EX200 Operate running systems — Timed 20 Questions

Question 1

A system administrator needs to ensure that a specific process continues to run even if it crashes. The process is started by a systemd service unit. Which approach ensures the process is automatically restarted by systemd, with a delay of 30 seconds after each crash, and does not count restarts towards the failure limit?

Accepted Answer

Restart=always, RestartSec=30, StartLimitIntervalSec=0, StartLimitBurst=0. Option A is correct because it combines `Restart=always` to restart the process unconditionally, `RestartSec=30` to introduce a 30-second delay between restarts, and `StartLimitIntervalSec=0` with `StartLimitBurst=0` to disable the start rate limiting entirely. This ensures the service restarts indefinitely after each crash without ever being considered as having failed, which matches the requirement exactly.

Answer

Restart=on-failure and RestartSec=30

Answer

Restart=always, RestartSec=30, StartLimitIntervalSec=0

Answer

Restart=always and RestartSec=30

Question 2

Which TWO statements about systemd journal and rsyslog are correct?

Accepted Answer

The journal stores logs in a structured binary format, allowing filtering by fields like _UID or _SYSTEMD_UNIT.. Option D is correct because the systemd journal stores log data in a structured binary format (using the journald protocol), which allows filtering by specific fields such as _UID, _SYSTEMD_UNIT, or _COMM. This enables precise queries via journalctl, unlike plain-text log files.

Answer

rsyslog reads log messages directly from the journal files in /var/log/journal.

Answer

The command 'journalctl --list-boots' lists only the current boot's journal entries.

Answer

The command 'journalctl -u sshd.service' outputs the same as 'tail -f /var/log/messages' for SSH logs.

Question 3

Refer to the exhibit. A security analyst reviews the journal output for sshd.service. Which of the following best describes the observed pattern of events?

Accepted Answer

The system experienced a brute-force attack on the root account originating from IP 192.168.1.100, which eventually succeeded.. The journal output shows repeated failed authentication attempts for the root user from IP 192.168.1.100, followed by a successful login. This pattern is characteristic of a brute-force attack where an attacker tries many passwords until one works. The final 'Accepted password for root' line confirms the attack succeeded, making D correct.

Answer

The system is under a denial-of-service attack because the connections are being closed before authentication.

Answer

The SSH service is malfunctioning and dropping connections due to a configuration error.

Answer

Multiple hosts are attempting to connect to the SSH service simultaneously, causing connection errors.

Question 4

Arrange the steps to configure a static IPv4 route in Red Hat Enterprise Linux.

Question 5

Order the steps to configure a new user 'jdoe' with UID 2000, home directory /home/jdoe, and secondary group 'staff'.

Question 6

Match each file system type to its description.

Question 7

Match each user/group management command to its function.

Question 8

A critical service must restart automatically after a crash. Which systemd directive should be added to the [Service] section of the service unit file?

Accepted Answer

Restart=always. Option A (Restart=always) is correct because it configures the service to restart automatically on failure. Option B (OnFailure=) invokes another unit on failure, not restart. Option C (Wants=) and Option D (Requires=) are dependency directives.

Answer

OnFailure=

Answer

Requires=

Answer

Wants=

Question 9

Which command checks if a specific systemd service is currently running?

Accepted Answer

systemctl is-active. Option B (systemctl is-active) returns active or inactive for a service. Option A (systemctl status) shows more information but also indicates state. Option C (systemctl list-units) lists all units. Option D (systemctl show) displays unit properties.

Answer

systemctl status

Answer

systemctl list-units

Answer

systemctl show

Question 10

An ext4 filesystem on a logical volume has been extended with lvextend, but df -h still shows the old size. Which command must be run to make the filesystem aware of the new size?

Accepted Answer

resize2fs. Option D (resize2fs) is correct for ext4 filesystems. Option A (xfs_growfs) is for XFS. Option B (lvextend -r) would have performed the resize automatically if used initially. Option C (fsadm resize) is alternative but less common.

Answer

lvextend -r

Answer

fsadm resize

Answer

xfs_growfs

Question 11

A security policy requires user passwords to expire 60 days after last change. Which command sets this for user 'jdoe'?

