Courseiva

Red Hat Certified System Administrator EX200 (EX200) — Questions 151–225

427 questions total · 6pages · All types, answers revealed

Page 2

Page 3 of 6

Page 4
151
Multi-Selectmedium

Which THREE of the following are common practices to improve the reliability of shell scripts?

Select 3 answers
A.Always quote variable expansions unless word splitting is intended
B.Use 'echo "Error"' for error messages without redirection
C.Include 'set -u' to abort on unset variables
D.Include 'set -e' at the top of the script to exit on error
E.Use 'cat' to read files line by line in while loops
AnswersA, C, D

Quoting variable expansions such as "$var" or "${var}" prevents the shell from performing word splitting (splitting the value on characters in IFS, typically whitespace) and pathname expansion (globbing) on the resulting tokens. Without quotes, a variable containing spaces or glob characters like '*' can be broken into multiple arguments or expanded into filenames in unexpected ways. Consistent quoting ensures that the value of the variable is passed as a single argument, which is essential for correctly handling filenames, paths, or data with special characters.

Why this answer

Option A is correct because quoting variable expansions such as "$var" prevents unintended word splitting and glob expansion, which are common sources of bugs and failures in shell scripts. Option C is correct because 'set -u' causes the shell to treat references to unset variables as an error and exit, catching typos and missing environment variables early. Option D is correct because 'set -e' makes the script exit immediately when a command returns a non-zero status, preventing execution from continuing after a failure.

Option B is not a reliability practice: 'echo "Error"' without redirection writes to stdout rather than stderr, so error messages may be missed or mixed with normal output. Option E is not recommended: using 'cat' to feed a while loop spawns an extra process and is less efficient than redirecting the file directly into the loop, and it does not by itself improve reliability.

Exam trap

The RHCSA exam often tests the misconception that 'echo' is sufficient for error output without considering redirection to stderr, and that 'cat' in while loops is a safe pattern, when in fact it introduces performance and reliability issues.

152
MCQeasy

A system administrator needs to create a file system on a new 10GB partition /dev/sdb1 for use with a database that requires high reliability and supports snapshots. Which file system type should be chosen?

A.xfs
B.ext4
C.vfat
D.btrfs
AnswerA

XFS is the correct choice because it is the default filesystem on RHEL 9, and Red Hat fully supports it for production workloads. While XFS itself does not have native snapshot capabilities, it works seamlessly with LVM, which provides snapshot functionality for consistent backups and recovery. Its allocation groups, scalable inode handling, and high concurrency support make it ideal for large database files, exactly what the administrator needs.

Why this answer

XFS is the correct choice because it is a high-performance, 64-bit journaling file system that supports snapshots via LVM or external tools, and is designed for large files and partitions. For a database requiring high reliability and snapshot capabilities, XFS provides robust data integrity features and is the default file system in Red Hat Enterprise Linux 8 and later, making it the recommended option for this scenario.

Exam trap

The trap here is that candidates may choose btrfs because it natively supports snapshots, but the EX200 exam expects XFS as the default RHEL file system for high-reliability production use, and btrfs is not covered as a standard option in the exam objectives.

How to eliminate wrong answers

Option B (ext4) is wrong because while ext4 is a reliable journaling file system, it does not natively support snapshots; snapshots require LVM or other external mechanisms, and ext4 is less optimized for very large partitions and high-concurrency database workloads compared to XFS. Option C (vfat) is wrong because vfat is a simple, non-journaling file system designed for compatibility with legacy systems and removable media; it lacks journaling, reliability features, and snapshot support, making it unsuitable for a database. Option D (btrfs) is wrong because although btrfs supports snapshots and checksumming, it is not the default file system in RHEL and is considered less mature for production database use; the EX200 exam focuses on XFS as the standard choice for high-reliability scenarios.

153
Multi-Selecteasy

Which TWO commands can be used to create a new directory that will serve as a mount point?

Select 2 answers
A.install -d /mnt/newmount
B.touch /mnt/newmount
C.ln -s /mnt /mnt/newmount
D.mkdir /mnt/newmount
E.ln /mnt /mnt/newmount
AnswersA, D

install -d /mnt/newmount is correct because it creates the directory /mnt/newmount, and unlike plain mkdir, it also creates any missing parent components. Even though install is often used to copy files and set modes, with the -d option it acts purely as a directory-creation utility. Because the command succeeds and the result is a real directory, it satisfies the requirement.

Why this answer

`install -d /mnt/newmount` creates the directory `/mnt/newmount` if it does not already exist, setting it up as a mount point. Option D is correct because `mkdir /mnt/newmount` is the standard command to create a directory, which can then be used as a mount point for a filesystem.

Exam trap

Red Hat often tests the distinction between creating a file (`touch`) and creating a directory (`mkdir` or `install -d`), leading candidates to mistakenly think any new filesystem object can serve as a mount point.

154
Multi-Selectmedium

Which THREE statements about container storage in podman are correct? (Choose THREE.)

Select 3 answers
A.Podman volumes can only be managed by podman volume commands, not manually.
B.The --storage-opt flag can be used to set options for the container's writable layer.
C.Rootless containers cannot use the overlay filesystem driver.
D.Bind mounts mount a host directory into the container.
E.Container images are stored in layers, each representing a set of filesystem changes.
AnswersB, D, E

The --storage-opt flag is a valid Podman run option that passes storage driver options to the container's writable layer. For example, size= can set a maximum size for the writable layer when using drivers that support quotas. This differs from --volume options because it configures the local mutable container layer itself rather than external storage.

Why this answer

The `--storage-opt` flag in Podman allows you to pass options directly to the container's storage driver, such as setting the size of the container's writable layer (e.g., `--storage-opt size=10G`). This is a feature of the container storage stack (containers/storage) that Podman uses, enabling fine-grained control over the writable layer's behavior without affecting the image layers.

Exam trap

Red Hat often tests the misconception that rootless containers cannot use overlay filesystems, but in modern Linux kernels (5.11+) with `userxattr` or via `fuse-overlayfs`, rootless overlay is fully supported.

155
Multi-Selecteasy

Which TWO commands can be used to add a user to an existing supplementary group without removing them from other groups?

Select 2 answers
A.groupmod -a user group
B.usermod -a -G group user
C.usermod -g group user
D.usermod -G group user
E.gpasswd -a user group
AnswersB, E

The -a (append) flag, when combined with -G, adds the specified supplementary group to the user's existing set of supplementary groups without disturbing any current memberships. Because -a is required to prevent -G from overwriting the full list, this is the standard, safe method for adding a user to a secondary group. For instance, usermod -a -G wheel alice would let alice retain all her other group memberships while gaining wheel privileges.

Why this answer

The `usermod -a -G group user` command appends the user to the specified supplementary group without affecting their membership in other groups. The `-a` (append) flag must be used with `-G` to add the user to additional groups; without `-a`, the `-G` option replaces all supplementary group memberships with the listed groups.

Exam trap

The trap here is that candidates often confuse `-g` (primary group) with `-G` (supplementary groups) and forget that `-G` without `-a` overwrites all supplementary group memberships, leading to accidental removal from other groups.

156
MCQmedium

The administrator wants to mount a new filesystem on /dev/sdb1 with the label 'backup' and mount it at /mnt/backup. Which commands achieve this?

A.parted /dev/sdb mkpart primary xfs 0% 100% && mkfs.xfs -L backup /dev/sdb1
B.mkfs.xfs /dev/sdb1 && xfs_admin -L backup /dev/sdb1 && mount -L backup /mnt/backup
C.mkfs.xfs -L backup /dev/sdb1 && mount /dev/sdb1 /mnt/backup
D.mkfs.ext4 -L backup /dev/sdb1 && echo '/dev/sdb1 /mnt/backup ext4 defaults 0 0' >> /etc/fstab
AnswerB, C

This sequence correctly creates an XFS filesystem on the existing /dev/sdb1, assigns it the label 'backup' using xfs_admin -L, and mounts it by label with 'mount -L backup /mnt/backup'. Mounting by label resolves through /dev/disk/by-label, avoiding dependence on unstable device names, and works without needing an /etc/fstab entry for immediate use. It assumes the partition already exists and that /mnt/backup is a valid mount point, both of which are prerequisites.

Why this answer

Both options B and C correctly create an XFS filesystem with the label 'backup' on /dev/sdb1 and mount it to /mnt/backup. Option B uses mkfs.xfs, then sets the label with xfs_admin, then mounts by label (mount -L works without fstab). Option C creates the filesystem with the label in one step and mounts by device path.

Options A and D are incorrect: A includes an unnecessary parted command and uses ext4? Actually A creates an XFS partition but then mounts? Wait A: parted ... mkpart primary xfs ... && mkfs.xfs -L backup /dev/sdb1. It doesn't mount, so incomplete. D uses ext4, not XFS.

Thus B and C are both valid.

Exam trap

The trap is that candidates may think mounting by label requires an /etc/fstab entry (as initially stated in the explanation for B), but mount -L works without fstab. Also, they might overlook that both B and C are valid sequences.

How to eliminate wrong answers

Option A is wrong because parted does not create a filesystem; it only creates a partition, and the mkpart command syntax is incomplete (missing filesystem type and partition type). Option B is wrong because xfs_admin -L backup cannot change the label of an XFS filesystem that is already mounted or without the filesystem being unmounted first, and mount -L backup uses the label but the label hasn't been set correctly before mounting. Option D is wrong because it creates an ext4 filesystem instead of XFS, and while it adds an fstab entry, it does not actually mount the filesystem immediately, failing the requirement to mount it at /mnt/backup.

157
MCQhard

An administrator wants to add the two 2G disks (sdc and sdd) as physical volumes, extend the 'data' logical volume in volume group 'vg' by 2G, and grow the filesystem. Which sequence of commands should be used?

A.pvcreate /dev/sdc /dev/sdd; vgextend vg /dev/sdc /dev/sdd; lvresize -L 2G /dev/vg/lv_data; xfs_growfs /data
B.pvcreate /dev/sdc /dev/sdd; vgextend vg /dev/sdc /dev/sdd; lvextend -L +2G /dev/vg/lv_data; resize2fs /dev/vg/lv_data
C.pvcreate /dev/sdc /dev/sdd; vgextend vg /dev/sdc; vgextend vg /dev/sdd; lvextend -L +2G /dev/vg/lv_data; xfs_growfs /dev/vg/lv_data
D.pvcreate /dev/sdc /dev/sdd; vgextend vg /dev/sdc /dev/sdd; lvextend -L +2G /dev/vg/lv_data; xfs_growfs /data
AnswerD

This command chain is fully correct. pvcreate initializes both /dev/sdc and /dev/sdd as physical volumes, then vgextend adds both to volume group vg in a single command. lvextend -L +2G grows lv_data by exactly 2 GiB (the plus sign means 'add' rather than 'set to'), and xfs_growfs /data expands the XFS filesystem that is mounted at /data to consume the additional space. This is the proper order: create PVs, extend the VG, extend the LV, and finally grow the filesystem online without needing to unmount.

Why this answer

It follows the correct sequence: create physical volumes on both disks, extend the volume group with both disks in a single command, extend the logical volume by exactly 2G using the `+` sign, and then grow the XFS filesystem using `xfs_growfs` with the mount point `/data`. The `+` in `lvextend -L +2G` is critical to add 2G rather than resize to 2G total, and `xfs_growfs` requires the mount point (or a block device) for XFS filesystems.

Exam trap

The trap here is that candidates often confuse the `-L` option with and without the `+` sign, and mistakenly use `resize2fs` for XFS filesystems, or use `lvresize` instead of `lvextend` without the correct syntax for adding space.

How to eliminate wrong answers

Option A is wrong because `lvresize -L 2G` (without the `+`) would resize the logical volume to exactly 2G, not add 2G, and it uses `lvresize` instead of `lvextend` (though functionally similar, the intent is extension). Option B is wrong because it uses `resize2fs` which is for ext2/3/4 filesystems, not XFS; the filesystem on `/data` is XFS, so `xfs_growfs` must be used. Option C is wrong because it splits the `vgextend` into two separate commands (which is redundant but not incorrect), but more critically it uses `xfs_growfs /dev/vg/lv_data` with the block device path instead of the mount point; while `xfs_growfs` can accept a block device, the mount point is the standard and safer approach, and the question explicitly states 'grow the filesystem' which implies using the mount point.

158
MCQeasy

A script contains: lines=$(wc -l /etc/passwd); echo $((lines+1)). The output is unexpected. What is the problem?

A.lines contains a string including the filename, not just a number.
B.wc -l requires the -c option to count correctly.
C.The script has a syntax error in the echo command.
D.$((...)) cannot read a variable from command substitution.
AnswerA

`wc -l /etc/passwd` writes the line count followed by a space and the filename (e.g., `37 /etc/passwd`) to stdout. Command substitution captures that entire string into `lines`, so `echo $((lines + 1))` attempts to perform arithmetic on a value that is not a valid integer literal. Because the filename is embedded in the variable, the shell cannot evaluate the expression. This is the fundamental problem: `lines` is not a pure number.

Why this answer

The command substitution `$(wc -l /etc/passwd)` outputs the line count followed by a space and the filename `/etc/passwd`. This entire string (e.g., `35 /etc/passwd`) is stored in the variable `lines`. When `$((lines+1))` attempts arithmetic expansion, it fails because the string is not a pure integer, causing the shell to treat it as 0 or produce an error, resulting in an unexpected output.

Exam trap

Red Hat often tests the candidate's understanding that `wc` includes the filename in its output when given a file argument, and that arithmetic expansion requires a pure numeric string, causing candidates to overlook the need to strip the filename or use input redirection.

How to eliminate wrong answers

Option B is wrong because `wc -l` already counts lines correctly; the `-c` option counts bytes, not lines, and would not fix the issue. Option C is wrong because the `echo` command syntax is valid; the problem lies in the arithmetic expansion, not the echo itself. Option D is wrong because `$((...))` can read variables from command substitution as long as the variable contains a valid integer; the issue is that `lines` contains extra non-numeric text (the filename), not that the variable type is incompatible.

159
Multi-Selecteasy

Which TWO commands can be used to view recent systemd journal logs for the current boot?

Select 2 answers
A.journalctl -p err
B.journalctl --list-boots
C.journalctl -b
D.journalctl --boot
E.journalctl --since today
AnswersC, D

journalctl -b is correct because it is the shorthand form of the --boot option, which instructs journald to display only the log messages from the current boot. This is the standard, concise way to view the most recent journal entries generated since the system started, making it ideal for troubleshooting issues in the current session. The -b flag accepts an optional argument like -1 to inspect previous boots, but with no argument it defaults to the current boot.

Why this answer

`journalctl -b` displays logs from the current boot, which is the default behavior when no boot ID is specified. This command directly queries the systemd journal for messages generated during the current system session.

Exam trap

The trap here is that candidates may confuse `--list-boots` (which lists boot IDs) with actually viewing logs, or think that `--since today` is equivalent to `-b`, when in fact `--since today` can span multiple boots if the system has been running for days.

160
MCQmedium

Refer to the exhibit. An administrator needs to free up space in the /backup filesystem. Which of the following actions would be MOST effective?

A.Increase the size of the logical volume
B.Remove unnecessary files in /backup
C.Delete old log files in /var/log
D.Use lvreduce to shrink the logical volume
AnswerB

Removing unnecessary files directly from the /backup mount point is the correct remedy because /backup is its own logical volume/filesystem, so freeing blocks there reduces the used capacity. Use commands such as `find /backup -type f -size +100M -ls`, `du -xh --max-depth=1 /backup`, or `rm` to identify and delete obsolete backups, then confirm the change with `df -h /backup`. This is the only action that actually frees space on the target filesystem.

Why this answer

The most direct way to free up space in the /backup filesystem is to remove unnecessary files stored there. This action immediately reclaims available space without altering the underlying logical volume or affecting other filesystems.

