory. When the script uses a relative path like './config.ini', the cron job's working directory is not /opt/scripts (it defaults to the user's home directory, /root for root cron), so the file is not found. The correct solution is to modify the script to use absolute paths, such as /opt/scripts/config.ini, ensuring it works regardless of the cron environment.

Answer

The configuration file is missing. Copy config.ini to /root.

Answer

The cron job runs as a different user. Change the cron job to run as the developer's user.

Answer

The script is not executable. Run chmod +x /opt/scripts/backup.sh.

Question 5

A server has a software RAID 5 array /dev/md0. One of its disks fails. The administrator wants to replace it without rebooting. Which command should be used to mark the disk as failed?

Accepted Answer

mdadm --fail /dev/md0 /dev/sdb. The correct command to mark a disk as failed in a software RAID array without rebooting is `mdadm --fail /dev/md0 /dev/sdb`. This command tells the md driver to mark the specified disk as faulty, which triggers the RAID 5 array to degrade and allows the failed disk to be removed and replaced while the system remains online.

Answer

mdadm --fault /dev/md0 /dev/sdb

Answer

echo faulty > /sys/block/md0/md/dev-sdb/state

Answer

mdadm --set-faulty /dev/md0 /dev/sdb

Question 6

Which THREE options are valid when creating a new partition with the 'parted' command? (Choose three.)

Accepted Answer

Setting the partition's bootable flag. Option B is correct because the 'parted' command can set the bootable flag on a partition using the 'set' command (e.g., 'set 1 boot on'). This flag is used by legacy BIOS bootloaders to identify the active partition, and it is a standard operation in MBR and GPT partition tables.

Answer

Setting the partition's UUID

Answer

Mounting the partition to a directory

Question 7

An administrator needs to ensure that a specific LVM logical volume is automatically mounted at boot with the 'noexec' option. Which configuration file and entry should be used?

Accepted Answer

/etc/fstab: /dev/vg/lv /mnt ext4 defaults,noexec 0 0. Option C is correct because /etc/fstab is the standard configuration file for defining filesystem mount points and options that are applied automatically at boot. The entry specifies the logical volume device, mount point, filesystem type, and mount options including 'noexec' to prevent execution of binaries on that filesystem. The 'defaults' keyword ensures standard mount behavior is applied before the 'noexec' option overrides the exec permission.

Answer

/etc/fstab: /dev/vg/lv /mnt ext4 noexec 0 0

Answer

/etc/rc.d/rc.local: mount /dev/vg/lv /mnt -o noexec

Answer

/etc/rc.local: mount -o noexec /dev/vg/lv /mnt

Question 8

A Red Hat Enterprise Linux 9 system has a logical volume 'lv_data' in the volume group 'vg_data' that needs to be resized from 10G to 15G. The underlying physical volumes have enough free space. Which sequence of commands correctly resizes the logical volume and the ext4 filesystem?

Accepted Answer

lvextend -L 15G /dev/vg_data/lv_data; resize2fs /dev/vg_data/lv_data. Option A is correct because to resize an ext4 filesystem on a logical volume, you must first extend the logical volume with `lvextend -L 15G /dev/vg_data/lv_data` to allocate the additional 5G from the volume group, then use `resize2fs /dev/vg_data/lv_data` to grow the filesystem to fill the enlarged block device. This order ensures the underlying block device has sufficient capacity before the filesystem resize operation.

Answer

resize2fs /dev/vg_data/lv_data; lvextend -L 15G /dev/vg_data/lv_data

Answer

lvextend -L 15G /dev/vg_data/lv_data; xfs_growfs /dev/vg_data/lv_data

Answer

lvreduce -L 15G /dev/vg_data/lv_data; resize2fs /dev/vg_data/lv_data

Question 9

Which THREE factors determine whether a local user can SSH into a Red Hat Enterprise Linux 9 system? (Choose three.)

