EX200 Deploy, configure, and maintain systems Practice Question
A web server running Apache (httpd) on RHEL 9 serves content from /var/www/custom. Clients get a 403 error. The SELinux context on files is system_u:object_r:default_t:s0. Which command resolves the issue persistently without disabling SELinux?
⚠ Common exam trap
Many exam-takers choose `chcon` (Option A) because it immediately fixes the 403 error, but they overlook the requirement for a persistent change, which `semanage fcontext` with `restorecon` provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
semanage fcontext -a -t httpd_sys_content_t "/var/www/custom(/.*)?" && restorecon -R /var/www/custom
It uses `semanage fcontext` to add a persistent file context rule for `/var/www/custom` and its contents, then applies it with `restorecon`. This ensures the `httpd_sys_content_t` type is set persistently across file system relabeling, resolving the 403 error caused by the default SELinux type (`default_t`) that denies Apache access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
chcon -t httpd_sys_content_t /var/www/custom
Why it's wrong here
chcon -t httpd_sys_content_t /var/www/custom only immediately changes the SELinux type on the directory itself; it does not update the persistent file_contexts database, and because -R is omitted, files inside remain incorrectly labeled. After a filesystem relabel (e.g., fixfiles -R or restorecon -R /), the type reverts to the default from the policy, leaving Apache unable to read content. This is a temporary fix, not a permanent one.
- ✗
setsebool -P httpd_enable_custom on
Why it's wrong here
setsebool -P httpd_enable_custom on attempts to enable a boolean that does not exist on RHEL 9. Valid httpd-related booleans include httpd_can_network_connect, httpd_can_sendmail, and httpd_use_nfs, but none of them control which file types Apache may serve. Even with -P, setsebool only persists boolean settings in the policy, not file label changes, and SELinux would still deny access because the file type mismatch remains unresolved.
- ✗
restorecon -R /var/www/custom
Why it's wrong here
restorecon -R /var/www/custom resets file contexts according to existing semanage fcontext rules, but no rule has been defined for /var/www/custom, so it has no target type to set. If the directory was created while SELinux was disabled or from an archive, its label may already be default_t; restorecon will not automatically replace that with httpd_sys_content_t unless an explicit fcontext entry matches the path. Thus, restorecon can apply rules but cannot create them.
- ✓
semanage fcontext -a -t httpd_sys_content_t "/var/www/custom(/.*)?" && restorecon -R /var/www/custom
Why this is correct
semanage fcontext -a -t httpd_sys_content_t "/var/www/custom(/.*)?" && restorecon -R /var/www/custom first writes a persistent file-context rule using a regex that covers the directory and all descendants. Then restorecon consumes that rule to relabel every matching file to httpd_sys_content_t. Because the rule is stored in the SELinux policy, it survives system relabels and is the proper method for assigning Apache-readable context to files outside the default /var/www locations.
Visual reference
Go deeper
Related to this question
About these practice questions
This EX200 question is part of Courseiva's 427-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This EX200 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX200 exam.