Exam trap

The trap here is that candidates may confuse freeing space in a filesystem with managing the underlying logical volume, leading them to choose lvreduce or lvextend instead of the simple file removal that directly addresses the space shortage.

How to eliminate wrong answers

Option A is wrong because increasing the size of the logical volume (e.g., with lvextend) does not free up space; it consumes additional free space from the volume group, potentially worsening the shortage. Option C is wrong because deleting old log files in /var/log frees space in the /var filesystem, not in /backup, unless /var/log is mounted under /backup, which is not indicated. Option D is wrong because using lvreduce to shrink the logical volume reduces the available space in /backup, which is the opposite of freeing up space and could cause data loss if the filesystem is not resized first.

161
MCQhard

You maintain a script that performs a long-running task and must clean up temporary files if the script is interrupted. The script uses: #!/bin/bash tempfile=$(mktemp) trap "rm -f $tempfile" EXIT # long task sleep 100 You notice that if the script receives SIGINT (Ctrl+C), the temporary file is not removed. Investigation shows that the trap on EXIT is not executed on SIGINT. Which modification should be made?

A.Move the trap inside a subshell: (trap ... EXIT; long task).
B.Change `trap ... EXIT` to `trap ... 0`.
C.Add `set -e` at the beginning of the script.
D.Add a trap for INT: `trap "rm -f $tempfile; exit" INT`.
AnswerD

This is the only option that explicitly handles the signal that is actually interrupting the script. The trap directive installs a handler for SIGINT, so when Ctrl-C is sent, the shell runs "rm -f $tempfile; exit" instead of simply dying. Because the trap is installed at the top level before the long task begins, it remains in effect throughout the task, and the explicit exit prevents the shell from continuing after the cleanup runs. This guarantees the temporary file is removed even on user interruption.

Why this answer

The EXIT trap is only triggered on normal script termination (e.g., reaching the end or an explicit `exit`), not on signals like SIGINT. By adding a separate trap for INT that explicitly removes the temp file and calls `exit`, the cleanup runs even when the user presses Ctrl+C, ensuring the temporary file is deleted.

Exam trap

Red Hat often tests the misconception that the EXIT trap handles all termination scenarios, including signals, when in fact it only runs on normal exit paths, not on unhandled signals like SIGINT.

How to eliminate wrong answers

Option A is wrong because moving the trap inside a subshell would cause the trap to apply only to the subshell, not the main script, and the subshell would exit immediately after the long task, defeating the purpose of the trap. Option B is wrong because `trap ... 0` is exactly equivalent to `trap ... EXIT` in bash; both trigger only on normal exit, not on signals, so this change would not fix the issue.

Option C is wrong because `set -e` causes the script to exit on any command failure, but it does not affect signal handling or trap execution; it would not ensure cleanup on SIGINT.

162
MCQeasy

A security policy requires that all files in /home have the default SELinux context for user home directories. Which command recursively restores the default context?

A.restorecon -Rv /home
B.semanage fcontext -a -t user_home_t /home
C.chcon -Rv default_t /home
D.setfiles -Rv /home
AnswerA

restorecon -Rv /home is correct because it rereads the active SELinux file context policy (from /etc/selinux/*/contexts/files) and applies the proper default type to every file and directory under /home. The -R flag makes it recursive, and -v shows exactly what is being relabeled, so this command directly satisfies the security policy requirement without altering policy definitions.

Why this answer

`restorecon -Rv /home` recursively resets the SELinux context of all files under `/home` to the default type defined in the SELinux policy for user home directories (typically `user_home_t`). The `-R` flag enables recursion, and `-v` provides verbose output, ensuring compliance with the security policy requirement.

Exam trap

The trap here is that candidates often confuse `restorecon` with `chcon` or `semanage fcontext`, mistakenly thinking that adding a rule with `semanage` or manually setting a context with `chcon` is sufficient, when in fact only `restorecon` (or `setfiles`) applies the policy-defined default context to existing files.

How to eliminate wrong answers

Option B is wrong because `semanage fcontext -a -t user_home_t /home` adds a new default context rule to the SELinux policy database, but it does not immediately apply the context to existing files; a subsequent `restorecon` or `setfiles` is needed to actually relabel the files. Option C is wrong because `chcon -Rv default_t /home` manually sets the context to `default_t`, which is not the correct default type for user home directories (the correct type is `user_home_t`), and `chcon` does not use the policy database, so changes are not persistent after a full relabel. Option D is wrong because `setfiles -Rv /home` is used to relabel files based on a file context specification file (usually `/etc/selinux/targeted/contexts/files/file_contexts`), but it requires root and is typically used for initial labeling or after policy changes, not for simply restoring the default context as `restorecon` does; `setfiles` is more complex and not the standard command for this routine task.

163
MCQeasy

An administrator needs to add a new 20GB disk /dev/sdb to a RHEL 9 server and mount it permanently at /data. The disk is unpartitioned. Which sequence of commands correctly accomplishes this?

A.fdisk /dev/sdb → mkfs.ext4 /dev/sdb1 → mount /dev/sdb1 /data
B.mkfs.ext4 /dev/sdb → mount /dev/sdb /data
C.parted /dev/sdb → mkfs.ext4 /dev/sdb1 → mount /dev/sdb1 /data
D.fdisk /dev/sdb → mkfs.ext4 /dev/sdb1 → echo '/dev/sdb1 /data ext4 defaults 0 0' >> /etc/fstab → mount -a
AnswerD

This sequence is complete: fdisk creates a partition (/dev/sdb1), mkfs.ext4 places a filesystem on it, the echo appends a persistent entry to /etc/fstab with mount options 'defaults' and dump/pass flags, and mount -a reads fstab and mounts all filesystems listed there. As long as the /data mount point directory exists, this will mount /dev/sdb1 immediately and automatically at every boot. The fstab entry is what makes the configuration persistent and distinguishes this from the temporary-mount-only alternatives.

Why this answer

It follows the proper sequence for adding a new unpartitioned disk: create a partition with fdisk, format the partition with mkfs.ext4, add an entry to /etc/fstab for permanent mounting, and then use mount -a to mount all filesystems from fstab. This ensures the disk is mounted persistently across reboots, which is required by the question.

Exam trap

The trap here is that candidates often forget the fstab step for permanent mounting, assuming mount alone makes it persistent, or they attempt to format the whole disk without partitioning, which is not the standard procedure for a new disk in RHEL.

How to eliminate wrong answers

Option A is wrong because it omits the critical step of adding the mount to /etc/fstab, so the mount is not permanent; after reboot, /data would not be mounted. Option B is wrong because it attempts to create a filesystem directly on the whole disk (/dev/sdb) without partitioning, which is not standard practice and may cause issues with tools expecting a partition table; also, it lacks the fstab entry for permanent mounting. Option C is wrong because while parted can create partitions, the sequence shown does not include creating the partition (only launching parted) and then directly formatting /dev/sdb1, which does not exist; additionally, it lacks the fstab entry.

164
MCQeasy

During boot, a custom application fails because the /data file system is not mounted. Upon investigation, the administrator sees an error 'UUID=abc123 not found' in the logs. Which command should the administrator use to correct the /etc/fstab entry?

A.blkid /dev/sdb1
B.mount -a
C.xfs_info /dev/sdb1
D.fdisk -l /dev/sdb1
E.lsblk -f /dev/sdb1
AnswerA

blkid reads the filesystem metadata on a block device and prints the UUID, TYPE, and LABEL directly from the superblock; it does not require the device to be mounted or an entry in /etc/fstab. Running blkid /dev/sdb1 is the correct first step to capture the exact UUID to place in an fstab line, ensuring the mount uses a stable identifier rather than a transient device node.

Why this answer

The error 'UUID=abc123 not found' indicates that the /etc/fstab entry for /data references a UUID that does not match any block device. The administrator needs to find the correct UUID of the actual partition (e.g., /dev/sdb1) and update the fstab entry. The `blkid /dev/sdb1` command displays the UUID (and filesystem type) of that specific device, allowing the administrator to copy the correct UUID into /etc/fstab.

Exam trap

Red Hat often tests the distinction between commands that display partition table information (fdisk) versus those that display filesystem metadata (blkid, lsblk -f), and candidates mistakenly choose `fdisk -l` or `lsblk -f` because they see 'UUID' in the output, but `blkid` is the direct, intended tool for retrieving a UUID to fix an fstab entry.

How to eliminate wrong answers

Option B is wrong because `mount -a` attempts to mount all filesystems listed in /etc/fstab, but if the UUID is incorrect, it will fail again — it does not fix the UUID mismatch. Option C is wrong because `xfs_info /dev/sdb1` displays XFS filesystem geometry and superblock details, not the UUID; it is used for tuning or checking XFS metadata, not for retrieving a UUID. Option D is wrong because `fdisk -l /dev/sdb1` shows partition table information (start/end sectors, type) for a specific partition, but it does not display the filesystem UUID; it is a partitioning tool, not a filesystem UUID tool.

Option E is wrong because `lsblk -f /dev/sdb1` lists filesystem information including UUID for all block devices, but it is a listing command; while it could show the UUID, the question asks for the command to 'correct the /etc/fstab entry' — `blkid` is the standard, precise tool for retrieving the UUID of a specific device to use in fstab, whereas `lsblk -f` is more for overview and does not output in a format as directly usable for fstab editing.

165
MCQmedium

A cron job fails to run. Which command should the administrator use to verify the cron daemon is active?

A.systemctl status cron
B.systemctl status crond
C.systemctl list-units --type=service
D.service crond status
AnswerB

'systemctl status crond' is the correct systemd command to inspect the cron daemon's runtime state. It displays whether crond.service is active (running), its load status, main process ID (PID), and recent log entries from the journal, which helps quickly identify why jobs are not executing. This is the standard, direct diagnostic action on RHEL 7 and later.

Why this answer

On RHEL-based systems (including Red Hat Enterprise Linux, CentOS, and Fedora), the cron daemon is named `crond`, not `cron`. The `systemctl status crond` command checks whether the `crond` service is active, enabled, and running. This is the correct method for verifying the cron daemon's status on systems using systemd.

Exam trap

A common pitfall is assuming the cron daemon is named 'cron' (as on Debian/Ubuntu) and selecting option A. However, on RHEL-based systems, the service is named 'crond', making option B correct. Always verify the exact service name for the exam's target distribution.

How to eliminate wrong answers

Option A is wrong because `systemctl status cron` references a service named 'cron', but on RHEL-based systems the cron daemon is named 'crond', not 'cron' (Debian/Ubuntu uses 'cron'). Option C is wrong because `systemctl list-units --type=service` lists all loaded service units, but it does not specifically check the status of the cron daemon; it would require additional filtering and does not directly answer whether crond is active. Option D is wrong because `service crond status` is a legacy SysVinit command that may work on older systems, but on modern RHEL 7+ systems using systemd, the recommended and consistent command is `systemctl status crond`; the `service` command is a compatibility wrapper and may not reflect the true systemd state in all cases.

166
MCQhard

An administrator needs to list the permissions, owner, group, and filenames of all files in /var/log, including hidden files, in a human-readable format. Which command does this?

A.ls -lh /var/log
B.ls -la /var/log
C.ls -ld /var/log
D.ls -lah /var/log
AnswerD

Combining -l, -a, and -h gives a long-format listing of every entry in /var/log including hidden dotfiles, with sizes expressed in human-readable units. This is the only option that simultaneously provides the required permissions/owner/group data for all contents and keeps the output easily readable, meeting every part of the request.

Why this answer

`ls -lah /var/log` combines the `-l` (long format), `-a` (show all files including hidden ones), and `-h` (human-readable sizes) flags. This meets all requirements: listing permissions, owner, group, filenames, and hidden files with sizes in KiB/MiB/GiB.

Exam trap

The trap here is that candidates may forget the `-a` flag for hidden files or the `-h` flag for human-readable sizes, assuming `-l` alone provides enough detail, or they might mistakenly choose `-ld` thinking it lists directory contents.

How to eliminate wrong answers

Option A is wrong because `ls -lh /var/log` omits the `-a` flag, so hidden files (those starting with a dot) are not listed. Option B is wrong because `ls -la /var/log` includes hidden files but lacks the `-h` flag, so file sizes are displayed in raw bytes rather than human-readable format. Option C is wrong because `ls -ld /var/log` uses the `-d` flag, which lists only the directory itself (its metadata) and not its contents.

167
MCQmedium

A server's firewall is managed by firewalld. The admin adds a rule to allow HTTPS traffic to the public zone, but clients still cannot connect. What is the most likely cause?

A.The rule was added with --permanent but firewall-cmd --reload was not run.
B.The rule must be added as a rich rule, not a simple service.
C.The default zone is not set to public.
D.firewalld is just a wrapper for iptables, so iptables rules must be cleared.
AnswerA

Rules added with `--permanent` are written to the on-disk configuration but not loaded into the running firewalld instance. Without `firewall-cmd --reload`, the active ruleset never includes the HTTPS allowance, so clients remain blocked despite the saved rule.

Why this answer

When a rule is added with the `--permanent` flag in firewalld, it is written to the configuration files but not applied to the runtime firewall. Until `firewall-cmd --reload` is executed, the runtime configuration remains unchanged, so the new rule allowing HTTPS traffic is not active. Clients cannot connect because the firewall is still blocking HTTPS based on the old runtime rules.

Exam trap

The trap here is that candidates often assume adding a rule with `--permanent` immediately takes effect, forgetting that firewalld requires a reload or the `--runtime-to-permanent` approach to synchronize changes.

How to eliminate wrong answers

Option B is wrong because HTTPS traffic can be added as a simple service using `firewall-cmd --add-service=https`; rich rules are not required for standard services like HTTPS. Option C is wrong because the rule was explicitly added to the public zone, so the default zone setting is irrelevant; the rule applies to the public zone regardless of whether it is the default. Option D is wrong because firewalld manages its own runtime and permanent configurations independently of iptables; clearing iptables rules would disrupt firewalld's state and is not necessary or recommended.

168
MCQhard

A systems administrator installs a custom hardware device driver kernel module named 'mydevice' on a RHEL 9 system. The module is built and placed in /lib/modules/$(uname -r)/extra/. The administrator loads it manually with modprobe mydevice and it works. However, after a system reboot, the module is not loaded. The administrator checks that the device is present at boot time. Which step should be taken to ensure the module loads automatically at boot?

A.Add the line 'install mydevice /sbin/modprobe --ignore-install mydevice' to /etc/modprobe.d/load.conf
B.Rebuild the initramfs with 'dracut --force --add mydevice'
C.Add the line 'load mydevice' to /etc/rc.local and ensure rc.local is executable.
D.Run 'echo mydevice > /etc/modules-load.d/mydevice.conf'
AnswerD

Writing the module name to a file under /etc/modules-load.d/ is the canonical systemd way to force a kernel module to be loaded at boot. systemd-modules-load.service reads every .conf file in that directory during early boot and passes each line as a module name to modprobe, so 'mydevice' will be loaded reliably. The echo redirection creates the necessary file with the correct content, and because the service runs before most hardware-dependent services, the driver will be present when the device is probed.

Why this answer

Writing the module name to a file in /etc/modules-load.d/ ensures systemd loads the module automatically at boot. The modules-load.d mechanism is the standard RHEL 9 method for specifying kernel modules to be loaded early in the boot process, before the root filesystem is fully available.

Exam trap

The trap here is that candidates confuse the initramfs rebuild (dracut) with the simpler modules-load.d mechanism, thinking all kernel modules must be baked into the initramfs to load at boot, when in fact only modules needed before root is mounted require that treatment.

How to eliminate wrong answers

Option A is wrong because the 'install' directive in modprobe.d is used to override the default installation command for a module, not to specify automatic loading at boot; it would only affect manual modprobe invocations. Option B is wrong because rebuilding the initramfs with dracut --add mydevice is unnecessary for a module already installed in /lib/modules/.../extra/; initramfs is for modules needed during early boot (e.g., storage drivers), and adding a device driver that is not required for mounting root is wasteful and not the standard method. Option C is wrong because /etc/rc.local is a legacy mechanism that runs after the system is fully booted, not during early kernel module loading; it is also not enabled by default on RHEL 9 and would load the module too late for device initialization.

