EX200 Operate running systems — 10 Questions

Question 1

A system administrator needs to ensure that a specific process continues to run even if it crashes. The process is started by a systemd service unit. Which approach ensures the process is automatically restarted by systemd, with a delay of 30 seconds after each crash, and does not count restarts towards the failure limit?

Accepted Answer

Restart=always, RestartSec=30, StartLimitIntervalSec=0, StartLimitBurst=0. Option A is correct because it combines `Restart=always` to restart the process unconditionally, `RestartSec=30` to introduce a 30-second delay between restarts, and `StartLimitIntervalSec=0` with `StartLimitBurst=0` to disable the start rate limiting entirely. This ensures the service restarts indefinitely after each crash without ever being considered as having failed, which matches the requirement exactly.

Answer

Restart=on-failure and RestartSec=30

Answer

Restart=always, RestartSec=30, StartLimitIntervalSec=0

Answer

Restart=always and RestartSec=30

Question 2

Which TWO statements about systemd journal and rsyslog are correct?

Accepted Answer

The journal stores logs in a structured binary format, allowing filtering by fields like _UID or _SYSTEMD_UNIT.. Option D is correct because the systemd journal stores log data in a structured binary format (using the journald protocol), which allows filtering by specific fields such as _UID, _SYSTEMD_UNIT, or _COMM. This enables precise queries via journalctl, unlike plain-text log files.

Answer

rsyslog reads log messages directly from the journal files in /var/log/journal.

Answer

The command 'journalctl --list-boots' lists only the current boot's journal entries.

Answer

The command 'journalctl -u sshd.service' outputs the same as 'tail -f /var/log/messages' for SSH logs.

Question 3

Refer to the exhibit. A security analyst reviews the journal output for sshd.service. Which of the following best describes the observed pattern of events?

Accepted Answer

The system experienced a brute-force attack on the root account originating from IP 192.168.1.100, which eventually succeeded.. The journal output shows repeated failed authentication attempts for the root user from IP 192.168.1.100, followed by a successful login. This pattern is characteristic of a brute-force attack where an attacker tries many passwords until one works. The final 'Accepted password for root' line confirms the attack succeeded, making D correct.

Answer

The system is under a denial-of-service attack because the connections are being closed before authentication.

Answer

The SSH service is malfunctioning and dropping connections due to a configuration error.

Answer

Multiple hosts are attempting to connect to the SSH service simultaneously, causing connection errors.

Question 4

Arrange the steps to configure a static IPv4 route in Red Hat Enterprise Linux.

Question 5

Order the steps to configure a new user 'jdoe' with UID 2000, home directory /home/jdoe, and secondary group 'staff'.

Question 6

Match each file system type to its description.

Question 7

Match each user/group management command to its function.

Question 8

A critical service must restart automatically after a crash. Which systemd directive should be added to the [Service] section of the service unit file?

Accepted Answer

Restart=always. Option A (Restart=always) is correct because it configures the service to restart automatically on failure. Option B (OnFailure=) invokes another unit on failure, not restart. Option C (Wants=) and Option D (Requires=) are dependency directives.

Answer

OnFailure=

Answer

Requires=

Answer

Wants=

Question 9

Which command checks if a specific systemd service is currently running?

Accepted Answer

systemctl is-active. Option B (systemctl is-active) returns active or inactive for a service. Option A (systemctl status) shows more information but also indicates state. Option C (systemctl list-units) lists all units. Option D (systemctl show) displays unit properties.

Answer

systemctl status

Answer

systemctl list-units

Answer

systemctl show

Question 10

An ext4 filesystem on a logical volume has been extended with lvextend, but df -h still shows the old size. Which command must be run to make the filesystem aware of the new size?

Accepted Answer

resize2fs. Option D (resize2fs) is correct for ext4 filesystems. Option A (xfs_growfs) is for XFS. Option B (lvextend -r) would have performed the resize automatically if used initially. Option C (fsadm resize) is alternative but less common.

Answer

lvextend -r

Answer

fsadm resize

Answer

xfs_growfs