EX200 Manage security Practice Question
A file has been assigned an incorrect SELinux context, preventing a service from accessing it. Which command restores the default SELinux context for that file?
⚠ Common exam trap
Test-takers frequently confuse `chcon` (which changes context manually) with `restorecon` (which restores the default from policy), leading them to pick `chcon` because they think they need to 'change' the context rather than 'restore' it to the correct default.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
restorecon
The `restorecon` command is used to restore the default SELinux security context for a file or directory based on the system's policy store (the file_contexts database). When a file has an incorrect context that prevents a service from accessing it, `restorecon` resets the context to the correct default, allowing the service to access the resource as intended.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
restorecon
Why this is correct
restorecon resets a file's SELinux context to the policy-defined default by consulting the file_contexts rules, typically with `restorecon -v /path/to/file`. It is the correct tool when a file's context has become incorrect because it determines the intended context from the policy rather than relying on a manually specified value, and it only changes files whose current context does not match the default.
- ✗
chcon
Why it's wrong here
chcon assigns a security context that you explicitly provide on the command line, such as `chcon -t httpd_sys_content_t file`, without consulting the policy's file_contexts database. It is inappropriate for this scenario because the incorrect context is already set; you need the file's default context, not a manually chosen one, and chcon would merely replace one possibly wrong context with another that may not match policy.
- ✗
fixfiles
Why it's wrong here
fixfiles is a bulk relabeling utility used to correct file contexts across an entire filesystem or directory tree, often invoked as `fixfiles -F relabel` or automatically during system boot after a policy change. It is not designed for a single file and would be overkill and impractical for fixing one incorrectly labeled file, as it scans and relabels potentially thousands of files rather than targeting a specific path.
- ✗
setfiles
Why it's wrong here
setfiles is a lower-level tool that relabels files according to a specified file-context specification file, usually with options like `setfiles -c /etc/selinux/targeted/policy/policy.31 /etc/selinux/targeted/contexts/files/file_contexts /path`; it is the engine underneath restorecon for system-wide relabeling. It is wrong here because it requires an explicit context-file argument and is intended for bulk operation, whereas restorecon knows the default context for a single file without extra arguments.
Go deeper
Related to this question
About these practice questions
Courseiva writes every EX200 question from scratch — 127 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This EX200 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX200 exam.