Accepted Answer

The user's shell is listed in /etc/shells.. Option C is correct because SSHd validates that the user's login shell is listed in /etc/shells before allowing authentication. If the shell is not present in /etc/shells (e.g., /sbin/nologin or a custom script), SSHd will deny the connection, even if the user has valid credentials. This check is controlled by the 'AllowUsers' and 'DenyUsers' directives but is a fundamental security measure to prevent users with non-standard shells from gaining interactive access.

Answer

The /etc/nologin file exists.

Answer

The user has sudo privileges.

Question 10

A server has a requirement that all users in the 'finance' group must have a password aging policy that forces password change every 90 days. Which approach best achieves this for existing users?

Accepted Answer

Write a script to run 'chage -M 90' for each user in the finance group. Option D is correct because `chage -M 90` sets the maximum password age for a specific user, and by scripting it to apply to all members of the 'finance' group, you directly enforce the 90-day policy on existing users. This approach works regardless of the default settings in `/etc/login.defs`, which only affect new users, and avoids the manual and error-prone editing of `/etc/shadow`.

Answer

Set PASS_MAX_DAYS 90 in /etc/login.defs

Answer

Edit /etc/shadow and change the fifth field for all users

Answer

Configure pam_pwquality.so to enforce password age

Question 11

Which THREE of the following practices are recommended when creating simple shell scripts in a Red Hat Enterprise Linux environment to ensure reliability, security, and maintainability?

Accepted Answer

Quote variables when used in commands, e.g., "$file" instead of $file.. Option B is correct because quoting variables (e.g., "$file") prevents word splitting and glob expansion, which can cause commands to operate on unexpected arguments or filenames with spaces. This is a fundamental shell scripting best practice that directly improves reliability and security by preserving the intended value of the variable.

Answer

Use #!/bin/sh for compatibility, even if bash-specific features are needed.

Answer

Always run scripts by invoking the interpreter directly (e.g., bash script.sh) instead of making them executable.

Question 12

Which THREE actions are required to enable a non-root user to run containers using Podman on Red Hat Enterprise Linux 8?

Accepted Answer

Ensure the user has a running systemd user instance (loginctl enable-linger).. Option A is correct because `loginctl enable-linger` ensures that the user's systemd user instance starts at boot and remains running after the user logs out. This is required for Podman to manage containers using systemd user services, such as auto-starting containers with `podman generate systemd`.

Answer

Add the user to the 'docker' group to access the Docker socket.

Answer

Grant the user sudo privileges to run podman commands.

Question 13

A container running a database service needs to persist data across restarts. The administrator decides to use a named volume. Which command creates a named volume and mounts it correctly?

Accepted Answer

podman volume create dbdata && podman run -v dbdata:/var/lib/mysql mydb. Option B is correct because it first creates a named volume with `podman volume create dbdata`, then mounts that named volume to the container's `/var/lib/mysql` directory using the `-v` flag. Named volumes are managed by Podman and persist data independently of the container lifecycle, ensuring data survives container restarts or removal.

Answer

podman run -v /var/lib/mysql:/var/lib/mysql mydb

Answer

podman run --mount type=bind,src=dbdata,dst=/var/lib/mysql mydb

Answer

podman run --mount type=tmpfs,dst=/var/lib/mysql mydb

Question 14

During a security audit, an administrator needs to list all TCP ports on which the system is listening, showing only the port numbers and the associated process names. Which command best achieves this?

Accepted Answer

sudo ss -tlnp. Option C is correct because `sudo ss -tlnp` lists TCP listening sockets with numeric port numbers and process names. The `-t` flag filters for TCP, `-l` shows only listening sockets, `-n` displays numeric addresses/ports (avoiding DNS resolution), and `-p` reveals the process name. This command requires root privileges to see process information, hence `sudo`.

Answer

netstat -tulpn

Answer

nmap -sT localhost

Answer

lsof -i TCP:1-65535

Question 15

Which THREE commands can be used to check the disk space usage of the /home partition?

Accepted Answer

df -h /home. Option A is correct because `df -h /home` displays the disk space usage of the /home filesystem in human-readable format (e.g., GB, MB). The `df` command reports the total, used, and available space for mounted filesystems, making it the standard tool for checking partition-level disk usage.