169
MCQmedium

An administrator has an XFS filesystem on a logical volume /dev/vg_data/lv_data mounted at /data. To extend the filesystem by 10GB, which sequence of commands is correct?

A.lvextend -L +10G /dev/vg_data/lv_data; resize2fs /dev/vg_data/lv_data
B.xfs_growfs /data; lvextend -L +10G /dev/vg_data/lv_data
C.resize2fs /dev/vg_data/lv_data; lvextend -L +10G /dev/vg_data/lv_data
D.lvextend -L +10G /dev/vg_data/lv_data; xfs_growfs /data
AnswerD

This is the correct sequence for expanding an XFS filesystem on an LVM logical volume: lvextend first allocates the additional disk space by extending the logical volume, and then xfs_growfs /data expands the filesystem to fill the newly available space. XFS can only be grown while mounted, and specifying the mount point /data tells the tool exactly which filesystem to target. Running commands in this order ensures no space is wasted and the filesystem remains consistent throughout the operation.

Why this answer

For XFS filesystems, the logical volume must be extended first with `lvextend`, then the filesystem must be grown online using `xfs_growfs` with the mount point as the argument. XFS does not support shrinking and requires this specific order; `resize2fs` is only for ext2/3/4 filesystems.

Exam trap

Red Hat often tests the misconception that `resize2fs` works for all filesystem types, or that the order of operations (extend LV vs. grow filesystem) is interchangeable, leading candidates to choose options that use the wrong tool or reverse the sequence.

How to eliminate wrong answers

Option A is wrong because `resize2fs` is used for ext2/3/4 filesystems, not XFS; using it on an XFS filesystem will fail. Option B is wrong because `xfs_growfs` must be run after extending the logical volume, not before; running it first will have no effect since the underlying block device hasn't been enlarged. Option C is wrong because `resize2fs` is incorrect for XFS, and the logical volume must be extended before the filesystem resize operation.

170
MCQhard

A Red Hat Enterprise Linux 9 system enforces a security policy that user accounts must be disabled after 90 days of inactivity. The system administrator has configured /etc/shadow accordingly with the proper fields. User 'bob' has been on leave for 95 days. When bob returns and tries to log in, he is unable to do so. The administrator checks the shadow file and sees that bob's password expiration date has passed and the account is locked due to inactivity (the inactivity period has exceeded). The administrator wants to immediately reactivate bob's account without changing the password, and also wants to set the account to expire in 30 days from now (relative to the current date). Which set of commands should the administrator run to achieve this goal?

A.chage -E $(date -d +30days +%Y-%m-%d) bob; chage -I -1 bob
B.usermod -e 2024-12-31 bob; passwd -S bob
C.chage -d 0 bob; usermod -L bob
D.usermod -e $(date -d +30days +%Y-%m-%d) bob; passwd -u bob
AnswerA

This combination is correct because chage -E $(date -d +30days +%Y-%m-%d) bob dynamically sets the account expiration date to exactly 30 days from today, while chage -I -1 bob sets the inactivity period to -1, which disables the automatic locking of an account whose password has expired. This directly clears the lockout caused by exceeding the inactivity threshold, so Bob's account can be used again for the next 30 days. It addresses both the expired expiration date and the inactivity-based lock.

Why this answer

`chage -E $(date -d +30days +%Y-%m-%d) bob` sets the account expiration date to 30 days from now, and `chage -I -1 bob` disables the inactivity period (sets it to -1, meaning no inactivity lockout), which immediately reactivates the account without changing the password. This directly addresses the requirement to unlock the account (which was locked due to exceeding the inactivity period) and set a new expiration date.

Exam trap

The trap here is that candidates confuse password lock (`passwd -l`/`passwd -u`) with inactivity lock (`chage -I`), and assume `passwd -u` can reactivate an account disabled by inactivity, when in fact only `chage -I` or modifying the INACTIVE field in `/etc/shadow` can do that.

How to eliminate wrong answers

Option B is wrong because `usermod -e 2024-12-31 bob` sets a static expiration date (not relative to current date) and `passwd -S bob` only shows the password status, it does not unlock the account or disable the inactivity lock. Option C is wrong because `chage -d 0 bob` forces a password change on next login (which violates 'without changing the password'), and `usermod -L bob` locks the account, which is the opposite of reactivating it. Option D is wrong because `usermod -e $(date -d +30days +%Y-%m-%d) bob` correctly sets the expiration date, but `passwd -u bob` only unlocks a password-locked account (via `passwd -l`), not an account locked due to inactivity in /etc/shadow (the INACTIVE field); it does not reset the inactivity counter or disable the inactivity period.

171
MCQmedium

A system administrator needs to ensure that a specific kernel module 'usb_storage' is not loaded automatically during boot on a RHEL 9 system. Which configuration file should be modified to blacklist this module?

A.Add 'blacklist usb_storage' to /etc/modules-load.d/usb_storage.conf
B.Add 'install usb_storage /bin/false' to /etc/sysconfig/modules/
C.Add 'blacklist usb_storage' to /etc/modprobe.d/blacklist.conf
D.Add 'blacklist usb_storage' to /etc/init.d/rc.local
AnswerC

This is the standard and correct approach: /etc/modprobe.d/ contains configuration consumed by modprobe, and the 'blacklist' directive instructs it to ignore any request to load usb_storage from automatic discovery (e.g., udev or coldplug). Files in this directory follow a .conf naming convention, so blacklist.conf is a conventional choice. This prevents the module from being loaded by alias, though a user could still force it with an explicit full-name modprobe command.

Why this answer

On RHEL 9, the recommended way to prevent a kernel module from loading automatically is to add a 'blacklist' directive in a file under /etc/modprobe.d/. The file /etc/modprobe.d/blacklist.conf is a conventional location for such blacklist entries. When modprobe processes this file, it will ignore the specified module during boot and when loading modules manually, effectively preventing usb_storage from being loaded.

Exam trap

The trap here is that candidates confuse /etc/modules-load.d/ (used for loading modules) with /etc/modprobe.d/ (used for module configuration including blacklisting), leading them to choose Option A.

How to eliminate wrong answers

Option A is wrong because /etc/modules-load.d/ is used to list modules that should be loaded at boot, not to blacklist them; adding 'blacklist usb_storage' there would have no effect. Option B is wrong because /etc/sysconfig/modules/ is not a standard directory for module blacklisting; the 'install usb_storage /bin/false' directive, if placed in a modprobe.d file, would override the module's installation, but the path given is incorrect. Option D is wrong because /etc/init.d/rc.local is a legacy script for local startup commands and is not designed for kernel module blacklisting; it would run too late in the boot process and is not the proper mechanism for preventing module loading.

172
MCQmedium

Based on the exhibit, which statement about the container 'webserver' is true?

A.Container port 80 is mapped to host port 8080.
B.The container uses the host network.
C.Container port 8080 is mapped to host port 80.
D.No port mapping exists.
AnswerA

The exhibit's PORTS column displays 0.0.0.0:8080->80/tcp, which uses Docker's host_port:container_port syntax. This means traffic sent to port 8080 on any host interface is forwarded to TCP port 80 inside the container, so container port 80 is indeed mapped to host port 8080. The wildcard 0.0.0.0 binding indicates the port is published on all of the host's network interfaces.

Why this answer

The exhibit shows the container 'webserver' with port mapping '0.0.0.0:8080->80/tcp'. This indicates that host port 8080 is mapped to container port 80, meaning traffic arriving at the host on port 8080 is forwarded to port 80 inside the container. Therefore, option A is correct.

Exam trap

The trap here is that candidates often confuse the order of port mapping, thinking the first number is the container port and the second is the host port, when in fact the syntax is `host_port:container_port`.

How to eliminate wrong answers

Option B is wrong because the container uses bridge networking by default (as seen by the port mapping syntax), not host networking; host networking would show '--network host' and no port mapping. Option C is wrong because it reverses the mapping: the exhibit shows host port 8080 to container port 80, not container port 8080 to host port 80. Option D is wrong because the exhibit explicitly shows a port mapping (0.0.0.0:8080->80/tcp), so port mapping does exist.

173
MCQmedium

A user wants to display the contents of a file in reverse line order. Which command should be used?

A.tail -r file
B.sort -r file
C.rev file
D.tac file
AnswerD

`tac` is the inverse of `cat` and writes each file to standard output with the lines listed in reverse order, meaning the last line appears first. The name comes from "cat" spelled backward, and it is a standard coreutils command available on RHEL. It preserves the exact content of every line while reversing only the line sequence, which exactly fulfills the user's request.

Why this answer

The `tac` command is the standard Linux utility for displaying a file in reverse line order. It reads the file from the last line to the first, effectively reversing the line sequence. This is the correct tool for the task described.

Exam trap

The trap here is that candidates may confuse `tac` with `tail` or `rev`, or incorrectly assume `sort -r` reverses line order, when in fact `tac` is the specific command for reversing line order in a file.

How to eliminate wrong answers

Option A is wrong because `tail -r` is not a valid command in standard Linux; `tail` displays the last lines of a file, and the `-r` flag is not supported. Option B is wrong because `sort -r` sorts lines in reverse alphabetical order, not reverse line order. Option C is wrong because `rev` reverses the characters within each line, not the order of lines themselves.

174
MCQmedium

A system administrator needs to restore the default SELinux security context on all files under /var/www/html after a misconfiguration. Which command should be used?

A.setfiles -R /var/www/html
B.restorecon -R /var/www/html
C.fixfiles -R /var/www/html
D.chcon -R -t httpd_sys_content_t /var/www/html
AnswerB

restorecon is the correct command because it reads the active policy's `file_contexts` rules and resets each file's SELinux context to the default for its path. With `-R`, it descends recursively through `/var/www/html`, fixing any files whose contexts were altered by copying, misconfiguration, or manual `chcon`. It is the standard tool for restoring contexts on a specific path.

Why this answer

The `restorecon -R /var/www/html` command restores the default SELinux security contexts on all files under /var/www/html by reading the file contexts defined in the SELinux policy (typically from /etc/selinux/targeted/contexts/files/file_contexts). The `-R` flag ensures recursive operation, making it the correct tool to fix misconfigured contexts without manually specifying a type.

Exam trap

The trap here is that candidates confuse `restorecon` with `chcon` or `setfiles`, thinking that manually setting the type with `chcon` is equivalent to restoring the default context, but `chcon` does not consult the policy and can set an incorrect type if the path's default context differs from the specified type.

How to eliminate wrong answers

Option A is wrong because `setfiles` is used to verify or set file contexts based on a file context specification file, but it requires a specification file argument (e.g., `setfiles -c /etc/selinux/targeted/policy/policy.31 file_contexts /var/www/html`) and is not the standard command for restoring contexts on a live system; it is more commonly used for initial labeling or relabeling after policy changes. Option C is wrong because `fixfiles` is a higher-level script that can restore contexts, but its `-R` option is not valid; `fixfiles` uses `-F` to force restoration or `-R` to remove files from the restore list, and the correct syntax for recursive restore is `fixfiles restore /var/www/html` or `fixfiles -R /var/www/html` is not a standard usage. Option D is wrong because `chcon -R -t httpd_sys_content_t /var/www/html` manually sets the type to `httpd_sys_content_t`, which may not match the default context defined in the policy (e.g., `httpd_sys_content_t` is correct for static content, but the default context could be `httpd_sys_rw_content_t` for writable directories or other types depending on the path); this approach bypasses the policy and can lead to further misconfiguration.

175
MCQeasy

Which systemctl command configures a service to start automatically at boot without starting it now?

A.systemctl set-default service
B.systemctl start service
C.systemctl enable service
D.systemctl reenable service
AnswerC

systemctl enable is the correct command to configure a service to start automatically at boot because it creates symlinks from the service unit into the appropriate .wants or .requires directories, based on the [Install] section of the unit file. For example, a service with WantedBy=multi-user.target will get a symlink in /etc/systemd/system/multi-user.target.wants/. This action does not start the service immediately, but it ensures systemd activates it when the target is reached during boot.

Why this answer

`systemctl enable service` creates the necessary symlinks in the systemd unit configuration directories (e.g., `/etc/systemd/system/multi-user.target.wants/`) to ensure the service starts automatically at boot, but it does not start the service immediately. This matches the requirement of configuring automatic startup without starting the service now.

Exam trap

The trap here is confusing `systemctl enable` with `systemctl start`; candidates often think enabling a service also starts it, but systemd separates these actions to allow administrators to schedule automatic startup without immediate execution.

How to eliminate wrong answers

Option A is wrong because `systemctl set-default` sets the default target (e.g., multi-user.target) for the system, not a service; it does not configure a service to start at boot. Option B is wrong because `systemctl start service` starts the service immediately but does not enable it for automatic startup at boot; it only affects the current runtime state. Option D is wrong because `systemctl reenable service` removes and recreates the enable symlinks, which is used to fix broken enablement but does not specifically address the requirement of not starting the service now; it also implies the service is already enabled.

176
MCQmedium

Based on the exhibit, which mount point is mounted with the 'noexec' option?

A./data
B./
C./var
D./tmp
E./boot
AnswerD

The /tmp mount point is the correct answer because the exhibit explicitly shows it as an ext4 filesystem mounted with the noexec option. This mount flag instructs the Linux kernel to refuse execve() calls for files located on that filesystem, preventing binaries from being launched directly from the world-writable /tmp directory. No other mount point listed in the exhibit displays the noexec flag, making /tmp the only matching option.

Why this answer

The /tmp mount point is configured with the 'noexec' option, as shown in the exhibit (e.g., in /etc/fstab or the output of mount or findmnt). This prevents execution of binaries directly from the /tmp filesystem, which is a common security hardening practice to mitigate the risk of attackers running malicious scripts or binaries from a world-writable directory.

Exam trap

Red Hat often tests the 'noexec' option on /tmp because candidates may overlook that /tmp is a separate mount point in many Red Hat Enterprise Linux installations, and they might incorrectly assume it inherits the root filesystem's mount options.

How to eliminate wrong answers

Option A is wrong because /data is not listed in the exhibit as having 'noexec'; it likely uses default exec permissions. Option B is wrong because / (root) typically does not have 'noexec' set, as it would break system binaries and scripts. Option C is wrong because /var is usually mounted with default exec permissions to allow services to run scripts or binaries from /var.

Option E is wrong because /boot is mounted without 'noexec' to allow kernel and bootloader updates that require execution of binaries.

177
MCQmedium

Which shell built-in can be used to read user input during script execution?

A.read
B.printf
C.cat
D.echo
AnswerA

read is a shell builtin that reads a line from standard input and splits it into words using IFS, assigning them to the listed variable names; when no variable is supplied, it stores the entire line in REPLY. Because it runs in the current shell process rather than a child process, the assigned variables remain available afterward, which is exactly what an interactive prompt requires. Its exit status reflects whether a line was actually read, so it also works in while loops.

Why this answer

The `read` built-in command is specifically designed to capture user input from standard input (stdin) during script execution, storing it in one or more variables. This makes it the correct choice for interactive scripts that require runtime input from the user.

Exam trap

Red Hat often tests the distinction between output commands (echo, printf) and input commands, expecting candidates to know that `read` is the only built-in among the options that directly captures user input into a variable.

How to eliminate wrong answers

Option B (printf) is wrong because it is used for formatted output, not for reading input; it writes to stdout. Option C (cat) is wrong because it concatenates and displays file contents, and while it can read from stdin if no file is given, it is not a shell built-in for capturing user input into a variable. Option D (echo) is wrong because it outputs text to the terminal and has no capability to read or capture input.

178
MCQmedium

An administrator wants to temporarily disable the firewalld service for troubleshooting. Which command will stop the service and prevent it from starting on subsequent boots?

