Red Hat Certified System Administrator EX200 (EX200) — Questions 1–75

df displays information about mounted filesystems, including total size, used space, available space, and the mount point, by reading filesystem statistics via statfs(2). This makes it the standard command for checking how full a mounted filesystem is. Unlike du, it does not walk the directory tree; it queries the filesystem itself.

XFS is the correct default filesystem in RHEL 8. Since RHEL 7, XFS has been the default choice, and it continues in RHEL 8 due to its scalability for large storage systems, metadata journaling, and support for online, non-destructive growth. Anaconda, the RHEL installer, preselects XFS for the root filesystem on new installations unless an administrator explicitly changes it.

podman start is correct because it changes an existing, stopped container from the Exited state to the Running state without creating a new container or pulling an image. It resumes the container's configured entrypoint, command, and environment, making it the exact tool needed for the situation shown in the exhibit.

This line grants the developers group passwordless sudo for every command as any user on any host. The leading % marks it as a group entry, ALL=(ALL) permits running commands as any target user, and NOPASSWD: ALL overrides the default password prompt. This is the exact configuration needed to satisfy the requirement of allowing group members to run commands without supplying a password.

`usermod -aG` adds the user to a supplementary group, not the primary group.

systemctl enable httpd creates the systemd symlinks that pull the httpd unit into the boot target, so the service starts automatically at reboot. It satisfies the persistence requirement without starting the service immediately, unlike systemctl start.

This is the correct setting. A dump value of 0 is the standard choice on modern Linux systems, as dump(8) is obsolete and almost never used. The pass value of 1 tells fsck(8) to check this filesystem at boot, and 1 is specifically used for the root filesystem; other filesystems use pass=2 to run after the root check completes.

dumpe2fs is designed for ext2, ext3, and ext4 filesystems; it looks for the ext family superblock magic (0xEF53) at offset 1024 on the device. XFS uses its own superblock format with the ASCII magic "XFSB" at a different offset. When dumpe2fs reads /dev/sdc1, it does not find the ext magic and prints "bad magic number in super-block," which simply means the device does not contain an ext filesystem, not that it is corrupt. The device likely holds a valid XFS filesystem, so running mount -t xfs /dev/sdc1 /mnt/archive will succeed. This is the correct diagnosis because the tool was incompatible with the actual filesystem type.

XFS project quotas are designed to limit usage of a directory subtree by assigning a project ID (e.g., project 42) to /data and setting a hard block limit. All files in /data, including the database files, inherit that project ID, and when the aggregate usage reaches the limit, further writes return the 'Disk quota exceeded' (EDQUOT) error. This is exactly the behavior described in the question, making it the correct explanation.

fsck is the generic filesystem check front-end that probes the filesystem type on /dev/sdc1 and invokes the appropriate underlying tool, such as e2fsck for ext4. The -n option forces it to answer 'no' to every repair prompt, making the run strictly read-only and non-destructive. This lets the administrator see errors without changing anything, exactly what a dry-run check needs.

This is the canonical command for creating a service account: -r assigns a UID from the system range, -s /sbin/nologin sets the PAM-aware shell that immediately rejects interactive logins, and -M suppresses creation of a home directory. Together these flags produce a minimal, non-interactive account that follows Red Hat's recommended security baseline for daemon users. No home directory means less attack surface and no risk of user-owned files in /home.

Running podman volume create creates a named volume that is managed by Podman and stored on the host under /var/lib/containers/storage/volumes (or a configured driver). Mounting it with -v volname:/var/lib/mysql makes MySQL data persist independently of the container's lifecycle; the volume remains after container removal and can be reused by a new container. Named volumes also allow easy backup, inspection, and sharing, and they are the recommended way to store persistent data with containers.

Correct. The `useradd -G wheel carol` command adds 'carol' to the supplementary group 'wheel' by appending her username to the end of the comma-separated member list in `/etc/group`. The line `wheel:x:10:root,alice,bob,carol` shows 'carol' after the existing members, with no trailing comma, which is the correct format.

SetUID (set user ID) is the correct interpretation: a lowercase 's' in the owner execute position means the executable runs with the effective UID of the file's owner rather than the invoking user. For example, `/usr/bin/passwd` has the setuid bit because it is owned by root and must modify `/etc/shadow`. This is a classic and security-sensitive special permission.

