EX200 Manage security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use semanage fcontext to set the SELinux type to httpd_sys_content_t and run restorecon

  Why this is correct

  The correct procedure is to use `semanage fcontext` to add a persistent rule to the SELinux policy database that maps the target directory and its contents to the `httpd_sys_content_t` type, then run `restorecon` to apply that context to the filesystem. Because the rule is stored in the file context database, it survives system reboots and filesystem relabels initiated by `restorecon -R` or `fixfiles`. This is the standard, supported method for serving static web content from non-default directories such as `/var/www/html` or custom paths, and it ensures the type enforcement allows `httpd_t` to read the files.

• ✗

  Set SELinux to permissive mode

  Why it's wrong here

  Setting SELinux to permissive mode disables type enforcement; the kernel will log AVC denials but will not block access, so httpd could read the files. However, this is a system-wide workaround that degrades the security posture of the entire host, not just the web service, and it does not correct the file's SELinux type. The root cause remains, so if SELinux is later returned to enforcing mode (as required by policy or compliance), the same denial will recur. Permissive mode is useful only temporarily for troubleshooting to identify denial sources, not as a permanent solution to a file context misconfiguration.

• ✗

  Use chcon to set the SELinux type to httpd_sys_content_t

  Why it's wrong here

  Using `chcon` to assign `httpd_sys_content_t` changes the SELinux security context directly on the inode, which resolves the immediate denial—but only temporarily. The change is not recorded in the file context database (`/etc/selinux/targeted/contexts/`), so the context is lost when the filesystem is relabeled by `fixfiles` or when a subsequent `restorecon -R` runs. If the directory already has a more specific rule in the policy, `restorecon` will also overwrite the `chcon` setting. Thus, `chcon` is appropriate for one-off tests or for adjusting contexts on files outside the policy, but it should never be relied upon for persistent web content serving.

• ✗

  Add the apache user to the group that owns the directory

  Why it's wrong here

  Adding the `apache` user to the group that owns the directory addresses the Discretionary Access Control (DAC) layer, which enforces traditional Unix permission bits like read, write, and execute for the owner, group, and others. The AVC denial in this scenario is caused by SELinux type enforcement: the `httpd_t` process domain is blocked because the file's type is not one that the policy allows `httpd_t` to access, such as `default_t` or `var_t`. Even if the `apache` user gains read permission through group membership, the SELinux policy will still prevent the process from opening the file unless the file is labeled with an appropriate type like `httpd_sys_content_t` (or `httpd_sys_rw_content_t`). This option confuses DAC permissions with MAC (Mandatory Access Control) and therefore cannot resolve the denial.

Go deeper

Related to this question