EX200 Operate running systems Practice Test 1 — 15 Questions

Question 1

A system administrator needs to ensure that a specific process continues to run even if it crashes. The process is started by a systemd service unit. Which approach ensures the process is automatically restarted by systemd, with a delay of 30 seconds after each crash, and does not count restarts towards the failure limit?

Accepted Answer

Restart=always, RestartSec=30, StartLimitIntervalSec=0, StartLimitBurst=0. Option A is correct because it combines `Restart=always` to restart the process unconditionally, `RestartSec=30` to introduce a 30-second delay between restarts, and `StartLimitIntervalSec=0` with `StartLimitBurst=0` to disable the start rate limiting entirely. This ensures the service restarts indefinitely after each crash without ever being considered as having failed, which matches the requirement exactly.

Answer

Restart=on-failure and RestartSec=30

Answer

Restart=always, RestartSec=30, StartLimitIntervalSec=0

Answer

Restart=always and RestartSec=30

Question 2

Which TWO statements about systemd journal and rsyslog are correct?

Accepted Answer

The journal stores logs in a structured binary format, allowing filtering by fields like _UID or _SYSTEMD_UNIT.. Option D is correct because the systemd journal stores log data in a structured binary format (using the journald protocol), which allows filtering by specific fields such as _UID, _SYSTEMD_UNIT, or _COMM. This enables precise queries via journalctl, unlike plain-text log files.

Answer

rsyslog reads log messages directly from the journal files in /var/log/journal.

Answer

The command 'journalctl --list-boots' lists only the current boot's journal entries.

Answer

The command 'journalctl -u sshd.service' outputs the same as 'tail -f /var/log/messages' for SSH logs.

Question 3

Refer to the exhibit. A security analyst reviews the journal output for sshd.service. Which of the following best describes the observed pattern of events?

Accepted Answer

The system experienced a brute-force attack on the root account originating from IP 192.168.1.100, which eventually succeeded.. The journal output shows repeated failed authentication attempts for the root user from IP 192.168.1.100, followed by a successful login. This pattern is characteristic of a brute-force attack where an attacker tries many passwords until one works. The final 'Accepted password for root' line confirms the attack succeeded, making D correct.

Answer

The system is under a denial-of-service attack because the connections are being closed before authentication.

Answer

The SSH service is malfunctioning and dropping connections due to a configuration error.

Answer

Multiple hosts are attempting to connect to the SSH service simultaneously, causing connection errors.

Question 4

Arrange the steps to configure a static IPv4 route in Red Hat Enterprise Linux.

Question 5

Order the steps to configure a new user 'jdoe' with UID 2000, home directory /home/jdoe, and secondary group 'staff'.

Question 6

Match each file system type to its description.

Question 7

Match each user/group management command to its function.

Question 8

A critical service must restart automatically after a crash. Which systemd directive should be added to the [Service] section of the service unit file?

Accepted Answer

Restart=always. Option A (Restart=always) is correct because it configures the service to restart automatically on failure. Option B (OnFailure=) invokes another unit on failure, not restart. Option C (Wants=) and Option D (Requires=) are dependency directives.

Answer

OnFailure=

Answer

Requires=

Answer

Wants=

Question 9

Which command checks if a specific systemd service is currently running?

Accepted Answer

systemctl is-active. Option B (systemctl is-active) returns active or inactive for a service. Option A (systemctl status) shows more information but also indicates state. Option C (systemctl list-units) lists all units. Option D (systemctl show) displays unit properties.

Answer

systemctl status

Answer

systemctl list-units

Answer

systemctl show

Question 10

An ext4 filesystem on a logical volume has been extended with lvextend, but df -h still shows the old size. Which command must be run to make the filesystem aware of the new size?

Accepted Answer

resize2fs. Option D (resize2fs) is correct for ext4 filesystems. Option A (xfs_growfs) is for XFS. Option B (lvextend -r) would have performed the resize automatically if used initially. Option C (fsadm resize) is alternative but less common.

Answer

lvextend -r

Answer

fsadm resize

Answer

xfs_growfs

Question 11

A security policy requires user passwords to expire 60 days after last change. Which command sets this for user 'jdoe'?

Accepted Answer

chage -M 60 jdoe. Option C (chage -M 60 jdoe) sets the maximum number of days between password changes. Option A (passwd -x 60 jdoe) is also valid but legacy; chage is preferred in RHCSA. Option B (usermod -f) sets inactivity period. Option D (chage -m) sets minimum days.

Answer

usermod -f 60 jdoe

Answer

passwd -x 60 jdoe

Answer

chage -m 60 jdoe

Question 12

Which systemctl command configures a service to start automatically at boot without starting it now?

Accepted Answer

systemctl enable service. Option B (systemctl enable service) creates the necessary symlinks to start at boot. Option A starts it immediately. Option C reenables. Option D sets default target.

Answer

systemctl set-default service

Answer

systemctl start service

Answer

systemctl reenable service

Question 13

After a system crash, an administrator needs to review logs from the previous boot. Which command shows only logs from the boot before the current one?

Accepted Answer

journalctl -b -1. Option A (journalctl -b -1) shows logs from the previous boot. Option B shows current boot. Option C uses dmesg incorrectly. Option D shows only the current boot log.

Answer

dmesg -b -1

Answer

cat /var/log/boot.log

Answer

journalctl -b 0

Question 14

An administrator needs to combine two physical network interfaces into a single logical interface for redundancy. Which RHEL tool is recommended to configure this in RHEL 8/9?

Accepted Answer

nmcli. Option D (nmcli) is the preferred command-line tool for network management and can configure bonding/teaming. Option A (ip link) can set bonding but is lower-level. Option B (teamd) is used for teaming but nmcli is more common. Option C (brctl) is for bridging.

Answer

teamd

Answer

ip link

Answer

brctl

Question 15

To mount an ext4 filesystem with the noatime option and remount read-only on errors, which file should be edited?

Accepted Answer

/etc/fstab. Option C (/etc/fstab) is the filesystem table that defines mount options. Option A (/etc/mtab) shows currently mounted filesystems. Option B is unrelated. Option D is a startup script.

Answer

/etc/mtab

Answer

/etc/sysconfig/network

Answer

/etc/rc.d/rc.local