Running mount with no arguments displays the kernel's current mount table, typically sourced from /proc/mounts, in a format showing the device, mount point, filesystem type, and mount options (e.g., /dev/sda1 on / type xfs (rw,relatime)). This output is precisely a list of all currently mounted filesystems, including real devices, pseudo-filesystems like sysfs, and bind mounts. As the standard command for mounting and unmounting filesystems, its bare invocation serves as the canonical way to view the complete active mount configuration.

This is the correct sequence for extending an XFS logical volume: pvcreate initializes the new disk or partition as a physical volume; vgextend adds that PV to the existing volume group, making new extents available; lvextend extends the logical volume into the free extents; and finally xfs_growfs expands the XFS filesystem to fill the larger LV. Because XFS can be grown online and does not support shrinking, xfs_growfs is the proper tool rather than resize2fs. This order ensures every prerequisite is satisfied before the next operation.

lvextend -l +100%FREE /dev/mydata-vg/mydata-lv is correct because it extends the logical volume by all free extents present in the volume group, ensuring the LV consumes every unused physical extent. The -l option uses logical extent counts rather than a fixed size, and +100%FREE is a relative allocation that dynamically calculates the total free space in the VG. By using all free extents, this command maximizes the LV size without requiring you to know the exact amount of free capacity, which is ideal after a vgextend operation.

This is the exact purpose of `set -e`, also known as `errexit`. When enabled, the shell immediately exits if any simple command, pipeline, or compound command (outside of contexts like `if`, `while`, `until`, `!`, or `&&`/`||` left operands) returns a non-zero status. This halts the script at the first error rather than continuing with unchecked failures.

restorecon resets a file's SELinux context to the policy-defined default by consulting the file_contexts rules, typically with `restorecon -v /path/to/file`. It is the correct tool when a file's context has become incorrect because it determines the intended context from the policy rather than relying on a manually specified value, and it only changes files whose current context does not match the default.

A script run via cron or an administrator's shell inherits a minimal PATH and can fail silently if critical commands like df or awk are missing or are non-executable. Including error handling, such as verifying prerequisites with command -v and checking the exit status of df, prevents the script from issuing false alerts or exiting with unrelated error codes. A graceful exit that logs a clear diagnostic message to stderr or syslog makes the failure self-evident and allows administrators to correct the environment rather than debug mysterious output.

This correctly adds TCP port 8443 to the persistent configuration of the default zone and then reloads firewalld to make the permanent rule active without restarting services. The --permanent flag writes the rule to the zone's permanent config (e.g., /etc/firewalld/zones/public.xml), and --reload re-applies that config cleanly. This is the proper way to expose a non-standard HTTPS port.

The podman port command prints the host port bindings for a running container, e.g., 8080/tcp -> 0.0.0.0:32768, by reading the port-mapping rules that podman created. If the container was started without -p or -P, this command produces no output, which is an immediate indicator that no host port was published and external access is impossible. It is the direct, minimal diagnostic for checking whether a container's ports are exposed to the network.

This rule correctly grants dev the ability to run /usr/local/bin/deploy.sh with root privileges without entering a password. The NOPASSWD tag overrides the default password requirement, and the fully qualified command path restricts execution to exactly that binary, preventing PATH-based substitution. The (root) runas specification ensures the command runs only as root, matching the requirement precisely.

For rootless containers, every UID and GID used inside the container must be mapped to an unprivileged range on the host, and those ranges are defined in /etc/subuid and /etc/subgid. The container engine such as Podman calls newuidmap and newgidmap to apply the subordinate ID mapping, and without at least one range assigned to the user, the kernel cannot establish the user namespace and the container fails to launch. A typical entry allocates a starting UID and a count, for example 1000:100000:65536, to give the container up to 65,536 IDs to work with.

nmcli is the NetworkManager command-line utility and is the recommended way to configure a bond or team on RHEL systems. For example, you can run nmcli connection add type bond to create the bond master, then add slave interfaces, and NetworkManager will persist the configuration and manage the underlying teamd or bonding driver automatically.