A.systemctl stop --now firewalld
B.systemctl mask firewalld
C.systemctl stop firewalld
D.systemctl disable firewalld
E.systemctl disable --now firewalld
AnswerE

Running systemctl disable --now firewalld performs both operations atomically: it stops the active firewalld daemon and removes the boot-time enablement symlinks so that the service will not start at the next boot. This is the cleanest way to temporarily take the firewall down across reboots while leaving the unit unmasked and available for manual start later. It is the standard single-command answer for 'temporarily disable' scenarios.

Why this answer

`systemctl disable --now firewalld` both stops the service immediately (via `--now`) and disables it from starting automatically on subsequent boots. This meets the requirement of temporarily disabling the service for troubleshooting while preventing it from starting after reboot.

Exam trap

The trap here is that candidates often confuse `disable` with `mask` or forget that `stop` alone does not affect boot-time behavior, leading them to choose options that either stop the service without disabling it or permanently block it with mask.

How to eliminate wrong answers

Option A is wrong because `systemctl stop --now firewalld` stops the service immediately but does not disable it, so it will start again on the next boot. Option B is wrong because `systemctl mask firewalld` creates a symlink to /dev/null, which prevents the service from being started manually or automatically, but it is a permanent action that is difficult to reverse and not appropriate for temporary troubleshooting. Option C is wrong because `systemctl stop firewalld` stops the service only for the current session; it will restart on the next boot.

Option D is wrong because `systemctl disable firewalld` prevents the service from starting on boot but does not stop it immediately, so the service remains running until manually stopped.

179
Multi-Selecthard

Which THREE of the following practices are recommended when creating simple shell scripts in a Red Hat Enterprise Linux environment to ensure reliability, security, and maintainability?

Select 3 answers
A.Use #!/bin/sh for compatibility, even if bash-specific features are needed.
B.Quote variables when used in commands, e.g., "$file" instead of $file.
C.Start the script with a shebang line, e.g., #!/bin/bash.
D.Include set -e at the beginning of the script to exit on any error.
E.Always run scripts by invoking the interpreter directly (e.g., bash script.sh) instead of making them executable.
AnswersB, C, D

Unquoted variable expansions are subject to word splitting and pathname expansion, so a filename like 'My File.txt' would be split into two arguments, and a value containing '*' could expand to multiple files. Quoting, as in "$file", preserves the variable's value as one literal argument, preventing these transformations. This is essential when handling user input, file paths, or any value with whitespace or glob characters.

Why this answer

Quoting variables (e.g., "$file") prevents word splitting and glob expansion, which can cause commands to operate on unexpected arguments or filenames with spaces. This is a fundamental shell scripting best practice that directly improves reliability and security by preserving the intended value of the variable.

Exam trap

The trap here is that candidates may think using #!/bin/sh is always safer for compatibility, but they overlook that it can break scripts relying on bash-specific features, and they may also believe invoking the interpreter directly is always acceptable, ignoring the portability and clarity benefits of an executable script with a shebang.

180
MCQhard

You are managing a Red Hat Enterprise Linux 8 server that hosts backup scripts. A user named 'backup' (UID 1005) is a member of the 'backup' group. The directory /var/backups is owned by root:backup with permissions 775. The 'backup' user needs to create files in this directory. However, when the user attempts to create a file, they receive 'Permission denied'. You verify that 'backup' is indeed listed in the backup group in /etc/group. The user's current shell was started after their last login. Which of the following is the most likely cause and solution?

A.The directory lacks the setgid bit; set it with 'chmod g+s /var/backups'.
B.The user needs to log out and log back in to refresh their group membership.
C.The user's umask is too restrictive, preventing file creation. Change the umask to 002.
D.The user should use 'newgrp backup' to switch to the backup group temporarily.
AnswerB

Linux determines a user's supplemental groups at login time from the /etc/group database and stores them in the process credentials via initgroups(). When a user is added to a new group after their current login, existing shells and daemons keep the old group set; simply editing /etc/group does not update running sessions. The user must end the session and log in again so that login(1) or systemd user session reinitializes the supplementary groups, allowing access to files and directories that require that group.

Why this answer

The user 'backup' is already a member of the 'backup' group in /etc/group, but the current shell session was started before the group membership was added or refreshed. On Linux, group membership is determined at login time by the PAM modules; simply adding a user to a group does not affect already running processes. The user must log out and log back in (or start a new login shell) to acquire the new group membership via the initgroups() system call, which populates the process's supplementary group list.

Exam trap

The trap here is that candidates often think the setgid bit or umask is the issue, but the real problem is that group membership changes do not apply to existing login sessions—a fundamental Linux behavior that Red Hat EX200 frequently tests.

How to eliminate wrong answers

Option A is wrong because the setgid bit (chmod g+s) would cause new files to inherit the group of the directory, but the user already has group write permission via the 775 permissions; the issue is that the user's process does not have the 'backup' group in its supplementary groups, not that the directory lacks setgid. Option C is wrong because umask only affects the default permissions of newly created files, not the ability to create files at all; even with a restrictive umask (e.g., 077), the user could still create files if they had write permission, but they would be created with no group/other permissions. Option D is wrong because 'newgrp backup' would work to switch the user's effective group to 'backup' temporarily, but it is not the most likely cause or the best solution; the question asks for the most likely cause and solution, and the standard fix is to log out and log back in to refresh group membership for all future sessions.

181
MCQmedium

An administrator needs to schedule a script to run every Monday, Wednesday, and Friday at 2:30 PM. Which cron expression should be used?

A.30 14 * * 1,3,5
B.30 14 * * 1-5
C.14 30 * * 1,3,5
D.30 14 * * 0,2,4
AnswerA

The cron expression has the correct field order: minute (30), hour (14), day of month (*), month (*), and day of week (1,3,5). Numeric day-of-week values start at 0 for Sunday, so 1 is Monday, 3 is Wednesday, and 5 is Friday. Because the day-of-month and month fields are wildcards, the job would run solely on those weekdays at 2:30 PM.

Why this answer

Cron uses five fields (minute, hour, day-of-month, month, day-of-week). 2:30 PM is 14:30 in 24-hour format, so minute=30 and hour=14. The day-of-week field uses 0-7 (0 and 7 = Sunday), with Monday=1, Wednesday=3, Friday=5. The asterisks for day-of-month and month mean 'every day' and 'every month', so the expression `30 14 * * 1,3,5` runs the script at 2:30 PM on Monday, Wednesday, and Friday.

Exam trap

Red Hat often tests the 24-hour time format and the correct ordering of minute and hour fields, causing candidates to swap them (as in Option C) or to confuse the day-of-week numbering (Sunday=0 vs Monday=1) as seen in Option D.

How to eliminate wrong answers

Option B is wrong because `1-5` in the day-of-week field specifies Monday through Friday (days 1,2,3,4,5), which includes Tuesday and Thursday, not just Monday, Wednesday, and Friday. Option C is wrong because the fields are reversed: `14 30` would mean minute=14 and hour=30, which is invalid (hour 30 does not exist) and would never run at 2:30 PM. Option D is wrong because `0,2,4` in the day-of-week field corresponds to Sunday (0), Tuesday (2), and Thursday (4), which is the wrong set of days.

182
MCQeasy

An administrator wants to display a list of all currently logged-in users. Which command is most appropriate?

A.who
B.w
C.last
D.users
AnswerA

The `who` command reads /var/run/utmp and outputs a roster of every currently active login session, including the username, terminal/line, login time, and remote host when applicable. This directly satisfies the administrator's requirement to display a list of all users currently logged into the system, with enough detail to identify each session. It is the canonical utility for this purpose.

Why this answer

The `who` command displays a list of currently logged-in users along with their terminal, login time, and originating host. It is the most straightforward and appropriate command for this specific task, as it directly queries the system's utmp database to show active sessions.

Exam trap

The trap here is that candidates often confuse `w` (which shows additional process information) with `who` for a simple user listing, or mistakenly think `last` shows current users because it lists login records.

How to eliminate wrong answers

Option B is wrong because `w` shows detailed information about currently logged-in users, including their current process and CPU usage, but it is more verbose than needed for simply listing users. Option C is wrong because `last` displays a history of previous logins and logouts from the wtmp file, not currently logged-in users. Option D is wrong because `users` prints only the usernames of currently logged-in users, but it does not show terminal or login time details, making it less comprehensive than `who` for a full list.

183
MCQmedium

Refer to the exhibit. If the system administrator wants to create a new logical volume of size 2GB in the 'rhel' volume group, what is the first command that must be executed?

A.pvcreate /dev/sdb
B.pvcreate /dev/sdb1
C.lvcreate -L 2G -n lvdata rhel
D.vgextend rhel /dev/sdb
AnswerB

The pvcreate /dev/sdb1 command is correct because it initializes the partition /dev/sdb1 as a physical volume, making it available to be added to an LVM volume group. After this step, the administrator would typically extend the volume group rhel with vgextend rhel /dev/sdb1, and only then can they create a logical volume. This aligns with the correct sequence of LVM operations: partition, pvcreate, vgextend, lvcreate.

Why this answer

Before a new logical volume can be created in the 'rhel' volume group, the physical volume must be prepared. The exhibit shows that /dev/sdb is not yet partitioned; the first step is to create a partition (e.g., /dev/sdb1) and then initialize it as a physical volume using `pvcreate /dev/sdb1`. Only after this can the volume group be extended and the logical volume created.

Exam trap

Red Hat often tests the misconception that you can directly extend a volume group with an uninitialized disk or create a logical volume without first ensuring the VG has free space, leading candidates to skip the essential `pvcreate` step.

How to eliminate wrong answers

Option A is wrong because `pvcreate /dev/sdb` would attempt to initialize the entire disk without a partition table, which is not the standard practice for adding a new disk to LVM; a partition (e.g., /dev/sdb1) is typically required first. Option C is wrong because `lvcreate -L 2G -n lvdata rhel` cannot succeed until the volume group has enough free physical extents, which requires first adding a physical volume and extending the VG. Option D is wrong because `vgextend rhel /dev/sdb` would fail if /dev/sdb is not yet a physical volume; the PV must be created before extending the VG.

184
MCQmedium

A volume group vg_data has no free extents. An admin adds a new disk /dev/sdc and wants to extend the logical volume lv_data (ext4 filesystem) by 5GB. Which sequence of commands is correct?

A.pvcreate /dev/sdc → vgextend vg_data /dev/sdc → lvextend -L+5G /dev/vg_data/lv_data
B.pvcreate /dev/sdc → vgextend vg_data /dev/sdc → lvextend -L+5G /dev/vg_data/lv_data → resize2fs /dev/vg_data/lv_data
C.lvextend -L+5G /dev/vg_data/lv_data → pvcreate /dev/sdc → vgextend vg_data /dev/sdc
D.fdisk /dev/sdc → mkfs.ext4 /dev/sdc1 → pvcreate /dev/sdc1 → vgextend vg_data /dev/sdc1 → lvextend -L+5G /dev/vg_data/lv_data
AnswerB

This is the complete and correct workflow: pvcreate initializes the new disk for LVM, vgextend adds that capacity to the volume group, lvextend allocates the extra extents to lv_data, and resize2fs expands the ext4 filesystem to fill the enlarged LV. Each step operates on the next layer, and because ext4 supports online resizing, resize2fs can be run while the filesystem is mounted. The result is that both the logical volume and the filesystem now use the full 5G.

Why this answer

It follows the proper sequence: first create the physical volume with pvcreate, then extend the volume group with vgextend, then extend the logical volume with lvextend, and finally resize the ext4 filesystem with resize2fs. Since the filesystem is ext4, the resize2fs command is required after lvextend to make the additional space available to the filesystem.

Exam trap

The trap here is that candidates often forget the filesystem resize step for ext4, assuming lvextend alone is sufficient, or they incorrectly add unnecessary partitioning and filesystem creation steps, which wastes time and can cause errors in a real environment.

How to eliminate wrong answers

Option A is wrong because it omits the resize2fs step; after extending an ext4 logical volume, the filesystem must be resized to use the new space, otherwise the filesystem remains at its original size. Option C is wrong because it attempts to extend the logical volume before adding the physical volume and extending the volume group; the volume group has no free extents, so lvextend will fail immediately. Option D is wrong because it unnecessarily partitions the disk with fdisk and creates a filesystem with mkfs.ext4 on the partition before creating the physical volume; pvcreate expects a block device (partition or whole disk) without a filesystem, and the mkfs.ext4 step is redundant and incorrect for LVM.

185
MCQmedium

A system administrator needs to replace all occurrences of 'enabled' with 'disabled' in /etc/ssh/sshd_config, but only on lines that do not start with '#'. Which sed command accomplishes this?

A.sed '/^#/!s/enabled/disabled/g' /etc/ssh/sshd_config
B.sed 's/enabled/disabled/g' /etc/ssh/sshd_config
C.sed -n '/^#/!s/enabled/disabled/gp' /etc/ssh/sshd_config
D.sed '/^#/s/enabled/disabled/g' /etc/ssh/sshd_config
AnswerA

The address '/^#/!' uses negated matching: sed applies the following command only to lines that do not begin with '#', i.e., active configuration directives. The s/enabled/disabled/g substitution then replaces every occurrence of 'enabled' with 'disabled' on those lines, with the g flag ensuring all matches per line, not just the first. Because sed's default action prints every input line, the output stream contains the complete updated file, and comment lines remain untouched as required.

Why this answer

It uses an address range `/^#/!` to negate lines starting with `#` (comments), then applies the substitution `s/enabled/disabled/g` only to non-comment lines. The `!` operator inverts the match, so the command acts on lines that do NOT match the pattern, which is exactly what the requirement specifies.

Exam trap

The trap here is that candidates may confuse the `!` negation operator with the `-n` suppress-print option, or mistakenly apply the substitution to commented lines instead of non-commented lines, leading to incorrect configuration changes.

How to eliminate wrong answers

Option B is wrong because it applies the substitution to all lines, including commented lines, which violates the requirement to only change lines that do not start with `#`. Option C is wrong because the `-n` flag suppresses automatic printing, and `gp` prints only lines where a substitution occurred; this would output only changed lines, not the entire file, so it does not produce the full modified configuration. Option D is wrong because the address `/^#/` selects only lines that start with `#` (comments), so the substitution is applied to comments instead of non-comment lines, which is the opposite of what is needed.

186
MCQhard

Refer to the exhibit. After mounting /dev/sdb1 with the noexec option, a script located at /mnt/data/test.file cannot be executed. What change will allow execution while maintaining security?

A.Copy the script to /tmp and run from there
B.Use chmod +x /mnt/data/test.file
C.Change the mount option to exec in /etc/fstab and remount
D.Remount without noexec and add setuid bit
AnswerC

Alter the /etc/fstab entry for /dev/sdb1 to include exec (or remove noexec), then run mount -o remount /mnt/data to re-read the options without a full unmount. This tells the kernel that the filesystem is allowed to serve as a source of executable programs. Using fstab ensures the change survives a reboot, and the remount applies it immediately to the mounted filesystem.

Why this answer

The noexec mount option prevents execution of any binaries or scripts on the filesystem, regardless of file permissions. To allow execution while maintaining security, you must change the mount option to exec in /etc/fstab and remount the filesystem (e.g., mount -o remount,exec /mnt/data). This approach preserves other mount options and avoids the security risks of removing noexec globally.

Exam trap

In RHEL, the noexec mount option overrides any execute permissions set on files, regardless of chmod. The common mistake is trying to fix permissions instead of modifying the mount options via /etc/fstab and remounting with exec.

