EX200 Timed Practice Test 4 — 10 Questions

Question 1

Which TWO are correct ways to check the SELinux context of a file named 'test.txt'? (Choose exactly two.)

Accepted Answer

ls -Z test.txt. Option A is correct because `ls -Z` displays the SELinux security context of files, including user, role, type, and sensitivity level. The `-Z` option is specifically designed to show SELinux context information for files and processes.

Answer

ls -l test.txt

Answer

sestatus

Answer

getenforce

Question 2

A Red Hat Enterprise Linux 9 system has a logical volume 'lv_data' in the volume group 'vg_data' that needs to be resized from 10G to 15G. The underlying physical volumes have enough free space. Which sequence of commands correctly resizes the logical volume and the ext4 filesystem?

Accepted Answer

lvextend -L 15G /dev/vg_data/lv_data; resize2fs /dev/vg_data/lv_data. Option A is correct because to resize an ext4 filesystem on a logical volume, you must first extend the logical volume with `lvextend -L 15G /dev/vg_data/lv_data` to allocate the additional 5G from the volume group, then use `resize2fs /dev/vg_data/lv_data` to grow the filesystem to fill the enlarged block device. This order ensures the underlying block device has sufficient capacity before the filesystem resize operation.

Answer

resize2fs /dev/vg_data/lv_data; lvextend -L 15G /dev/vg_data/lv_data

Answer

lvextend -L 15G /dev/vg_data/lv_data; xfs_growfs /dev/vg_data/lv_data

Answer

lvreduce -L 15G /dev/vg_data/lv_data; resize2fs /dev/vg_data/lv_data

Question 3

A system administrator needs to ensure that a specific kernel module 'usb_storage' is not loaded automatically during boot on a RHEL 9 system. Which configuration file should be modified to blacklist this module?

Accepted Answer

Add 'blacklist usb_storage' to /etc/modprobe.d/blacklist.conf. Option C is correct because on RHEL 9, the recommended way to prevent a kernel module from loading automatically is to add a 'blacklist' directive in a file under /etc/modprobe.d/. The file /etc/modprobe.d/blacklist.conf is a conventional location for such blacklist entries. When modprobe processes this file, it will ignore the specified module during boot and when loading modules manually, effectively preventing usb_storage from being loaded.

Answer

Add 'blacklist usb_storage' to /etc/modules-load.d/usb_storage.conf

Answer

Add 'install usb_storage /bin/false' to /etc/sysconfig/modules/

Answer

Add 'blacklist usb_storage' to /etc/init.d/rc.local

Question 4

An administrator wants to install a package 'httpd' but only if it is available in the configured repositories. Which command should be used to check if the package exists?

Accepted Answer

dnf list available httpd. Option C is correct because `dnf list available httpd` queries the configured DNF repositories and displays the package only if it exists in them. This command checks availability without installing, which matches the requirement to verify the package is present in the repositories before proceeding.

Answer

rpm -q httpd

Answer

dnf search httpd

Answer

dnf install httpd

Question 5

A user reports that they cannot log in to a RHEL 9 system. The administrator checks /etc/passwd and finds the user's shell is set to /sbin/nologin. What is the most likely cause?

Accepted Answer

The user account is intentionally disabled for login.. The /sbin/nologin shell is a valid shell entry that, when set as a user's login shell, prevents interactive login by immediately exiting with a message that the account is not available. This is a standard method for disabling login for system accounts (e.g., daemon, bin) or intentionally disabling a user account while keeping the account and its files intact. Option D correctly identifies that the user account is intentionally disabled for login.

Answer

The SSH service is not running.

Answer

The user account has been locked by pam_tally2.

Answer

The user's password has expired.

Question 6

Which TWO statements are true about systemd services in RHEL 9? (Choose exactly two.)

Accepted Answer

'systemctl list-units --type=service' lists all service units.. Option A is correct because 'systemctl list-units --type=service' filters the output to show only service units, which are the primary unit type for managing daemons and background processes. Option C is correct because 'systemctl status' displays the current state of a unit, including whether it is active (running), inactive (stopped), or in another state like failed.

Answer

'systemctl enable' starts the service immediately.

Answer

'systemctl mask' disables a service but allows manual start.

Answer

'systemctl disable' stops the service immediately.

Question 7

Refer to the exhibit. The service 'example.service' is created but fails to start. The administrator runs 'systemctl start example.service' and gets no output, but 'systemctl status example.service' shows 'active (exited)'. What is the most likely cause?

Accepted Answer

The script /usr/local/bin/example.sh exits immediately.. When a service unit is configured with `Type=oneshot` (or the default `Type=simple` with a script that exits quickly), systemd reports the service as `active (exited)` after the main process finishes. The administrator sees no error output because the command `systemctl start` succeeded in launching the process, but the process itself (the script `/usr/local/bin/example.sh`) exits immediately, which is expected behavior for a oneshot service. The service is considered 'active' because it ran and exited cleanly, not because it remains running.

Answer

The Restart=on-failure directive is misconfigured.

Answer

The network.target dependency is not met.

Answer

The administrator forgot to run systemctl daemon-reload after starting.

Question 8

Which THREE factors determine whether a local user can SSH into a Red Hat Enterprise Linux 9 system? (Choose three.)

Accepted Answer

The user's shell is listed in /etc/shells.. Option C is correct because SSHd validates that the user's login shell is listed in /etc/shells before allowing authentication. If the shell is not present in /etc/shells (e.g., /sbin/nologin or a custom script), SSHd will deny the connection, even if the user has valid credentials. This check is controlled by the 'AllowUsers' and 'DenyUsers' directives but is a fundamental security measure to prevent users with non-standard shells from gaining interactive access.

Answer

The /etc/nologin file exists.

Answer

The user has sudo privileges.

Question 9

A server has a requirement that all users in the 'finance' group must have a password aging policy that forces password change every 90 days. Which approach best achieves this for existing users?

Accepted Answer

Write a script to run 'chage -M 90' for each user in the finance group. Option D is correct because `chage -M 90` sets the maximum password age for a specific user, and by scripting it to apply to all members of the 'finance' group, you directly enforce the 90-day policy on existing users. This approach works regardless of the default settings in `/etc/login.defs`, which only affect new users, and avoids the manual and error-prone editing of `/etc/shadow`.

Answer

Set PASS_MAX_DAYS 90 in /etc/login.defs

Answer

Edit /etc/shadow and change the fifth field for all users

Answer

Configure pam_pwquality.so to enforce password age

Question 10

Which THREE of the following practices are recommended when creating simple shell scripts in a Red Hat Enterprise Linux environment to ensure reliability, security, and maintainability?

Accepted Answer

Quote variables when used in commands, e.g., "$file" instead of $file.. Option B is correct because quoting variables (e.g., "$file") prevents word splitting and glob expansion, which can cause commands to operate on unexpected arguments or filenames with spaces. This is a fundamental shell scripting best practice that directly improves reliability and security by preserving the intended value of the variable.

Answer

Use #!/bin/sh for compatibility, even if bash-specific features are needed.

Answer

Always run scripts by invoking the interpreter directly (e.g., bash script.sh) instead of making them executable.