Mounting a filesystem with nosuid disables the setuid and setgid bits on all executable files within it, so a binary cannot temporarily assume the UID or GID of its file owner. This is critical for partitions like /tmp that are writable by unprivileged users, because a setuid root binary created there could otherwise be exploited for privilege escalation. Administrators commonly include nosuid when mounting removable media or network shares to prevent untrusted binaries from attaining local higher privileges.

If /dev/sdb1 actually contains an ext4 filesystem, the mount command would report "wrong fs type, bad option, bad superblock" only when the fstab entry specifies `xfs` and the filesystem type is inconsistent. However, a UUID mismatch prevents the mount from even locating the device — the error occurs during device resolution, before the kernel reads the superblock — so the failure described in the question would happen regardless of whether the filesystem type were ext4 or XFS. Moreover, an ext4 filesystem mounted with the correct UUID would succeed, so merely having ext4 on the device does not inherently cause a boot-time mount failure.

mkfs.xfs is the XFS-specific formatting utility provided by the xfsprogs package. Running it against /dev/sdb1 initializes the partition with an XFS superblock, allocation-group headers, and the associated metadata structures. It is the canonical, unambiguous command for creating an XFS filesystem, which makes it a correct answer.

The USER instruction is the standard Containerfile directive that sets the active user for subsequent instructions, including the final CMD/ENTRYPOINT runtime process. By specifying a non-root user or numeric UID (e.g., USER 1000), the container runs with least privilege. This is the only option here that directly changes the identity of the running container process.

The `bash -n script.sh` command invokes Bash's noexec mode, which causes the shell to read and parse the entire script but not execute any of its commands. The parser reports any syntax errors with the offending line number and returns a non-zero exit status, making this the standard method for syntax-checking a Bash script. Note that this check only validates grammar, not logical or runtime errors.

The correct procedure is to use `semanage fcontext` to add a persistent rule to the SELinux policy database that maps the target directory and its contents to the `httpd_sys_content_t` type, then run `restorecon` to apply that context to the filesystem. Because the rule is stored in the file context database, it survives system reboots and filesystem relabels initiated by `restorecon -R` or `fixfiles`. This is the standard, supported method for serving static web content from non-default directories such as `/var/www/html` or custom paths, and it ensures the type enforcement allows `httpd_t` to read the files.

find /etc -name "*.conf" is the correct choice because find recursively descends into all subdirectories of /etc, applying the -name test to every file and directory it encounters. The -name test compares the filename (basename) against the glob pattern "*.conf" using standard glob matching, and the double quotes ensure the shell passes the pattern to find rather than expanding it to existing filenames. This command outputs the full path of every file under /etc whose name ends in .conf, making it the proper tool for this name-based recursive search.

mkfs.xfs is the correct command because it explicitly initializes an XFS filesystem on the target partition. XFS is the default filesystem in RHEL 9 for root and many standard partitions, and this invocation creates the required on-disk structure, including the superblock, allocation groups, and B+tree metadata. After running this command, the partition can be mounted and used as an XFS volume.

fdisk is the traditional interactive text-based utility for creating, modifying, and deleting partitions on MBR (DOS) partition tables, and modern versions also support GPT with a compatible interface. It writes partition entries that define start and end sectors, partition type, and boot flag, but it cannot directly create a filesystem without a separate mkfs step. fdisk is well-suited for manual partition planning and small disks.

timedatectl is the correct command because it gives a consolidated, systemd-based view of the time and timezone configuration. Running it with no arguments prints local time, universal time (UTC), RTC time, the currently configured timezone (e.g., 'Europe/Amsterdam'), and whether NTP synchronization is active or enabled. It also supports subcommands like set-timezone to change the configuration, making it the standard utility for this purpose on modern Linux distributions. Thus it directly and unambiguously displays both the current system time and the timezone, plus related status information.

The `id -nG` command prints all group IDs for the named user (or the current user if no user is given) and then converts those numeric IDs to names via the `-n` flag. Because `id` queries the system's user and group databases through NSS, it includes the primary group from `/etc/passwd` and every supplementary group from `/etc/group` (or LDAP/SSSD), making it a complete and script-friendly listing.