Accepted Answer

chage -M 60 jdoe. Option C (chage -M 60 jdoe) sets the maximum number of days between password changes. Option A (passwd -x 60 jdoe) is also valid but legacy; chage is preferred in RHCSA. Option B (usermod -f) sets inactivity period. Option D (chage -m) sets minimum days.

Answer

usermod -f 60 jdoe

Answer

passwd -x 60 jdoe

Answer

chage -m 60 jdoe

Question 12

Which systemctl command configures a service to start automatically at boot without starting it now?

Accepted Answer

systemctl enable service. Option B (systemctl enable service) creates the necessary symlinks to start at boot. Option A starts it immediately. Option C reenables. Option D sets default target.

Answer

systemctl set-default service

Answer

systemctl start service

Answer

systemctl reenable service

Question 13

After a system crash, an administrator needs to review logs from the previous boot. Which command shows only logs from the boot before the current one?

Accepted Answer

journalctl -b -1. Option A (journalctl -b -1) shows logs from the previous boot. Option B shows current boot. Option C uses dmesg incorrectly. Option D shows only the current boot log.

Answer

dmesg -b -1

Answer

cat /var/log/boot.log

Answer

journalctl -b 0

Question 14

An administrator needs to combine two physical network interfaces into a single logical interface for redundancy. Which RHEL tool is recommended to configure this in RHEL 8/9?

Accepted Answer

nmcli. Option D (nmcli) is the preferred command-line tool for network management and can configure bonding/teaming. Option A (ip link) can set bonding but is lower-level. Option B (teamd) is used for teaming but nmcli is more common. Option C (brctl) is for bridging.

Answer

teamd

Answer

ip link

Answer

brctl

Question 15

To mount an ext4 filesystem with the noatime option and remount read-only on errors, which file should be edited?

Accepted Answer

/etc/fstab. Option C (/etc/fstab) is the filesystem table that defines mount options. Option A (/etc/mtab) shows currently mounted filesystems. Option B is unrelated. Option D is a startup script.

Answer

/etc/mtab

Answer

/etc/sysconfig/network

Answer

/etc/rc.d/rc.local

Question 16

After restoring files from backup, an SELinux context of a directory is not correct. Which command will restore the file contexts to the system defaults?

Accepted Answer

restorecon -R /directory. Option B (restorecon -R) is the correct command to restore default SELinux contexts. Option A (chcon) sets contexts manually, not to defaults. Option C (setfiles) is used for initial labeling. Option D (semanage fcontext) adds default context rules.

Answer

chcon -R default_t /directory

Answer

semanage fcontext -R /directory

Answer

setfiles -v /directory

Question 17

Which two commands can be used to view systemd journal entries for the sshd service?

Accepted Answer

journalctl -u sshd. Options A and B are correct. journalctl -u sshd and journalctl _SYSTEMD_UNIT=sshd.service both filter journal entries for sshd. Option C shows current status. Options D and E read traditional log files, not the journal.

Answer

systemctl status sshd

Answer

grep sshd /var/log/messages

Answer

tail -f /var/log/secure

Question 18

Which three network configuration methods are valid in RHEL 8/9?

Accepted Answer

/etc/sysconfig/network-scripts/ifcfg-* files. Options A, C, and E are valid. nmcli is the primary CLI tool. ip command is used for low-level network management. /etc/sysconfig/network-scripts/ifcfg-* files are still supported. ifconfig is deprecated. system-config-network is removed.

Answer

system-config-network

Answer

ifconfig

Question 19

Which three commands can be used to display overall memory usage information?

Accepted Answer

free. Options A, B, and C are correct. free shows memory summary. vmstat shows memory and more. top includes memory usage. ps aux shows per-process memory. uptime shows load averages only.

Answer

uptime

Answer

ps aux

Question 20

Refer to the exhibit. What is the most likely cause of this failure?

Accepted Answer

Another process is already bound to port 22.. Option B is correct. The error message 'Cannot bind any address' indicates that the port (22) is already in use by another process. Option A is wrong because the service is enabled. Option C would show 'Permission denied' if SELinux were blocking. Option D would show configuration errors.

Answer

The sshd service is not enabled.

Answer

SELinux is blocking the service.

Answer

The /etc/ssh/sshd_config file is missing.