Answer

fdisk -l /dev/sda

Answer

parted /dev/sda print

Question 16

An administrator suspects a disk failure in /dev/md0. Which command would be used to simulate a failure on /dev/sdb and then remove it from the array?

Accepted Answer

mdadm /dev/md0 -f /dev/sdb -r /dev/sdb. Option C is correct because the `mdadm` command with the `-f` (fail) and `-r` (remove) flags in a single command line first marks /dev/sdb as faulty in the /dev/md0 array, then immediately removes it. This is the standard syntax for simulating a failure and removing the disk in one step, as tested in the EX200 exam.

Answer

mdadm --manage /dev/md0 --fail /dev/sdb --remove /dev/sdc

Answer

mdadm --fail /dev/md0 /dev/sdb; mdadm --remove /dev/md0 /dev/sda

Answer

mdadm --manage /dev/md0 --fault /dev/sdb --remove /dev/sdb

Question 17

A system has two 500GB disks in a RAID1 (mirror) using mdadm. One disk fails. After replacement, what is the correct procedure to restore redundancy?

Accepted Answer

Use sfdisk to copy partition table from /dev/sda to /dev/sdb, then 'mdadm --manage /dev/md0 --add /dev/sdb1'. Option D is correct because when replacing a failed disk in a RAID1 array managed by mdadm, the new disk must have a partition table that matches the surviving disk. Using sfdisk to copy the partition table from /dev/sda to /dev/sdb ensures that the partition layout (e.g., partition type 0xFD for Linux RAID autodetect) is identical, which is required before adding the partition (e.g., /dev/sdb1) to the array with mdadm --manage --add. Simply adding the raw disk without a proper partition table would fail because mdadm expects a partition with the correct RAID superblock and partition type.

Answer

Run 'mdadm --manage /dev/md0 --add /dev/sdb'

Answer

Remove the failed disk with 'mdadm /dev/md0 --fail /dev/sdb1' then add new.

Answer

Run 'mdadm --assemble --scan' to rebuild the array automatically.

Question 18

A system administrator notices that a RHEL 9 server's /var/log/messages is filling up the /var partition. The administrator wants to ensure log rotation runs daily and keeps 4 weeks of logs. Which configuration file should be modified?

Accepted Answer

/etc/logrotate.d/syslog. Option B is correct because /etc/logrotate.d/syslog is the configuration file that controls log rotation for system log files such as /var/log/messages. By modifying this file, the administrator can set the rotation frequency to daily and specify the number of weeks (e.g., rotate 28 for 4 weeks) to retain logs, directly addressing the requirement.

Answer

/etc/systemd/journald.conf

Answer

/etc/rsyslog.conf

Answer

/etc/cron.daily/logrotate

Question 19

A RHEL 9 system has a second disk /dev/sdb that needs to be partitioned with a single partition using all space, formatted with XFS, and mounted persistently at /data. The administrator uses fdisk to create the partition /dev/sdb1. Which filesystem creation command should be used?

Accepted Answer

mkfs.xfs /dev/sdb1. The correct command is mkfs.xfs /dev/sdb1 because the question specifies that the partition must be formatted with XFS. The mkfs.xfs command is the dedicated tool for creating an XFS filesystem on a block device. It directly invokes the mkfs.xfs utility, which writes the XFS superblock and metadata structures to the partition.

Answer

mke2fs /dev/sdb1

Answer

mkfs -t ext4 /dev/sdb1

Answer

mkfs.ext4 /dev/sdb1

Question 20

Which THREE are valid methods to configure network bonding in RHEL 9? (Choose exactly three.)

Accepted Answer

Using a configuration file in /etc/NetworkManager/system-connections/.. Option A is correct because in RHEL 9, NetworkManager stores connection profiles in `/etc/NetworkManager/system-connections/`. You can manually create a bond configuration file in this directory with the proper key-value pairs (e.g., `type=bond`, `bond.options=mode=1,miimon=100`), and NetworkManager will read it on restart or reload. This is a valid method for configuring network bonding.

Answer

Using the teamd service.

Answer

Editing /etc/sysconfig/network-scripts/ifcfg-bond0 directly.