A `noexec` mount option on the filesystem is the direct cause: the kernel refuses to execute any file (binary or script) from that mount, even if the file has executable permissions set. This is enforced at the VFS layer, so attempting to run the script with `./script.sh` will return `Permission denied` or `Operation not permitted`, matching the reported symptom. The option is set in `/etc/fstab` (or via `mount -o noexec`), and it overrides normal execute-bit checks.

xfs_growfs works by expanding the filesystem's data allocation structures to consume the additional space that must already exist on the backing device. Before running the command, the administrator must have extended the partition or logical volume using lvextend or a partition editor. When invoked on a mounted XFS filesystem with no arguments, it grows the filesystem to the maximum size permitted by the underlying block device.

This option uses `df /` without `-h`, which produces a stable, machine-parseable output. The `awk` command extracts the fifth field (the percentage used) and `tr` removes the percent sign. This is portable across different Unix/Linux systems.

Checking 'systemctl status remote-fs.target' is the correct first step because systemd uses this target to synchronize the activation of all remote filesystem mounts, including NFS, during the boot sequence. If the target is in a 'failed' or 'degraded' state, the status output will directly show which mount unit failed and why, allowing you to then inspect that specific unit's logs or configuration rather than guessing. This target is explicitly ordered after network-online.target and pulls in the mount units, so its state is the authoritative indicator of whether boot-time NFS mounting was attempted and completed.

The `time` utility, whether the Bash reserved word or the external `/usr/bin/time` binary, is specifically designed to measure how long a command takes to complete. It reports real (wall-clock), user, and system CPU time consumed by the command, typically written to stderr. For example, `time ls -lR /etc` prints a timing summary after the command finishes, making it the correct tool for measuring execution duration.

The exhibit confirms that the physical volume /dev/sdb3 and the volume group vg01 already exist, so the only remaining prerequisite is to create the logical volume itself. The command lvcreate -L 10G -n lv01 vg01 allocates a 10 GiB logical volume named lv01 from the free extents in vg01, which is exactly the correct next step. Afterward, a filesystem can be created on /dev/vg01/lv01.

The plus sign in `-size +10M` is the "greater than" operator, so this command finds all regular files over 10 MiB in /var/log. The `-type f` option filters for regular files only, excluding directories, symlinks, and special files. This is the correct way to identify large files with find.

This is the correct sequence because groupadd --gid explicitly creates the group with the requested GID, and the && operator ensures the subsequent useradd runs only if groupadd succeeds. The useradd -g then sets that newly-created group as the user's primary group. This atomic two-step chain guarantees both objects exist with the intended numeric GID.

The swapon command activates an existing swap device. After a partition has been prepared with mkswap, it is not automatically enabled; running swapon /dev/sdd1 makes the kernel immediately use that partition as paging space. Without this step, the swap space remains available only as a prepared but inactive signature on disk.

Running `journalctl -u service -b` combines the `--unit` filter with the `--boot` option, instructing systemd's journal to display only log records belonging to the specified service unit within the current boot cycle. This is the precise diagnostic command because it isolates the service's own output, errors, and exit status messages. It also automatically appends `.service` to the name if omitted, making it the recommended method for checking why a service failed to start.

Extending a logical volume with lvextend only increases the size of the block device; the filesystem on top of it remains unchanged until explicitly resized. For XFS filesystems, the resize must be performed with xfs_growfs, which can only grow the filesystem online to fill the additional space in the LV. Since the administrator has presumably not run xfs_growfs (or did not mount the filesystem with a tool that auto-grows it), the new space is allocated but not yet available to files, which exactly matches the symptom.

htop is an ncurses-based interactive process viewer that updates its display continuously by default, refreshing CPU, memory, and per-process statistics roughly once per second while it remains in the foreground. It redraws the screen in place, so you see live changes without rerunning a command, and it also lets you sort, filter, and signal processes interactively. Because it keeps running and updating until you quit, it is a genuine real-time process monitor.

`systemctl start myapp` immediately activates the unit by loading it into memory, satisfying its dependencies, and launching the main process defined in `ExecStart`. This changes the unit's *active* state but not its *enabled* state, so myapp will not automatically start after a reboot unless it is also enabled.

