EX200 Essential Tools Practice Question
A developer needs to search for the string 'ERROR' in all files under /var/log, but wants to exclude files ending with '.gz'. Which command is correct?
⚠ Common exam trap
Red Hat often tests the distinction between `--exclude` (which filters files by name) and `-v` (which inverts line matches), leading candidates to mistakenly use `-v` with a glob pattern to try to exclude files.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
grep -r --exclude='*.gz' 'ERROR' /var/log
`grep -r` performs a recursive search through all files under /var/log, and the `--exclude='*.gz'` option tells grep to skip any files matching the glob pattern '*.gz'. This combination ensures that only non-compressed log files are searched for the string 'ERROR', meeting the requirement exactly. Option B uses `-R` instead of `-r`. In GNU grep, `-R` implies `--dereference-recursive`, which follows symbolic links into other directories. This could lead to searching outside `/var/log` if any symlinks point elsewhere, making it less precise for the stated requirement. While `-r` and `-R` are often conflated, `-R` is not equivalent to `-r` when symlinks are present, and the standard recursive option is `-r`. Therefore, B is incorrect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
grep -r --exclude='*.gz' 'ERROR' /var/log
Why this is correct
The -r flag makes grep recursively descend into /var/log and all of its subdirectories, while --exclude='*.gz' instructs grep to skip any file whose basename matches that glob, thereby avoiding compressed log files. This precisely implements the requested search: only uncompressed files under /var/log are examined for the string 'ERROR'. Using -r rather than the similar -R is also safer because -r does not dereference symbolic links, keeping the search confined to the named directory tree.
- ✗
grep -R --exclude='*.gz' 'ERROR' /var/log
Why it's wrong here
Although -R also performs a recursive search and respects --exclude='*.gz', it additionally dereferences all symbolic links encountered during the traversal, so any symlink under /var/log that points outside that directory would carry the search beyond the intended scope. That can lead to searching unrelated files, potentially including sensitive or very large data, and may also cause duplicate matches if symlinks point back into the same tree. The safer and more predictable behavior for this task is -r, which does not follow symlinks, making the recursive search stay within /var/log.
- ✗
grep -l 'ERROR' /var/log/*.gz
Why it's wrong here
The -l option causes grep to print only the names of files that contain a match, but the glob /var/log/*.gz limits the target set exclusively to compressed log files—the exact files that the requirement asks to exclude. Moreover, the shell expands that glob, so grep never sees the pattern as a recursive search specification; it neither traverses subdirectories nor touches the many uncompressed files in /var/log. Since grep does not decompress .gz files by default, any binary data would also interfere with matching.
- ✗
grep -v '*.gz' -r 'ERROR' /var/log
Why it's wrong here
The -v option inverts the match, so instead of printing errors, grep would output every line that does not contain the pattern '*.gz'—the wrong semantic for this task. Additionally, '*.gz' is treated as the search pattern, not as a filename-exclusion glob, and 'ERROR' becomes a file operand (or directory to recurse into), effectively ignoring the original search string. This command does not exclude compressed files in any way; it only filters lines that contain a literal asterisk-dot-gz sequence, producing meaningless results.
Go deeper
Related to this question
About these practice questions
Courseiva writes every EX200 question from scratch — 127 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This EX200 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX200 exam.