How to eliminate wrong answers

Option A is wrong because copying the script to /tmp does not change the mount options on /mnt/data; /tmp may also be mounted with noexec, and even if it is not, this workaround bypasses the intended security policy without addressing the underlying filesystem configuration. Option B is wrong because chmod +x sets the executable permission bit on the file, but the noexec mount option overrides file permissions entirely—execution is blocked at the kernel level regardless of the file's mode. Option D is wrong because remounting without noexec and adding the setuid bit introduces a significant security risk (setuid allows the script to run with the privileges of its owner, often root), and the question asks to maintain security while allowing execution, not to escalate privileges.

187
MCQmedium

An administrator wants to optimize system performance for a database workload. Which tool should be used to select a performance profile?

A.performance-tune --profile database
B.setroubleshoot
C.tuned-adm profile throughput-performance
D.systemctl set-profile database
AnswerC

`tuned-adm profile throughput-performance` is the correct command: it tells the `tuned` daemon to activate the `throughput-performance` profile, which tunes the system for maximum throughput by adjusting settings such as the CPU governor, kernel scheduler, and virtual memory parameters. This command requires the `tuned` package to be installed and the `tuned` service to be active; once applied, the profile persists across reboots automatically.

Why this answer

C is correct because `tuned-adm profile throughput-performance` selects a Tuned performance profile optimized for high throughput, which is suitable for database workloads that benefit from increased I/O and network performance. Tuned is the systemd-based dynamic system tuning daemon in RHEL that adjusts kernel parameters, disk schedulers, and other settings based on the selected profile.

Exam trap

The trap here is that candidates may confuse `tuned-adm` with non-existent commands like `performance-tune` or incorrectly assume `systemctl` can manage performance profiles, when in fact Tuned is a separate service controlled via `tuned-adm`.

How to eliminate wrong answers

Option A is wrong because `performance-tune` is not a valid command in RHEL; the correct tool for managing performance profiles is `tuned-adm`. Option B is wrong because `setroubleshoot` is a tool for diagnosing SELinux denials, not for selecting performance profiles. Option D is wrong because `systemctl set-profile` is not a valid systemctl command; systemctl manages systemd units and services, not performance tuning profiles.

188
Multi-Selecthard

An administrator wants to change the default systemd target to multi-user.target. Which three steps are part of a correct procedure? (Choose three.)

Select 3 answers
A.systemctl enable multi-user.target
B.systemctl start multi-user.target
C.systemctl isolate multi-user.target
D.ln -sf /lib/systemd/system/multi-user.target /etc/systemd/system/default.target
E.systemctl set-default multi-user.target
AnswersC, D, E

systemctl isolate multi-user.target is correct because it atomically switches the currently running target by stopping all units not required by multi-user.target and starting the required ones, effectively performing a runtime runlevel switch. This is the proper way to change the active target immediately, and while it does not modify the default for future boots, it is the necessary command to apply a target change without a reboot.

Why this answer

`systemctl isolate multi-user.target` immediately switches the current systemd target to multi-user.target, which is the correct way to change the active target at runtime without a reboot. This command stops all units not required by the new target and starts those that are, effectively changing the system's operational state.

Exam trap

The trap here is that candidates confuse `systemctl enable` (which controls whether a unit starts at boot) with `systemctl set-default` (which sets the default target for boot), and they may think `systemctl start` is sufficient to change the active target, not realizing that `isolate` is required to properly transition systemd to a different target.

189
MCQmedium

A server running Red Hat Enterprise Linux 9 experiences high system load (load average 15 on a 4-core system) and slow response times. The administrator runs 'top' and sees that the 'kworker' processes are consuming significant CPU time. Further investigation reveals that the system is performing heavy I/O operations on the root filesystem, which is formatted as XFS. The administrator wants to reduce the impact of filesystem maintenance tasks on system performance. Which of the following actions should the administrator take?

A.Increase the value of the 'nr_requests' queue parameter for the underlying block device.
B.Mount the filesystem with the 'noatime' option to reduce metadata updates.
C.Schedule filesystem checks (fsck) to run during off-peak hours using a cron job.
D.Set the dirty ratio sysctl parameters (vm.dirty_ratio and vm.dirty_background_ratio) to lower values.
AnswerD

Lowering vm.dirty_ratio and vm.dirty_background_ratio reduces the amount of dirty page cache allowed to accumulate before the kernel forces writeback. This causes the flusher threads to run more frequently with smaller batches, which smooths I/O bursts and prevents the CPU and disk from being pegged by large writeback spikes. These parameters directly control the dirty-page writeback behavior described in the scenario, making them the correct tuning target.

Why this answer

The high system load is caused by heavy I/O operations, and the kworker processes indicate kernel threads handling writeback. Lowering vm.dirty_ratio and vm.dirty_background_ratio reduces the amount of dirty pages that accumulate before writeback begins, which prevents large bursts of I/O and smooths out disk writes, thereby reducing the impact on system performance.

Exam trap

The trap here is that candidates confuse filesystem maintenance tasks (like fsck or atime updates) with kernel writeback mechanisms, and incorrectly choose options that address metadata or integrity checks rather than the actual I/O load caused by dirty page flushing.

How to eliminate wrong answers

Option A is wrong because increasing 'nr_requests' for the block device queue allows more I/O requests to be queued, which can increase latency and worsen the problem under heavy I/O, not reduce it. Option B is wrong because 'noatime' reduces metadata updates for file access times, but the issue here is heavy I/O from filesystem maintenance tasks, not atime updates; it would not address the kworker writeback load. Option C is wrong because scheduling fsck with cron is for checking filesystem integrity, not for reducing the impact of ongoing maintenance tasks; fsck is run on unmounted filesystems and does not affect runtime I/O performance.

190
MCQmedium

A system administrator needs to create a file system on /dev/sdb1 with a size of 10 GB and mount it persistently at /data. The file system should support extended attributes and be suitable for large files. Which command sequence achieves this?

A.mkfs.xfs /dev/sda1 && mkdir /data && echo '/dev/sda1 /data xfs defaults 0 0' >> /etc/fstab
B.mkfs.xfs /dev/sdb1 && mkdir /data && mount /dev/sdb1 /data && echo '/dev/sdb1 /data xfs defaults 0 0' >> /etc/fstab
C.mkfs.ext4 /dev/sdb1 && mkdir /data && mount /dev/sdb1 /data && echo '/dev/sdb1 /data ext4 defaults 0 0' >> /etc/fstab
D.mkswap /dev/sdb1 && mkdir /data && swapon /dev/sdb1 && echo '/dev/sdb1 /data swap defaults 0 0' >> /etc/fstab
AnswerB

This is the correct sequence because it creates an XFS filesystem on the intended /dev/sdb1, creates the /data mount point, immediately mounts the device with the mount command, and appends a persistent fstab entry using the xfs type. The && chain stops if any step fails, preventing a broken configuration. XFS is the default and supported filesystem for RHEL/CentOS 8+ and supports extended attributes.

Why this answer

Both XFS and ext4 support extended attributes by default in RHEL. However, XFS is optimized for large files and high performance, making it the recommended choice for this scenario. Option B correctly creates an XFS file system on /dev/sdb1, creates the mount point, mounts it immediately, and adds an fstab entry for persistence.

Option C uses ext4, which is not as suitable for large files as XFS. Options A and D are incorrect due to wrong device or file system type.

Exam trap

Red Hat often tests the requirement to mount the file system immediately after creation, not just add it to fstab, and the specific file system type (XFS vs. ext4) based on suitability for large files and extended attributes.

How to eliminate wrong answers

Option A is wrong because it uses /dev/sda1 instead of /dev/sdb1, and it does not mount the file system before adding the fstab entry, which means the mount point will not be active until a reboot. Option C is wrong because it uses mkfs.ext4 to create an ext4 file system; while ext4 supports extended attributes, it is not as suitable for very large files as XFS, and the question specifies a file system suitable for large files. Option D is wrong because mkswap creates a swap area, not a file system, and the fstab entry uses 'swap' as the file system type, which is incorrect for mounting a data directory.

191
MCQeasy

A developer wants to create a script that accepts a directory path as an argument and creates a timestamped backup of that directory. If no argument is provided, it should back up the current directory. How should the script handle the argument?

A.dir=${1:-.}
B.dir=${@:-.}
C.dir=${0:-.}
D.dir=${?:-.}
AnswerA

The parameter expansion `${1:-.}` explicitly targets the first positional parameter (`$1`) and applies the `:-` operator: if `$1` is unset or null, the expansion substitutes the literal `.` (the current directory). This precisely fulfills the requirement to accept a directory argument with a sensible default when no argument is supplied, because `$1` is the first argument passed to the script, and the default value is only used when that argument is missing or empty.

Why this answer

`${1:-.}` uses the default value substitution syntax in bash: if parameter `$1` (the first positional argument) is unset or null, it expands to `.` (the current directory). This ensures the script backs up the supplied directory path or defaults to the current directory when no argument is provided, exactly matching the requirement.

Exam trap

Red Hat often tests the distinction between positional parameters (`$1`, `$2`, etc.) and special variables (`$@`, `$0`, `$?`), and the trap here is that candidates confuse `$1` with `$0` (the script name) or incorrectly assume `$@` works as a single default value, leading to option B or C.

How to eliminate wrong answers

Option B is wrong because `${@:-.}` expands to all positional arguments (`$@`) or `.` if none are provided, but `$@` is a list, not a single directory path, and using it in a backup command would break the script. Option C is wrong because `${0:-.}` refers to the script's own name (the zeroth argument), not the first argument passed by the user, so it would always expand to the script name instead of the intended directory. Option D is wrong because `${?:-.}` is not valid bash syntax; `$?` holds the exit status of the last command, and the `:-` substitution does not apply meaningfully here, causing a syntax error or unintended behavior.

192
MCQeasy

An administrator wants to mount an existing ext4 filesystem from /dev/sdb1 to /mnt/data at boot time. What entry should be added to /etc/fstab?

A./dev/sdb1 /mnt/data xfs defaults 0 0
B.LABEL=data ext4 defaults 0 0
C./dev/sdb1 /data ext4 defaults 0 0
D./dev/sdb1 /mnt/data ext4 defaults 0 0
AnswerD

This is a valid and correct fstab entry for mounting the ext4 filesystem on /dev/sdb1 to the /mnt/data mount point. It properly specifies all six required fields: the device file, the exact mount directory, the ext4 filesystem type matching the on-disk format, the defaults option set (rw, suid, dev, exec, auto, nouser, async), and 0 for both dump and fsck pass. When the system boots or mount -a is executed, this line will mount the filesystem at /mnt/data as requested.

Why this answer

It specifies the correct device (/dev/sdb1), the correct mount point (/mnt/data), the correct filesystem type (ext4), and the correct mount options (defaults) for an ext4 filesystem to be mounted at boot. The /etc/fstab entry must include all six fields in order: device, mount point, filesystem type, options, dump, and pass.

Exam trap

The trap here is that candidates may confuse the filesystem type (ext4 vs xfs) or misremember the required mount point path (/mnt/data vs /data), leading them to select an option that looks correct but has a subtle mismatch.

How to eliminate wrong answers

Option A is wrong because it specifies xfs as the filesystem type, but the question explicitly states the filesystem is ext4. Option B is wrong because it omits the mount point and the device identifier (it uses LABEL=data but does not include a mount point or the required six-field structure). Option C is wrong because it specifies /data as the mount point, but the question requires the mount point to be /mnt/data.

193
MCQhard

A system administrator needs to ensure that a user named 'bob' can access a shared directory '/data' owned by group 'developers'. The directory has permissions 2775 and is owned by root:developers. Bob is a member of the 'developers' group. However, when Bob tries to create a file in '/data', it fails with 'Permission denied'. What is the most likely cause?

A.The directory has incorrect SELinux context
B.Bob's umask is set to 0077
C.The setgid bit is not set
D.Bob's primary group is not developers
AnswerA

Even when the directory's mode and ownership (2775, root:developers) grant Bob write access, SELinux performs a separate mandatory access control check. If /data carries a context type that Bob's domain is not allowed to write to (for example, default_t instead of a type like public_content_rw_t or a domain-specific type), the kernel denies the operation with EACCES. This appears as a permission problem though standard permissions are correct. To fix, restore or apply the correct context, e.g., restorecon -Rv /data or a custom semanage fcontext rule.

Why this answer

The directory '/data' has permissions 2775, which grants read, write, and execute to the group 'developers'. Bob is a member of 'developers', so standard Unix permissions should allow him to create files. However, the failure with 'Permission denied' despite correct group membership and permissions strongly indicates that SELinux is enforcing a policy that denies Bob write access.

The most likely cause is that the directory lacks the correct SELinux context (e.g., `default_t` instead of a type like `public_content_rw_t` or a context that allows write operations).

Exam trap

Red Hat often tests the misconception that group membership alone guarantees access, ignoring that SELinux can block operations even when Unix permissions are correct; the trap here is that candidates focus on umask or primary group instead of recognizing SELinux as the likely cause when permissions and group membership appear correct.

How to eliminate wrong answers

Option B is wrong because umask affects the default permissions of newly created files, not the ability to create them; a umask of 0077 would not cause a 'Permission denied' error when creating a file if the directory permissions allow write access. Option C is wrong because the setgid bit (2775) is already set (the '2' in the permissions), so it is not missing; the setgid bit ensures new files inherit the group, but its absence would not cause a 'Permission denied' error. Option D is wrong because Bob's primary group does not need to be 'developers'; as a member of the 'developers' group, he has group-level access to the directory regardless of his primary group.

194
MCQeasy

A technician needs to configure a network interface to use a static IP address permanently. Which command should be used in RHEL 9?

A.ip
B.vi /etc/sysconfig/network-scripts/ifcfg-eth0
C.nmcli
D.ifconfig
AnswerC

`nmcli` is the correct tool because it interacts with NetworkManager, the default network management service on RHEL 9. Commands like `nmcli con modify eth0 ipv4.addresses 192.0.2.10/24` and `nmcli con up eth0` make changes persist in the connection profile automatically. It also validates the configuration and applies it without requiring a reboot, making it the supported method for permanent network interface configuration.

Why this answer

`nmcli` is the primary command-line tool for managing NetworkManager in RHEL 9, and it allows you to configure a static IP address persistently. Using `nmcli con mod` followed by the connection name and IP settings ensures the configuration survives reboots, as NetworkManager stores the settings in its own configuration files.

Exam trap

The trap here is that candidates familiar with older RHEL versions (e.g., RHEL 7 or 8) may still expect the legacy `ifcfg-*` files to work, but RHEL 9 has fully transitioned to NetworkManager keyfiles, making `nmcli` the correct persistent tool.

How to eliminate wrong answers

Option A is wrong because `ip` is a low-level tool for viewing and temporarily changing network parameters (e.g., IP addresses, routes) at runtime; it does not write persistent configuration to any file, so changes are lost after a reboot. Option B is wrong because RHEL 9 no longer uses the legacy `ifcfg-*` files in `/etc/sysconfig/network-scripts/` by default; NetworkManager ignores these files unless explicitly configured, and the correct persistent method is via `nmcli` or `nmtui`. Option D is wrong because `ifconfig` is deprecated and not installed by default in RHEL 9; it only makes temporary changes and does not support persistent configuration.

195
Multi-Selectmedium

An administrator needs to configure a static IP address on an interface that will persist across reboots using NetworkManager. Which TWO commands or files can be used to achieve this?

Select 2 answers
A.systemctl restart network
B.nmcli con up eth0
C.nmcli con mod eth0 ipv4.addresses 192.168.1.10/24
D.Edit /etc/sysconfig/network-scripts/ifcfg-eth0
E.ip addr add 192.168.1.10/24 dev eth0
AnswersC, D

This NetworkManager command modifies the persistent connection profile assigned to eth0, storing the IPv4 address 192.168.1.10/24 within that profile's configuration. Because the change is saved to a NetworkManager-backed file (or to /etc/sysconfig/network-scripts/ifcfg-eth0 on RHEL 7), it remains in effect across reboots; to apply it immediately you would reactivate the connection with 'nmcli con up eth0'. Along with the address, you would normally also set 'ipv4.method manual' to fully define a static configuration, but this command is the core persistent address-setting step.