This is correct because `usermod -g` directly modifies the user's primary group by changing the GID field in the `/etc/passwd` entry. The specified group must already exist on the system, otherwise `usermod` will return an error and make no changes. After this command, newly created files and directories will inherit this group as their owning group by default, until the user changes it.

On RHEL 9, SELinux ships with the rsyslog_remote boolean disabled by default, which prevents rsyslogd from making outbound TCP/UDP connections to a central log server. Even with a correct rsyslog action line (e.g., *.* @192.0.2.10:514), SELinux will silently drop the packet and log an AVC denial in /var/log/audit/audit.log. Enabling the boolean with `setsebool -P rsyslog_remote 1` allows rsyslog to send syslog messages over the network, making this the correct fix when the service restarts normally but no logs arrive at the remote server.

The log literally contains the message 'start request repeated too quickly', which is systemd's rate-limiting protection for units that crash immediately after starting. When a service fails more than StartLimitBurst times within StartLimitIntervalSec, systemd refuses to attempt further starts until the interval elapses or the unit is reset. The sshd service has hit this start limit, so the failure is correctly explained by too many rapid restart attempts, not by a faulty binary, bad config, or memory exhaustion.

The command uses $home, which is a different variable name from $HOME because bash is case-sensitive. Environment variables like HOME are uppercase by convention, and the lowercase $home is not defined in any standard shell session, so it expands to an empty string. Assigning or exporting a lowercase home would require the script author to have previously set it, and echo "$home" would then output that value rather than the actual home directory. The only correct fix is to change the script to use $HOME (or ${HOME}).

zcat data.log.gz reads the gzip-compressed file, decompresses it, and writes the result to standard output, leaving data.log.gz completely unchanged. Its non-destructive, streaming behavior makes it ideal for piping into tools like head or grep, or for redirecting to another file. Note that zcat is functionally equivalent to gunzip -c.

mkswap /dev/sdc2 writes the swap signature and metadata to the /dev/sdc2 partition, preparing it for use as swap space. Then swapon /dev/sdc2 activates it immediately, making the kernel use it for paging. This two-step sequence is the correct procedure, and you can verify that it worked with swapon --show or by checking the output of free.

This command correctly uses the syntax ln -s <target> <link_name>, with /etc/hosts as the target and /tmp/link_to_hosts as the new symlink. The link is created with absolute path /tmp/link_to_hosts, and accessing it will resolve to /etc/hosts. Because /tmp/link_to_hosts does not already exist, no files are overwritten, making this the correct way to create the requested link.

Extending the logical volume first is required because XFS can only be grown, and the filesystem growth depends on the block device's new capacity. After lvextend allocates the additional storage to the LV, the mounted XFS filesystem is still the old size; running xfs_growfs on the mount point resizes it online to consume the newly available space. This is the only correct sequence for an XFS filesystem on LVM.

The shell and many programs follow the convention that exit status 0 means successful completion, while any non-zero value signals an error, warning, or unusual termination. This convention is pervasive across UNIX-like systems and is relied upon by scripts, continuous integration pipelines, and command-line tools to make control-flow decisions. While specific programs may assign different meanings to specific non-zero codes, the general rule remains that non-zero means the command did not complete as intended.

The bin user is a system account (UID typically below 1000) created for running services and binaries rather than for human interactive use. Its login shell is deliberately set to /sbin/nologin in /etc/passwd, which causes any login attempt to print a message and exit immediately. This is a standard security precaution: system accounts should never provide an interactive shell, but they may still be used for non-interactive tasks like cron jobs or service startup. The exhibit shows nologin precisely because this account is not meant for shell access.

lvextend -L 15G /dev/vg_data/lv_data; resize2fs /dev/vg_data/lv_data — This is the correct order. lvextend first expands the logical volume by adding physical extents from the volume group, making a larger block device available to the filesystem. Only after that can resize2fs safely grow the ext4 filesystem into the newly available space; attempting filesystem growth first would have no extra capacity to claim.

