EX200 Multiple Select — 60 Questions

Question 1

Which TWO methods are considered best practices for securing SSH access to a server? (Select exactly two.)

Accepted Answer

Disable root login by setting PermitRootLogin no.. Disabling root login by setting `PermitRootLogin no` in `/etc/ssh/sshd_config` prevents direct SSH access as the root user, forcing administrators to log in as a regular user and then use `sudo` or `su` to escalate privileges. This reduces the attack surface by eliminating a high-value target for brute-force attacks and ensures all actions are auditable via the regular user's session.

Answer

Use only password authentication for simplicity.

Answer

Change the default SSH port to a high-numbered port.

Answer

Allow SSH access for all users in the system.

Question 2

Which THREE statements about container storage in podman are correct? (Choose THREE.)

Accepted Answer

The --storage-opt flag can be used to set options for the container's writable layer.. The `--storage-opt` flag in Podman allows you to pass options directly to the container's storage driver, such as setting the size of the container's writable layer (e.g., `--storage-opt size=10G`). This is a feature of the container storage stack (containers/storage) that Podman uses, enabling fine-grained control over the writable layer's behavior without affecting the image layers.

Answer

Podman volumes can only be managed by podman volume commands, not manually.

Answer

Rootless containers cannot use the overlay filesystem driver.

Question 3

Which two are required to create a logical volume? (Choose two.)

Accepted Answer

Physical volume. A physical volume (PV) is required because it is the underlying storage device (e.g., a disk or partition) that LVM uses as a building block. Without a PV, there is no raw storage to allocate to a volume group. The volume group (VG) is then created from one or more PVs, and logical volumes (LVs) are carved from the VG. Both are mandatory steps in the LVM workflow.

Answer

Mount point

Answer

Filesystem

Answer

Partition

Question 4

Which TWO commands can be used to check the UUID of a filesystem on /dev/sda1?

Accepted Answer

lsblk -o UUID /dev/sda1. The `blkid` command directly queries the UUID of a block device from the libblkid cache or by reading the filesystem superblock, and `lsblk -o UUID` filters the lsblk output to show only the UUID column for the specified device. Both commands reliably retrieve the UUID of /dev/sda1.

Answer

e2label /dev/sda1

Answer

findmnt /dev/sda1

Answer

file -s /dev/sda1

Question 5

Which two commands can be used to create a new partition on a disk without erasing existing partitions? (Choose two.)

Accepted Answer

fdisk. The `fdisk` command is a disk partitioning tool that allows you to create, delete, and modify partitions on a disk without erasing existing partitions, as long as there is unallocated space. It operates on the MBR or GPT partition table and writes changes only when explicitly saved, preserving existing partition entries.

Answer

mkswap

Answer

dd

Answer

wipefs

Question 6

Which TWO LVM commands can be used to reduce the size of a logical volume?

Accepted Answer

lvresize. Both `lvresize` and `lvreduce` can reduce the size of a logical volume. `lvresize` is the general-purpose command for resizing LVs, and when used with the `-L` or `--size` option to specify a smaller size, it shrinks the volume. `lvreduce` is a dedicated command that specifically reduces the size of a logical volume, offering the same functionality as `lvresize --size` but with a more explicit name. Both commands require the filesystem to be shrunk first (if it contains data) using tools like `resize2fs` or `xfs_growfs` (though XFS cannot be shrunk).

Answer

lvchange

Answer

lvdisplay

Answer

lvextend

Question 7

Which THREE of the following are valid and recommended practices when writing shell scripts for RHEL?

Accepted Answer

Using 'local' keyword for variable declarations inside functions.. The 'local' keyword restricts a variable's scope to the function where it is declared, preventing unintended side effects on global variables. This is a recommended practice in RHEL shell scripting to maintain modularity and avoid namespace pollution.

Answer

Using 'set -e' to exit on non-zero exit codes.

Answer

Using the 'source' command instead of '.' for readability.

Question 8

Which TWO commands can be used to display the contents of a compressed log file without decompressing it first?

Accepted Answer

bzless /var/log/messages.bz2. `bzless` is a utility specifically designed to view bzip2-compressed files without decompressing them first. It decompresses the file on the fly and pipes the output to a pager, allowing you to scroll through the content. Similarly, option B is correct because `zcat` reads a gzip-compressed file and writes the decompressed data to standard output, effectively displaying the contents without permanently decompressing the file.

Answer

grep 'error' /var/log/messages.gz

Answer

vim /var/log/messages.gz

Answer

less /var/log/messages.gz

Question 9

A system administrator needs to configure a firewall using firewalld to allow incoming HTTPS traffic and deny incoming SSH traffic from a specific source IP 192.168.1.100. Which two commands should be run? (Choose two.)

Accepted Answer

firewall-cmd --add-service=https --permanent. `firewall-cmd --add-service=https --permanent` adds the HTTPS service (TCP port 443) to the permanent firewall configuration, which is required to allow incoming HTTPS traffic persistently across reboots. The `--permanent` flag ensures the rule survives a reload or restart, and the `--add-service` option uses predefined service definitions from firewalld to simplify rule creation.

Answer

firewall-cmd --runtime-to-permanent

Answer

firewall-cmd --add-rich-rule='rule family=ipv4 source address=192.168.1.100 service name=ssh reject' --permanent

Answer

firewall-cmd --add-service=http --permanent

Question 10

Which three of the following actions are required when adding a new swap device to the system? (Choose three.)