Why this answer

The `nmcli con mod` command modifies the NetworkManager connection profile for the interface, setting a static IPv4 address that is stored persistently in the connection configuration. Option D is correct because editing the `/etc/sysconfig/network-scripts/ifcfg-eth0` file directly defines the static IP address in the ifcfg format, which NetworkManager reads on boot to apply persistent settings.

Exam trap

The trap here is that candidates confuse runtime commands like `ip addr add` (which are temporary) with persistent configuration methods, or they mistakenly think restarting the network service (systemctl restart network) will save the IP address, when in fact it only reloads existing configurations without making changes permanent.

196
Multi-Selecthard

Which THREE of the following are valid and recommended practices when writing shell scripts for RHEL?

Select 3 answers
A.Using 'local' keyword for variable declarations inside functions.
B.Always quoting variable expansions with double quotes.
C.Using [[ $var =~ regex ]] for pattern matching.
D.Using 'set -e' to exit on non-zero exit codes.
E.Using the 'source' command instead of '.' for readability.
AnswersA, B, C

Declaring variables with `local` inside a function constrains their scope to that function and its called subshells, preventing them from leaking into and clobbering global variables. This avoids hard-to-trace side effects, strengthens reusability and recursion, and is a core principle of writing clean, modular Bash functions.

Why this answer

The 'local' keyword restricts a variable's scope to the function where it is declared, preventing unintended side effects on global variables. This is a recommended practice in RHEL shell scripting to maintain modularity and avoid namespace pollution.

Exam trap

In Red Hat RHCSA exams, the trap is that candidates may think 'set -e' is always a best practice for error handling, but Red Hat expects you to recognize that it can cause premature exits in scripts where non-zero exit codes are expected and handled conditionally.

197
MCQhard

Alice tries to run 'sudo less /var/log/messages' and gets 'Sorry, user alice is not allowed to execute /usr/bin/less /var/log/messages as root on this host.' Why?

A.The command path must exactly match, including arguments
B.The secure_path does not include /usr/bin
C.The sudoers allows only specific commands with specific arguments
D.The /var/log/messages file does not exist
AnswerC

This is the correct reason. A sudoers entry such as 'alice ALL=(root) /usr/bin/less /var/log/secure' grants permission only for that exact command line, including the specific argument. Because alice is attempting '/usr/bin/less /var/log/messages', sudo finds no matching entry in the user's command list and reports 'not allowed to execute'—the error is purely a policy mismatch.

Why this answer

Sudoers rules can restrict commands to specific arguments. The error message indicates that the sudoers configuration explicitly allows 'less' only with certain arguments (or none), and the attempt to run 'less /var/log/messages' violates that restriction. Sudo matches both the command path and the argument list against the sudoers entries, and if the arguments do not match, access is denied.

Exam trap

Red Hat RHCSA often tests the misconception that sudo denies commands based on the binary path alone, when in fact argument-specific restrictions in sudoers are the cause of such errors.

How to eliminate wrong answers

Option A is wrong because sudo does not require the command path to include arguments in the sudoers rule; arguments are matched separately, and the error is not about path mismatch. Option B is wrong because secure_path affects the default PATH for commands run via sudo, but the error message explicitly states the command '/usr/bin/less /var/log/messages' is not allowed, indicating the path is resolved and the issue is with the argument restriction. Option D is wrong because if the file did not exist, sudo would still execute less (which would then fail with a 'No such file' error), not produce a sudo permission error.

198
MCQhard

A system administrator notices that a server is responding slowly. The administrator runs `top` and sees a process named `backup_script` consuming 95% CPU. The process runs as root and is supposed to run nightly backups. However, the system load average is low. The administrator wants to investigate without killing the process. Which of the following is the best course of action?

A.Use `renice -n 19 -p <PID>` to lower the priority of the process.
B.Use `nice -n 19 ./backup_script` to start the process with lower priority next time.
C.Use `chrt -i 0 <PID>` to set the scheduling policy to idle.
D.Use `kill -STOP <PID>` to pause the process and then resume later.
AnswerA

renice changes the nice value of an already-running process; specifying -n 19 with -p <PID> sets it to the lowest dynamic priority while leaving the process in a Running (or sleepable) state. This reduces its CPU scheduler share so interactive workloads are less affected, and the backup continues making progress rather than being suspended or restarted.

Why this answer

`renice -n 19 -p <PID>` lowers the CPU scheduling priority of the running `backup_script` process to the lowest possible value (19), which reduces its CPU consumption without killing it. This allows the administrator to investigate the cause of the high CPU usage while minimizing the impact on other processes and system responsiveness.

Exam trap

Red Hat often tests the distinction between `nice` (for starting a new process) and `renice` (for adjusting an existing process), and candidates may confuse the two or think `nice` can be applied to a running process.

How to eliminate wrong answers

Option B is wrong because `nice` sets the priority of a new process, not an already running one; the administrator needs to adjust the priority of the currently running `backup_script`, not start a new instance. Option C is wrong because `chrt -i 0 <PID>` sets the scheduling policy to SCHED_IDLE, which is an idle scheduling class that only runs when no other process needs the CPU, but this is a more drastic change than needed and may not be appropriate for a backup script that should eventually complete; also, the `-i` option is for SCHED_IDLE, but the correct syntax for setting idle policy is `chrt -i 0 <PID>` (though `chrt` typically uses `-i` for idle, but the policy value 0 is for SCHED_OTHER, not idle — the trap is that `chrt -i` expects a priority argument, and 0 is not valid for idle). Option D is wrong because `kill -STOP` pauses the process, which would halt the backup entirely, preventing it from completing its work and potentially leaving data in an inconsistent state; the administrator wants to investigate without killing or stopping the process.

199
MCQhard

Which of the following is the correct way to persistently mount a filesystem using its UUID?

A.LABEL=1234 /mnt xfs defaults 0 0
B.UUID=1234 /mnt xfs defaults 0 0
C./dev/disk/by-uuid/1234 /mnt xfs defaults 0 0
D.PARTUUID=1234 /mnt xfs defaults 0 0
AnswerB

This is the correct fstab entry because UUID= directly references the filesystem's unique identifier, which is stored in the XFS superblock. The first field of an fstab line may use UUID= to make the mount permanent and independent of device names like /dev/sdb1, which can change across reboots. The remaining fields specify the mount point (/mnt), filesystem type (xfs), options (defaults), dump (0), and fsck pass (0), exactly as required.

Why this answer

The /etc/fstab entry uses the 'UUID=' prefix followed by the actual UUID value to persistently mount a filesystem. The kernel reads this line at boot time and resolves the UUID to the corresponding block device, ensuring the mount is consistent regardless of device name changes.

Exam trap

The trap here is that candidates confuse the 'UUID=' fstab syntax with the /dev/disk/by-uuid/ path, or mistakenly think 'LABEL=' or 'PARTUUID=' are interchangeable with UUID for filesystem identification.

How to eliminate wrong answers

Option A is wrong because it uses 'LABEL=' with a numeric string that looks like a UUID, but LABEL expects a filesystem label, not a UUID; the correct syntax for a label mount is 'LABEL=labelname'. Option C is wrong because it uses a device path under /dev/disk/by-uuid/ which is not a valid fstab format; fstab requires either 'UUID=' or 'LABEL=' for persistent identification, not a full path. Option D is wrong because 'PARTUUID=' refers to the partition table UUID (GPT partition unique identifier), not the filesystem UUID; while PARTUUID can be used for mounting, the question specifically asks for the filesystem UUID.

200
Multi-Selectmedium

Which THREE actions will create a new empty file named 'testfile' in the current directory? (Choose three.)

Select 3 answers
A.> testfile
B.ls > testfile
C.touch testfile
D.cp /dev/null testfile
E.echo "content" > testfile
AnswersA, C, D

This is a shell redirection with no command preceding the operator. The shell opens (or creates) the file with O_CREAT and O_TRUNC flags, and because nothing is written to stdout, the resulting regular file has zero length. This is one of the classic methods for creating an empty file, and it will also truncate an existing file to zero bytes.

Why this answer

The shell redirection operator `>` without a preceding command truncates or creates the specified file. When used alone, `> testfile` opens 'testfile' for writing, which creates an empty file if it does not exist, or truncates it to zero length if it does. This is a standard POSIX shell feature.

Exam trap

The trap here is that candidates may think only `touch` creates an empty file, overlooking the shell redirection operator `>` used alone and the `cp /dev/null` technique, both of which are valid methods for creating or truncating files to empty.

201
MCQmedium

An administrator wants to ensure that any new user accounts created on the system have a default primary group matching the username. What change is needed?

A.Set GROUP to same name in /etc/default/useradd
B.Set USERGROUPS_ENAB to no; then create user with -g
C.Set USERGROUPS_ENAB to yes in /etc/login.defs
D.Set CREATE_HOME to yes in /etc/login.defs
AnswerC

When USERGROUPS_ENAB is set to yes, useradd automatically creates a private group whose name and GID match the new username and sets that group as the user's primary group. This is the default behavior on RHEL and derivatives, providing a one-to-one mapping between user and group. As long as this setting remains enabled, every new user account will have its own private primary group.

Why this answer

Setting USERGROUPS_ENAB to yes in /etc/login.defs instructs the useradd command to automatically create a private group with the same name as the new user and assign it as the user's primary group. This is the default behavior in Red Hat Enterprise Linux and ensures that each new user has a matching primary group without manual intervention.

Exam trap

The trap here is that candidates often confuse the GROUP setting in /etc/default/useradd (which sets a fixed default group) with the USERGROUPS_ENAB mechanism that dynamically creates a matching group, leading them to incorrectly select Option A.

How to eliminate wrong answers

Option A is wrong because the GROUP setting in /etc/default/useradd specifies the default primary group for new users (e.g., GROUP=100 for users group), not a group matching the username. Option B is wrong because setting USERGROUPS_ENAB to no disables the automatic creation of a private group, and using -g manually would require the group to already exist, not create it automatically. Option D is wrong because CREATE_HOME controls whether a home directory is created for new users, not the primary group assignment.

202
MCQmedium

An administrator wants to install a package 'httpd' but only if it is available in the configured repositories. Which command should be used to check if the package exists?

A.rpm -q httpd
B.dnf search httpd
C.dnf list available httpd
D.dnf install httpd
AnswerC

dnf list available httpd asks DNF to query the enabled repository metadata and display only packages that are not yet installed and whose name exactly matches 'httpd'. The output shows the version and repository source, proving availability. Because it targets the exact package name and filters to available packages, it is the most precise way to verify httpd can be installed.

Why this answer

`dnf list available httpd` queries the configured DNF repositories and displays the package only if it exists in them. This command checks availability without installing, which matches the requirement to verify the package is present in the repositories before proceeding.

Exam trap

The trap here is that candidates often confuse `rpm -q` (which checks local installation status) with repository availability checks, or they mistakenly think `dnf search` is the correct command for listing available packages, when in fact `dnf list available` is the precise tool for this task.

How to eliminate wrong answers

Option A is wrong because `rpm -q httpd` checks if the package is already installed on the system, not whether it is available in repositories. Option B is wrong because `dnf search httpd` searches package names and descriptions across repositories but does not specifically list only available packages; it may return partial matches and is not the standard command for confirming availability. Option D is wrong because `dnf install httpd` attempts to install the package immediately, which does not fulfill the requirement to check existence first without making changes.

203
Multi-Selectmedium

Which two commands can be used to view systemd journal entries for the sshd service?

Select 2 answers
A.journalctl -u sshd
B.systemctl status sshd
C.journalctl _SYSTEMD_UNIT=sshd.service
D.grep sshd /var/log/messages
E.tail -f /var/log/secure
AnswersA, C

The `journalctl -u sshd` command is the standard way to query the systemd journal for all log messages associated with the sshd unit. The `-u` flag filters by unit name, showing entries from both the current boot and previous boots if persistent journaling is enabled. This command reads the binary journal directly, making it the accurate and complete method for viewing a service's logs.

Why this answer

`journalctl -u sshd` filters the systemd journal to show only log entries associated with the `sshd.service` unit. This is the standard way to view service-specific logs in a systemd-based system, as it uses the unit name directly. Option C is also correct because `_SYSTEMD_UNIT=sshd.service` is a systemd journal field that matches the exact unit name, providing an equivalent filter to `-u sshd`.

Exam trap

On Red Hat Enterprise Linux (RHEL) systems with systemd, the primary logging mechanism is the journal. The trap is that candidates may mistakenly use `systemctl status sshd` (which only shows a snippet) or rely on legacy syslog files like `/var/log/messages` or `/var/log/secure` instead of `journalctl`.

204
Multi-Selecteasy

Which TWO commands can be used to create a new user account in Red Hat Enterprise Linux 8?

Select 2 answers
A.adduser
B.groupadd
C.usermod
D.passwd
E.useradd
AnswersA, E

On RHEL, adduser is a symbolic link to useradd, so it invokes the exact same low-level tool and creates a user account with the defaults defined in /etc/login.defs and /etc/default/useradd. Because it is just an alias, it does not provide an interactive front-end as it does on Debian-based systems, but it is still a valid way to create a new user.

Why this answer

Both `adduser` and `useradd` are commands that create a new user account in Red Hat Enterprise Linux 8. `adduser` is a symbolic link to `useradd` in RHEL 8, so they perform the same function. The `useradd` command creates a new user with default settings from `/etc/default/useradd` and `/etc/login.defs`, while `adduser` behaves identically.

Exam trap

The trap here is that candidates may think `adduser` is a separate, interactive command (as in Debian-based systems), but in RHEL 8 it is identical to `useradd`, and `passwd` or `groupadd` are often mistakenly chosen for user creation.

205
MCQmedium

A system administrator needs to run a container that remains running in the background and executes a web server. Which podman command will correctly run the container detached and map host port 8080 to container port 80?

A.podman run -d -p 8080:80 nginx
B.podman run -d -p 80:8080 nginx
C.podman run -d --expose 80 nginx
D.podman run -d -P 8080:80 nginx
AnswerA

The -d flag detaches the container, keeping it running in the background even after your shell exits. The -p flag publishes a port mapping in the form host:container, so -p 8080:80 exposes the container's port 80 (where nginx serves HTTP) on the host's port 8080. This meets the requirement of a persistent, reachable container. Because the mapping order is correct, startup will succeed and traffic to localhost:8080 reaches nginx.

Why this answer

`podman run -d` runs the container in detached mode (background), and `-p 8080:80` maps host port 8080 to container port 80, which is the standard port for the nginx web server. This allows external traffic on host port 8080 to be forwarded to the nginx service inside the container.

Exam trap

The trap here is confusing the order of the port mapping (`host_port:container_port`) with the reverse, and mistaking `--expose` for a functional port publishing mechanism instead of a documentation-only flag.

How to eliminate wrong answers

Option B is wrong because it maps host port 80 to container port 8080, which would not serve the web server (nginx listens on port 80 by default) and would require the container to be configured to listen on port 8080. Option C is wrong because `--expose 80` only documents that port 80 is exposed in the container metadata but does not publish any ports to the host, so the web server would not be accessible from outside. Option D is wrong because `-P` (capital P) automatically publishes all exposed ports to random high-numbered host ports, and the syntax `-P 8080:80` is invalid; `-P` does not accept a port mapping argument.

206
MCQhard

A container exits immediately with status 1. The administrator runs 'podman logs container' but sees no output. What is the most likely reason for the missing logs?

A.The container binary is missing or has the wrong architecture (exec format error).
B.The container's logging driver is not configured to capture stdout.
C.The log file is rotated and cleared.
D.The container is using a non-standard log location inside the container.
AnswerA

When a container exits immediately with status 1 and no output, the kernel often returns ENOEXEC ('exec format error') because the configured entrypoint or command is not a valid executable for the host architecture. This occurs when the image was built for a different CPU architecture (e.g., ARM on x86_64) or when a script's shebang points to a missing interpreter. The container's main process never actually runs, so no stdout/stderr is generated, making logs appear empty. Therefore, the correct action is to verify the image architecture and the executable's format using 'file' and 'podman inspect'.