Running `mdadm --detail /dev/md0` is the correct first step because it reports the array state (`clean`, `degraded`, or `recovering`) and shows per-device status, including whether `/dev/sdc` is present as an active or spare device. It also displays a rebuild progress percentage and estimated time when a reshape or reconstruction is in progress, allowing you to confirm that recovery is actually underway and to spot device errors or mismatches. Without this command, you cannot distinguish a healthy rebuild from one that has stalled or failed.

This is correct because groupadd with the -g option creates a new group and assigns the specified GID value of 4500 to it. The output from getent group qa confirms the group exists with GID 4500 and no members, which is exactly what groupadd -g produces. No other command in the list creates a group entry in /etc/group with a custom GID.

tar -czf backup.tar.gz data is correct because -c tells tar to create a new archive, -z pipes the tar stream through gzip for compression, and -f specifies the output file name. The operand data is the directory tar recursively reads into the archive, producing exactly the requested gzip-compressed tarball.

`systemd.timer` units are unit files with a `.timer` suffix that activate corresponding `.service` units on a schedule defined in `[Timer]` sections with directives like `OnCalendar=`, `OnBootSec=`, or `OnUnitActiveSec=`. Timers support calendar events, monotonic timers, persistent timers (`Persistent=true`), and can run missed jobs after boot, making them the modern replacement for cron on systems using systemd. They provide fine-grained control, logging integration with `journald`, and dependency management, so creating a timer unit is a fully valid scheduling method.

`--no-cache` is the correct answer because it tells Podman to ignore every cached layer and execute each instruction from the `Containerfile` as if this were the first build. It forces all dependent stages, such as `RUN` steps, to re-run and pull any changed content from network repositories, giving a pristine result. This is useful for reproducible builds where you need to verify that a fresh base image and package set produce the image.

chmod go-x file is correct because the symbolic mode 'go-x' targets the group (g) and other (o) permission classes with a minus operation, stripping only their execute bits. The owner's existing execute permission is unaffected, which precisely matches the requirement to remove execute access from group and others while preserving the owner's access.

Running cat /etc/yum.repos.d/custom.repo will print the exact bytes of the file to stdout, confirming both that the file exists in the proper /etc/yum.repos.d directory and what its repository configuration lines contain. If the file is missing, cat returns a nonzero exit status with a 'No such file or directory' error, so it provides an unambiguous, immediate pass/fail verification for this specific path.

This is the correct approach because podman volume create dbdata allocates a dedicated, managed volume in Podman's storage area, and the -v dbdata:/var/lib/mysql flag uses the non-absolute source to identify it as a named volume rather than a host path. Podman handles all lifecycle operations, permissions are configured correctly for the container's user, and the volume persists across container restarts and even after the container is removed. You can inspect it with podman volume inspect and reuse it with other containers, making it the right choice for durable database data.

Replacing a mechanical drive with an SSD or deploying RAID 10 directly attacks the root cause of high disk i/o wait: excessive per-request latency and insufficient IOPS. SSDs eliminate rotational seek times and provide thousands of IOPS, while RAID 10 combines striping for parallel reads and writes with mirroring for redundancy, allowing multiple spindles to serve requests concurrently. This decreases both service time and queue depth, thereby reducing the await metric and iowait experienced by the database server.

xfs_growfs is the proper command to expand an XFS filesystem online, and it can be run while the filesystem is mounted. Passing the mount point /var/log instructs the tool to grow the filesystem to consume all available space in the underlying logical volume after an lvextend operation. This command performs the growth without requiring a reboot or unmounting, making it the correct and immediate solution for a full /var/log partition.

stderr, file descriptor 2, is one of the three standard streams that the kernel guarantees to be open for every process from the moment it starts. It is specifically designated for error and diagnostic output, and is intentionally unbuffered or line-buffered so messages appear immediately, even if stdout is redirected or fully buffered. This descriptor is inherited from the parent process and can be redirected via shell operators like 2>.

Switching the /etc/fstab entry to use the filesystem's UUID (e.g., UUID=abc-123) makes the mount independent of the kernel's device node naming order, because the UUID is burned into the filesystem superblock and remains constant regardless of which /dev/sdX node the disk acquires. After editing the file, running 'mount -a' mounts all entries listed in /etc/fstab that are not already mounted, applying the new configuration immediately without needing a reboot. This is the standard, reliable way to handle devices whose /dev names are not stable.