Accepted Answer

Use mkswap to set up the swap signature. `mkswap` writes a swap signature (UUID and label) to the device, which is required before the kernel can use it as swap space. Without this signature, the device is not recognized as a swap area.

Answer

Mount the device to a swap directory

Answer

Create a filesystem using mkfs

Question 11

Which TWO statements are true regarding container images and containers in Podman?

Accepted Answer

A container is a running or stopped instance of an image with a writable layer.. A container in Podman is an instantiation of an image that adds a writable layer on top of the image's read-only layers. This writable layer persists changes made during the container's runtime, even after the container is stopped, unless explicitly removed.

Answer

A container can only be created from an image that is stored locally.

Answer

When a container is stopped, its writable layer is automatically removed.

Answer

A container image must be built using a Dockerfile.

Question 12

Which TWO statements about the /etc/shadow file are true? (Select exactly two.)

Accepted Answer

Contains hashed passwords for local users.. The /etc/shadow file stores hashed user passwords using algorithms like SHA-512 or yescrypt, as defined by the pam_unix module. It also contains password aging fields (e.g., minimum days, maximum days, warning period) that enforce password expiration policies. These two functions make options A and E correct.

Answer

Contains the user's UID.

Answer

Is used to store encrypted group passwords.

Answer

Is readable by all users.

Question 13

An administrator needs to configure a static IP address on an interface that will persist across reboots using NetworkManager. Which TWO commands or files can be used to achieve this?

Accepted Answer

nmcli con mod eth0 ipv4.addresses 192.168.1.10/24. The `nmcli con mod` command modifies the NetworkManager connection profile for the interface, setting a static IPv4 address that is stored persistently in the connection configuration. Option D is correct because editing the `/etc/sysconfig/network-scripts/ifcfg-eth0` file directly defines the static IP address in the ifcfg format, which NetworkManager reads on boot to apply persistent settings.

Answer

systemctl restart network

Answer

nmcli con up eth0

Answer

ip addr add 192.168.1.10/24 dev eth0

Question 14

Which TWO are correct ways to check the SELinux context of a file named 'test.txt'? (Choose exactly two.)

Accepted Answer

ls -Z test.txt. `ls -Z` displays the SELinux security context of files, including user, role, type, and sensitivity level. The `-Z` option is specifically designed to show SELinux context information for files and processes.

Answer

ls -l test.txt

Answer

sestatus

Answer

getenforce

Question 15

Which TWO commands can be used to view the current disk usage of a filesystem?

Accepted Answer

du. The `du` command (disk usage) estimates file and directory space usage, allowing you to view disk usage at the file or directory level. The `df` command (disk free) reports the amount of available and used disk space on mounted filesystems, showing overall filesystem usage. Both are standard Linux tools for examining disk consumption.

Answer

blkid

Answer

fdisk

Answer

lsblk

Question 16

Which three network configuration methods are valid in RHEL 8/9?

Accepted Answer

/etc/sysconfig/network-scripts/ifcfg-* files. In RHEL 8/9, the traditional `/etc/sysconfig/network-scripts/ifcfg-*` files are still supported for backward compatibility, though NetworkManager is the default service. These files define interface configurations using variables like `DEVICE`, `BOOTPROTO`, and `ONBOOT`, and are read by the `ifup`/`ifdown` scripts or NetworkManager when configured to use them. This method remains valid for static or DHCP-based network setup without requiring a GUI.

Answer

system-config-network

Answer

ifconfig

Question 17

Which TWO commands can be used to create a new directory that will serve as a mount point?

Accepted Answer

install -d /mnt/newmount. `install -d /mnt/newmount` creates the directory `/mnt/newmount` if it does not already exist, setting it up as a mount point. Option D is correct because `mkdir /mnt/newmount` is the standard command to create a directory, which can then be used as a mount point for a filesystem.

Answer

touch /mnt/newmount

Answer

ln -s /mnt /mnt/newmount

Answer

ln /mnt /mnt/newmount

Question 18

Which THREE options to podman run can be used to publish container ports to the host? (Select exactly three.)

Accepted Answer

-p. (-p) is correct because it is the short form of --publish, which maps a container port to a host port. Option B (--publish) is the long form of -p and explicitly publishes container ports to the host. Option D (-P) is correct because it publishes all exposed container ports to random high-numbered ports on the host (typically in the range 32768-60999).

Answer

--expose

Answer

--port

Question 19

Which TWO commands can be used to add a user to a secondary group without removing existing supplementary group memberships? (Choose exactly 2)

Accepted Answer

usermod -aG group user. `usermod -aG` appends the user to the specified supplementary group(s) without affecting any existing supplementary group memberships. The `-a` flag (append) must be used with `-G` to avoid overwriting the current list of supplementary groups. This is the standard method in Red Hat Enterprise Linux for adding a user to an additional group while preserving all other group memberships.

Answer

usermod -AG group user

Answer

adduser user group

Answer

groupadd -a user group

Question 20

Which TWO commands are valid for resizing an XFS file system? (Choose exactly two.)

Accepted Answer

xfs_growfs /mnt. `xfs_growfs` is the dedicated command for resizing (growing) an XFS file system while it is mounted. It expands the file system to fill the available space in the underlying device or logical volume, making it the primary tool for XFS resizing operations.

Answer

xfs_admin -L /mnt

Answer

resize2fs /dev/sda1

Answer

xfs_repair /dev/sda1