Why this answer

When a container exits immediately with status 1 and `podman logs` shows no output, the most common cause is that the container binary is missing or has the wrong architecture (e.g., an x86 binary on an ARM system). This results in an 'exec format error' that prevents the container's entrypoint from executing, so no stdout/stderr is ever written to the logging driver. The container exits before any process runs, leaving the log buffer empty.

Exam trap

Red Hat often tests the misconception that missing logs are always due to a logging configuration issue, but the trap here is that an immediate exit with status 1 and no output points to a failure before any process runs, such as an exec format error.

How to eliminate wrong answers

Option B is wrong because Podman's default logging driver (journald) captures stdout/stderr from the container's PID 1; if the container never starts a process, there is nothing to capture, so the driver is not the issue. Option C is wrong because log rotation or clearing would not cause an immediate exit with status 1 and zero logs; rotated logs would still show prior output if any existed. Option D is wrong because `podman logs` only reads from the container's configured log driver (stdout/stderr), not from files inside the container; a non-standard log location inside the container is irrelevant to the `podman logs` command.

207
Multi-Selecthard

Which TWO LVM commands can be used to reduce the size of a logical volume?

Select 2 answers
A.lvresize
B.lvchange
C.lvreduce
D.lvdisplay
E.lvextend
AnswersA, C

lvresize is the general-purpose LVM command for altering a logical volume's size, and it can both increase and decrease the volume equally well. When reducing an LV, you specify a smaller size (absolute, by extent count, or as a percentage), and it will adjust the LV accordingly, optionally resizing the underlying filesystem with the -r/--resizefs flag if the filesystem supports it. Because it handles both directions, it is one of the two valid commands for shrinking an LV.

Why this answer

Both `lvresize` and `lvreduce` can reduce the size of a logical volume. `lvresize` is the general-purpose command for resizing LVs, and when used with the `-L` or `--size` option to specify a smaller size, it shrinks the volume. `lvreduce` is a dedicated command that specifically reduces the size of a logical volume, offering the same functionality as `lvresize --size` but with a more explicit name. Both commands require the filesystem to be shrunk first (if it contains data) using tools like `resize2fs` or `xfs_growfs` (though XFS cannot be shrunk).

Exam trap

The trap here is that candidates often assume only `lvreduce` can shrink a volume, forgetting that `lvresize` is a universal tool that can both increase and decrease size, making both correct answers.

208
MCQeasy

Which command initializes a disk partition as a physical volume for LVM?

A.fdisk
B.vgcreate
C.lvcreate
D.pvcreate
AnswerD

pvcreate is the correct command because it initializes a disk or partition as an LVM physical volume by writing an LVM label and metadata area at a specific offset on the device. This action assigns a unique PV ID and records the device in LVM's configuration, allowing it to later be added to a volume group with vgcreate. Without this initialization, other LVM tools cannot recognize the device, so pvcreate always precedes vgcreate and lvcreate in the LVM workflow.

Why this answer

`pvcreate` is the LVM command specifically designed to initialize a disk partition as a physical volume (PV), which is the first step in creating an LVM logical volume. Without a PV, LVM cannot manage the underlying block device. The command writes LVM metadata to the partition, marking it as available for inclusion in a volume group.

Exam trap

The trap here is that candidates confuse the LVM creation sequence and select `fdisk` (which only partitions the disk) instead of `pvcreate` (which initializes the partition for LVM use), or select `vgcreate` or `lvcreate` which operate on already-initialized physical volumes.

How to eliminate wrong answers

Option A is wrong because `fdisk` is a partitioning tool used to create or modify partition tables on a disk, not to initialize a partition as an LVM physical volume. Option B is wrong because `vgcreate` creates a volume group from one or more existing physical volumes, not initializes a partition as a PV. Option C is wrong because `lvcreate` creates a logical volume within an existing volume group, which requires physical volumes and a volume group to already exist.

209
MCQmedium

An administrator wants newly created files to be readable and writable only by the owner, and readable by group and others. Which umask value should be set?

A.027
B.022
C.002
D.077
AnswerB

With umask 022, the mask removes the write bit from group and others (2 = write) from the base 666, resulting in files with 644. That gives the owner read/write and both the group and others read permission, so every user can read the file. This is the standard, desired value for making newly created files world-readable.

Why this answer

The umask value 022 removes write permissions for group and others, while leaving read and execute permissions intact. Since the default base permissions for files are 666 (rw-rw-rw-), applying umask 022 results in 644 (rw-r--r--), which gives the owner read/write access and group/others read-only access — exactly matching the requirement.

Exam trap

A common pitfall is confusing the umask as the permissions to grant rather than to subtract. In Red Hat Enterprise Linux, the default file creation mask is 022, which results in files with 644 permissions (rw-r--r--). Candidates often incorrectly select 002 (which would allow group write) or 077 (which would remove all group/other permissions).

How to eliminate wrong answers

Option A (027) is wrong because it removes read and execute permissions from others (resulting in 640 for files), making files unreadable by others, which violates the requirement. Option C (002) is wrong because it only removes write permissions from others (resulting in 664), leaving group with write access, which is not allowed. Option D (077) is wrong because it removes all permissions for group and others (resulting in 600), making files completely inaccessible to anyone except the owner.

210
MCQmedium

A script needs to execute a command that might fail, but the script should continue. The administrator wants to capture the exit status for logging. Which code snippet correctly implements this?

A.set -e; ./risky_command; rc=$?; echo $rc
B.rc=$? ./risky_command; echo $rc
C../risky_command; rc=$?; echo $rc
D../risky_command && rc=$?; echo $rc
AnswerC

The semicolon is a command terminator that allows rc=$? to execute regardless of how risky_command exited. After risky_command finishes, $? holds its exact exit status, and the assignment immediately stores it before any other command or expansion can alter it. The subsequent echo $rc then prints the saved value, making this the correct pattern for capturing a failure status without terminating the script.

Why this answer

It runs the risky command, captures its exit status immediately after in the `$?` variable, and then echoes it for logging. The script continues regardless of the command's success or failure, which meets the requirement. The `$?` variable holds the exit status of the last executed foreground command, so assigning it to `rc` right after `./risky_command` ensures the correct value is stored.

Exam trap

In Red Hat Enterprise Linux shell scripting, a common mistake is to use `set -e` or conditional operators like `&&` when the goal is to capture the exit status regardless of success or failure. The correct approach is to assign `$?` unconditionally immediately after the command.

How to eliminate wrong answers

Option A is wrong because `set -e` causes the shell to exit immediately if any command fails, which contradicts the requirement that the script should continue after a failure. Option B is wrong because `rc=$? ./risky_command` sets `rc` in the environment of `./risky_command` (not the current shell) and `$?` is evaluated before the command runs, so `rc` gets the exit status of the previous command, not `./risky_command`. Option D is wrong because `&&` makes the assignment `rc=$?` conditional on `./risky_command` succeeding; if the command fails, `rc` is never assigned, and the exit status is lost.

211
Multi-Selectmedium

Which three network configuration methods are valid in RHEL 8/9?

Select 3 answers
A.system-config-network
B./etc/sysconfig/network-scripts/ifcfg-* files
C.nmcli
D.ip command
E.ifconfig
AnswersB, C, D

The /etc/sysconfig/network-scripts/ifcfg-* files define persistent network interface settings such as IP addressing, boot protocol, and device name. While NetworkManager by default does not automatically manage interfaces configured only via these files, it can still read them, and they are recognized by the system as a valid legacy configuration mechanism. In fact, RHEL 8 and RHEL 9 continue to support ifcfg files, though they are deprecated in favor of NetworkManager keyfiles.

Why this answer

In RHEL 8/9, the traditional `/etc/sysconfig/network-scripts/ifcfg-*` files are still supported for backward compatibility, though NetworkManager is the default service. These files define interface configurations using variables like `DEVICE`, `BOOTPROTO`, and `ONBOOT`, and are read by the `ifup`/`ifdown` scripts or NetworkManager when configured to use them. This method remains valid for static or DHCP-based network setup without requiring a GUI.

Exam trap

The trap here is that candidates confuse deprecated tools (like `ifconfig` and `system-config-network`) with valid configuration methods, or assume that any command that can set an IP address qualifies as a persistent network configuration method.

212
MCQmedium

Refer to the exhibit. An administrator wants to mount /dev/sdc1 on /mnt/storage. What must be done first?

A.Mount /dev/sdc directly
B.Add an entry to /etc/fstab
C.Create a partition on /dev/sdc
D.Run mkfs.xfs /dev/sdc1
AnswerC

The exhibit shows /dev/sdc as a whole disk with no recognized partitions (e.g., no /dev/sdc1). Before you can format and mount storage, you must create a partition table and a partition on the disk using a tool such as parted or fdisk. This step creates the necessary block device /dev/sdc1, which can then be formatted with mkfs.xfs and mounted. Without a partition, neither the device name referenced in the question nor a filesystem exists.

Why this answer

The exhibit shows that /dev/sdc has no partition table (it is a raw disk). Before you can mount a filesystem on /dev/sdc1, you must first create a partition on /dev/sdc using a tool like fdisk or parted. Without a partition, the block device /dev/sdc1 does not exist, so any mount attempt would fail with a 'no such device' error.

Exam trap

A common pitfall in the Red Hat RHCSA exam is thinking you can directly mount a raw disk or create a filesystem on a non-existent partition, leading candidates to select mkfs.xfs or /etc/fstab before partitioning.

How to eliminate wrong answers

Option A is wrong because mounting /dev/sdc directly would attempt to mount the whole disk without a partition table, which is not a standard practice and would fail unless the disk contains a filesystem written directly to it (which is not the case here). Option B is wrong because adding an entry to /etc/fstab is only useful after the partition and filesystem exist; it does not create the partition or the block device. Option D is wrong because running mkfs.xfs /dev/sdc1 requires that /dev/sdc1 already exists as a valid block device; you cannot create a filesystem on a non-existent partition.

213
MCQmedium

A system has a new disk /dev/sdb that needs to be used as an LVM physical volume for an existing volume group 'vg_data'. Which sequence of commands is correct?

A.vgcreate vg_data /dev/sdb; pvcreate /dev/sdb
B.lvextend vg_data /dev/sdb
C.pvcreate /dev/sdb; vgcreate vg_data /dev/sdb
D.pvcreate /dev/sdb; vgextend vg_data /dev/sdb
AnswerD

This is the correct procedure: pvcreate writes LVM metadata onto /dev/sdb, turning it into a physical volume ready for LVM to use. vgextend then adds that PV to the existing vg_data volume group, increasing the VG's total available physical extents. This is the standard way to grow a volume group with a freshly added disk, after which logical volume capacity can be expanded with lvextend.

Why this answer

The disk /dev/sdb must first be initialized as a physical volume using pvcreate, then added to the existing volume group vg_data using vgextend. This sequence properly extends the volume group with the new physical volume, as required by LVM.

Exam trap

The trap here is that candidates often confuse vgcreate (which creates a new volume group) with vgextend (which adds a physical volume to an existing volume group), leading them to select option C instead of D.

How to eliminate wrong answers

Option A is wrong because vgcreate creates a new volume group, but the question specifies an existing volume group 'vg_data', and the command order also incorrectly places vgcreate before pvcreate. Option B is wrong because lvextend extends a logical volume, not a volume group, and it requires a physical volume or logical volume path, not a volume group name. Option C is wrong because vgcreate would attempt to create a new volume group named 'vg_data', which already exists, causing a conflict; the correct command to add a physical volume to an existing volume group is vgextend, not vgcreate.

214
MCQmedium

A system administrator needs to extend an existing logical volume 'lv_data' in volume group 'vg_data'. The administrator has already added a new physical volume /dev/sdd1 to the volume group. Which sequence of commands should be used to complete the extension and ensure the filesystem is usable?

A.lvextend -L +10G /dev/vg_data/lv_data; mount /dev/vg_data/lv_data; resize2fs /dev/vg_data/lv_data
B.lvextend -L +10G /dev/vg_data/lv_data; resize2fs /dev/vg_data/lv_data
C.lvextend -L +10G /dev/vg_data/lv_data; mkfs.ext4 /dev/vg_data/lv_data
D.lvresize -L +10G /dev/vg_data/lv_data; fsck /dev/vg_data/lv_data
E.vgextend vg_data /dev/sdd1; lvextend -L +10G /dev/vg_data/lv_data; resize2fs /dev/vg_data/lv_data
AnswerB

This is the correct procedure: lvextend -L +10G first expands the LV by 10 GiB, making additional physical extents available to the LV. Then resize2fs grows the ext4 filesystem to fill the enlarged block device, either online or offline, without unmounting. Because both commands operate in place and preserve the existing data, this safely completes the extension.

Why this answer

After adding a physical volume to the volume group, the logical volume must be extended with `lvextend`, and then the filesystem must be resized with `resize2fs` to use the new space. The filesystem remains mounted and usable throughout; no remount or filesystem recreation is needed.

Exam trap

The trap here is that candidates may think they need to remount the filesystem (Option A) or recreate it (Option C) after extending the logical volume, but in Red Hat Enterprise Linux, `resize2fs` can grow an ext4 filesystem online without unmounting.

How to eliminate wrong answers

Option A is wrong because `mount` is unnecessary and incorrect here — the filesystem is already mounted and does not need to be remounted after extension. Option C is wrong because `mkfs.ext4` would destroy the existing filesystem, not extend it. Option D is wrong because `fsck` checks filesystem integrity but does not resize the filesystem; also `lvresize` alone without `resize2fs` leaves the filesystem unaware of the new space.

Option E is wrong because `vgextend` has already been performed (as stated in the question), so repeating it is redundant and not part of the required sequence.

215
MCQhard

A system fails to boot because of a corrupted fstab file. The administrator boots into rescue mode from a RHEL installation ISO. Which command should be run first to mount the root filesystem read-write?

A.mount /dev/mapper/rhel-root /mnt/sysimage
B.mount -o rw,remount /sysroot
C.chroot /mnt/sysimage
D.systemctl rescue
AnswerA

When you enter RHEL rescue mode, the installer mounts the installed system's root logical volume at the /mnt/sysimage directory. This command explicitly mounts the LVM logical volume /dev/mapper/rhel-root to that expected mount point, making the filesystem contents visible so you can later chroot and repair /etc/fstab. Without this mount, the repair tools cannot access the system's configuration files.

Why this answer

In rescue mode, the root filesystem is not mounted by default. The first step is to mount the logical volume containing the root filesystem (e.g., /dev/mapper/rhel-root) to a temporary mount point like /mnt/sysimage so that you can access and repair the corrupted /etc/fstab file. Option A correctly uses the mount command with the device and mount point, which is the standard procedure for RHEL rescue environments.

Exam trap

The trap here is that candidates confuse the rescue mode mount point (/mnt/sysimage) with the emergency mode mount point (/sysroot) or attempt to use chroot before mounting, leading them to select options B or C.

How to eliminate wrong answers

Option B is wrong because /sysroot is not a standard mount point in rescue mode; the correct temporary mount point is /mnt/sysimage, and the -o rw,remount option is used to remount an already mounted filesystem, not to mount one from scratch. Option C is wrong because chroot /mnt/sysimage changes the root directory into the mounted filesystem, but it cannot be run before the filesystem is actually mounted; it is a subsequent step after mounting. Option D is wrong because systemctl rescue switches the system to rescue mode (a systemd target), but the system is already booted into rescue mode from the ISO, and this command does not mount the root filesystem.

216
MCQeasy

A container fails to start because the port it needs is already in use. Which command can the administrator use to identify the process using the port?

A.podman logs <container>
B.ss -tlnp
C.podman port -l
D.firewall-cmd --list-ports
AnswerB

ss -tlnp is correct because it directly interrogates the kernel's socket table for listening TCP endpoints. The -t option limits output to TCP, -l shows only listening sockets, -n displays numeric addresses and ports without DNS lookups, and -p appends the process ID and name that holds each socket. This lets you see exactly which host process has bound the port that the container needs, confirming the conflict at the OS level.

Why this answer

The `ss -tlnp` command displays listening TCP sockets (`-t`), numeric addresses (`-n`), and the associated process information (`-p`). This allows the administrator to identify which process (PID and program name) is bound to a specific port, directly addressing the container startup failure caused by a port conflict.

Exam trap

The trap here is that candidates often think `podman port -l` or `podman logs` can diagnose host-level port conflicts, but these commands only show container-specific information and cannot identify processes outside the container namespace.

How to eliminate wrong answers

Option A is wrong because `podman logs <container>` shows the log output of a container, not the processes using ports on the host; it cannot identify which external process is occupying the port. Option C is wrong because `podman port -l` lists port mappings for the last created container, but it does not show which process on the host is using a port; it only shows the container's port bindings. Option D is wrong because `firewall-cmd --list-ports` lists ports opened in the firewall configuration, not the actual processes or sockets using those ports; a port can be in use by a process even if it is not listed in the firewall rules.

217
MCQeasy

An administrator adds a new 100GB disk to a RHEL 9 server. Which command should be used first to verify that the kernel has detected the new disk?

A.udevadm trigger
B.dmesg | grep sd
C.fdisk -l
D.lsblk
E.partprobe
AnswerD

lsblk reads block device information directly from sysfs and the kernel device model, listing every attached disk, partition, and relevant attributes such as size, type, and mountpoint. It works without elevated privileges and produces a clean, easily parseable tree that immediately shows the newly added 100GB disk via its NAME and SIZE columns. Because it reflects the live kernel view, lsblk is the standard, first-line tool for verifying that a disk is detected.

Why this answer

The `lsblk` command lists all block devices detected by the kernel, including newly added disks, by reading the sysfs filesystem. It is the safest and most direct way to verify kernel detection without requiring root privileges or triggering side effects. Option D is correct because it immediately shows whether the 100GB disk appears in the device list.

Exam trap

The trap here is that candidates often choose `dmesg | grep sd` (Option B) because they recall kernel messages for SCSI disks, but this fails for non-SCSI devices (e.g., NVMe, virtio) and may miss the disk if the buffer has rotated, making `lsblk` the universal and correct first check.

How to eliminate wrong answers

Option A is wrong because `udevadm trigger` forces the kernel to re-evaluate device events, but it does not verify detection; it is used to reprocess rules or simulate hotplug events, not to check current state. Option B is wrong because `dmesg | grep sd` may show kernel messages about SCSI disk detection, but it is not a reliable first verification step—messages can scroll off the ring buffer, and the new disk might use a different driver (e.g., nvme, vd) not matching 'sd'. Option C is wrong because `fdisk -l` requires root privileges and may not show the disk if the partition table is unreadable or the disk is not yet partitioned; it also risks modifying the disk if used incorrectly.

Option E is wrong because `partprobe` informs the kernel of partition table changes, not disk detection; it is used after partitioning, not to verify initial kernel recognition.

218
MCQmedium

An administrator wants to view only the error messages from the kernel ring buffer since last boot. Which command should be used?

A.cat /var/log/kernel-errors
B.dmesg -p err
C.journalctl -k -p err
D.systemctl status kernel
AnswerC

journalctl -k -p err is the correct command because -k (or --dmesg) tells journalctl to show kernel messages, and -p err (or --priority=err) filters those messages to the err priority level and more severe (emerg, alert, crit, err). This works because systemd-journald captures kernel logs from /dev/kmsg and indexes them by facility and priority. It is the recommended way to view kernel errors on RHEL systems using systemd.

Why this answer

`journalctl -k -p err` filters the kernel messages (`-k`) from the systemd journal by priority level `err` (error), showing only error-level kernel messages since the last boot. This is the standard way to view kernel error messages in modern RHEL/CentOS systems using systemd-journald.

Exam trap

The trap here is that candidates may confuse `dmesg` options (using `-l` for level filtering) with `journalctl` options (using `-p` for priority), or assume a static log file exists for kernel errors, leading them to pick option A or B.

How to eliminate wrong answers

Option A is wrong because `/var/log/kernel-errors` is not a standard log file; kernel messages are stored in the kernel ring buffer and accessed via `dmesg` or `journalctl`, not a dedicated file. Option B is wrong because `dmesg -p err` is invalid syntax; `dmesg` uses `-l` (level) to filter by priority, not `-p`. Option D is wrong because `systemctl status kernel` is not a valid systemctl command; systemctl manages services, not the kernel directly.

219
MCQmedium

A web server running Apache (httpd) on RHEL 9 serves content from /var/www/custom. Clients get a 403 error. The SELinux context on files is system_u:object_r:default_t:s0. Which command resolves the issue persistently without disabling SELinux?

A.chcon -t httpd_sys_content_t /var/www/custom
B.setsebool -P httpd_enable_custom on
C.restorecon -R /var/www/custom
D.semanage fcontext -a -t httpd_sys_content_t "/var/www/custom(/.*)?" && restorecon -R /var/www/custom
AnswerD

semanage fcontext -a -t httpd_sys_content_t "/var/www/custom(/.*)?" && restorecon -R /var/www/custom first writes a persistent file-context rule using a regex that covers the directory and all descendants. Then restorecon consumes that rule to relabel every matching file to httpd_sys_content_t. Because the rule is stored in the SELinux policy, it survives system relabels and is the proper method for assigning Apache-readable context to files outside the default /var/www locations.

Why this answer

It uses `semanage fcontext` to add a persistent file context rule for `/var/www/custom` and its contents, then applies it with `restorecon`. This ensures the `httpd_sys_content_t` type is set persistently across file system relabeling, resolving the 403 error caused by the default SELinux type (`default_t`) that denies Apache access.

Exam trap

The trap here is that candidates choose `chcon` (Option A) because it immediately fixes the 403 error, but they overlook the requirement for a persistent change, which `semanage fcontext` with `restorecon` provides.

How to eliminate wrong answers

Option A is wrong because `chcon` changes the SELinux context immediately but does not persist after a file system relabel (e.g., `restorecon` or `fixfiles`), making it a temporary fix. Option B is wrong because `setsebool -P httpd_enable_custom on` is not a valid boolean; the correct boolean for allowing Apache to access custom content directories is `httpd_read_user_content` or similar, and this option does not address the file context issue. Option C is wrong because `restorecon` alone will reset the context to the default policy, which is `default_t` for an unlabeled directory, not `httpd_sys_content_t`, so it does not fix the 403 error.

220
MCQeasy

A helpdesk ticket states that user 'bob' cannot write to his own home directory. The directory /home/bob has permissions drwxr-xr-x and is owned by root:root. What command will fix this?

A.setfacl -m u:bob:rwx /home/bob
B.usermod -d /home/bob bob
C.chmod 755 /home/bob
D.chown bob:bob /home/bob
AnswerD

chown bob:bob changes both the user and group ownership of /home/bob to bob, making bob the owner with the rwx bits applying to him. This is the standard fix because each user's home directory should be owned by that user and their primary group, not by root. After this command, bob's existing owner permissions take effect, and he can create, modify, and delete files in his home directory.

Why this answer

The home directory /home/bob is owned by root:root with permissions drwxr-xr-x, meaning only root can write to it. User 'bob' cannot write because he is not the owner. Option D (chown bob:bob /home/bob) changes the owner and group to bob, granting him write access via the owner 'w' permission.

Exam trap

Red Hat exams often test the distinction between permission bits and ownership; candidates may mistakenly think changing permissions (chmod) will fix a write issue when the real problem is that the user is not the owner.

How to eliminate wrong answers

Option A is wrong because setfacl adds an ACL entry for bob, but the underlying ownership issue remains; ACLs are not the standard fix for incorrect ownership and may not be enabled or expected in a basic EX200 scenario. Option B is wrong because usermod -d changes the home directory path in /etc/passwd but does not alter permissions or ownership of the existing directory. Option C is wrong because chmod 755 sets permissions to rwxr-xr-x, which already matches the current permissions; it does not address the ownership problem that prevents bob from writing.

221
MCQmedium

A company policy requires that when a user is deleted, all files owned by that user in /home should be reassigned to a 'guest' account. Which command accomplishes this?

A.usermod -l guest olduser
B.find /home -user olduser -exec chown guest {} +
C.userdel -r olduser
D.rsync -a /home/olduser/ /home/guest/
AnswerB

find /home -user olduser -exec chown guest {} + is correct because it searches /home for every file whose owner matches the username olduser (which resolves to the UID) and executes chown guest on them in one batched command, thanks to the + terminator. This directly transfers ownership of each located file to guest, satisfying the policy efficiently. The find approach also covers files outside olduser's home directory that reside anywhere under /home, whereas other options only handle the home directory itself.

Why this answer

Uses `find` to locate all files owned by `olduser` under `/home` and then executes `chown guest` on them, which reassigns ownership to the `guest` account. This directly satisfies the policy requirement without affecting the user account itself or copying files.

Exam trap

Red Hat often tests the distinction between modifying user attributes (usermod), deleting users (userdel), copying files (rsync), and directly reassigning file ownership (find + chown), expecting candidates to recognize that only the latter changes ownership without altering or removing the files.

How to eliminate wrong answers

Option A is wrong because `usermod -l` changes the login name of an existing user, not ownership of files; it would rename `olduser` to `guest`, which does not reassign ownership to a separate `guest` account and may conflict if `guest` already exists. Option C is wrong because `userdel -r` removes the user and their home directory, which deletes files rather than reassigning ownership. Option D is wrong because `rsync -a` copies files from one directory to another, leaving the original files still owned by `olduser` and not reassigning ownership of the originals.

222
Multi-Selecteasy

Which TWO files are essential in the /boot directory for the kernel to boot?

Select 2 answers
A.fstab
B.grub.cfg
C.initramfs
D.vmlinuz
E.kernel
AnswersC, D

initramfs (the initial RAM filesystem) is an essential boot file because it contains the device modules, LVM/encryption tools, and udev rules needed to discover and mount the real root filesystem. During early boot the kernel extracts initramfs into a tmpfs and executes /init, which probes storage hardware, activates volumes, and then switches to the actual root. Without an initramfs, most Linux systems cannot boot unless every required storage driver is statically built into the kernel, which is rarely the case in distributions.

Why this answer

The initramfs (initial RAM filesystem) is essential because it contains the necessary drivers and tools to mount the root filesystem before the kernel can take over. Without it, the kernel would not be able to access the storage device containing the root partition, especially when using filesystems or hardware that require kernel modules not built into the kernel itself.

Exam trap

The trap here is that candidates often confuse the bootloader configuration file (grub.cfg) with a kernel-essential file, or they think the generic term 'kernel' is an actual filename, when in fact the correct filename is vmlinuz.

223
MCQeasy

A system administrator needs to create a shell script that processes a list of hostnames stored in a file, one per line, and runs a command on each host. Which loop construct is most appropriate?

A.while read host; do ... done < hosts
B.for i in $(seq 1 $(wc -l < hosts)); do ... done
C.for host in $(cat hosts); do ... done
D.until read host; do ... done < hosts
AnswerA

The `while read host; do ... done < hosts` construct is the correct approach because it reads the file line by line. On each iteration, `read` assigns the entire line (minus trailing newline) to the variable `host`, so the content is not subjected to word splitting or pathname expansion. This makes it robust for hostnames that might contain unusual characters, though for exact preservation one should add `IFS=` and `-r` to `read`. Additionally, the redirection `< hosts` attaches the file to the loop's standard input, and the loop runs in the current shell, so any variable updates inside the loop remain available afterward.

Why this answer

The `while read host; do ... done < hosts` construct reads the file line by line, preserving each hostname exactly as it appears, including spaces or special characters. This is the safest and most idiomatic way to process a list of hostnames in a shell script, as it avoids word splitting and glob expansion issues that can occur with other methods.

Exam trap

The trap here is that candidates often choose `for host in $(cat hosts)` because it looks simpler, but they overlook how word splitting and glob expansion can break the script when hostnames contain spaces, tabs, or wildcard characters.

How to eliminate wrong answers

Option B is wrong because it uses a for loop with `seq` and `wc -l`, which is unnecessarily complex and fragile; it requires counting lines first and then indexing into the file, which is error-prone and not a standard pattern for reading lines. Option C is wrong because `for host in $(cat hosts)` subjects the file content to word splitting and glob expansion, so hostnames with spaces or wildcard characters would be incorrectly split or expanded. Option D is wrong because `until read host` is syntactically invalid; `until` tests a condition at the top of the loop, but `read` returns a non-zero exit status at end-of-file, making the loop never execute its body (or execute it incorrectly), and the redirection `< hosts` is misplaced.

224
MCQhard

A server has an LVM volume group vg01 with a physical volume /dev/sdb. The administrator wants to move all physical extents from /dev/sdb to /dev/sdd which is also in the same volume group. Which command sequence is correct?

A.pvmove /dev/sdb; vgreduce vg01 /dev/sdb
B.vgreduce vg01 /dev/sdb; pvmove
C.pvmove /dev/sdb; pvremove /dev/sdb
D.pvmove /dev/sdb /dev/sdd
AnswerA

The correct sequence starts with `pvmove /dev/sdb`, which relocates every allocated physical extent on that disk to any available free extent elsewhere in the same volume group (vg01). Once the source PV is completely empty, `vgreduce vg01 /dev/sdb` safely removes it from the volume group's metadata, allowing the disk to be repurposed or detached without risking data loss or LVM corruption.

Why this answer

The correct sequence is to first use `pvmove /dev/sdb` to relocate all physical extents from /dev/sdb to other physical volumes in the same volume group (vg01), and then use `vgreduce vg01 /dev/sdb` to remove the now-empty physical volume from the volume group. This ensures no data loss and that the volume group metadata is properly updated.

Exam trap

The trap here is that candidates often think `pvmove` requires a target PV or that `pvremove` can be used directly after moving extents, but they forget that the PV must first be removed from the VG with `vgreduce` before it can be fully decommissioned.

How to eliminate wrong answers

Option B is wrong because `vgreduce` before `pvmove` would attempt to remove /dev/sdb from the volume group while it still contains data, causing an error or data loss. Option C is wrong because after `pvmove`, the physical volume /dev/sdb is empty but still part of the volume group; `pvremove` would fail because the PV is still in a VG, and it does not remove the PV from the VG metadata. Option D is wrong because `pvmove /dev/sdb /dev/sdd` attempts to move extents directly to a specific target PV, but if /dev/sdd does not have enough free extents, the command will fail; the correct approach is to use `pvmove` without a target to let LVM distribute extents across all available PVs in the VG.

225
Multi-Selecthard

Which TWO commands can be used to display the current SELinux mode?

Select 2 answers
A.setenforce
B.ausearch
C.getenforce
D.sestatus
E.semanage
AnswersC, D

getenforce is the most direct command for displaying the current SELinux execution mode and prints exactly one of Enforcing, Permissive, or Disabled to standard output. It calls the SELinux library's getenforce function, which reads the kernel-enforced mode, making it convenient for shell scripts and monitoring tools. Unlike sestatus, it provides no policy version, configuration file details, or denial counts, but it is the canonical lightweight way to check the mode alone.

Why this answer

The `getenforce` command (option C) displays the current SELinux mode as either Enforcing, Permissive, or Disabled. The `sestatus` command (option D) provides a detailed status report including the current mode, the loaded policy, and the mode from the configuration file. Both are standard tools for querying the SELinux operational state.

Exam trap

Red Hat often tests the distinction between commands that *query* state versus those that *modify* state, so candidates may confuse `setenforce` (which changes mode) with `getenforce` (which displays mode).

Page 2

Page 3 of 6

Page 4

All pages