Knowledge + Practice

CCNA Essential Tools Questions

60 questions · Essential Tools topic · All types, answers revealed

Practice these questions Exam hub All questions

1

MCQmedium

What does the 's' in the owner execute position indicate?

A.Mandatory access control

B.SetGID

C.Sticky bit

D.No special permission

E.SetUID

AnswerE

SetUID (set user ID) is the correct interpretation: a lowercase 's' in the owner execute position means the executable runs with the effective UID of the file's owner rather than the invoking user. For example, `/usr/bin/passwd` has the setuid bit because it is owned by root and must modify `/etc/shadow`. This is a classic and security-sensitive special permission.

Why this answer

In Linux file permissions, the 's' in the owner execute position (e.g., `-rwsr-xr-x`) indicates the SetUID (Set User ID) special permission. When set on an executable file, it allows the process to run with the effective user ID of the file's owner (typically root), rather than the user who launched it. This is why option E is correct.

Exam trap

Red Hat often tests the distinction between SetUID (owner execute 's') and SetGID (group execute 's'), and candidates confuse which position corresponds to which special permission.

How to eliminate wrong answers

Option A is wrong because Mandatory Access Control (MAC) is a security model enforced by systems like SELinux or AppArmor, not represented by the 's' in the owner execute position. Option B is wrong because SetGID (Set Group ID) is indicated by an 's' in the group execute position, not the owner execute position. Option C is wrong because the sticky bit is indicated by a 't' in the 'others' execute position, not the owner execute position.

Option D is wrong because 'No special permission' would show a simple 'x' in the owner execute position, not an 's'.

Practice this question →

2

MCQeasy

A user needs to find all files with the '.conf' extension under /etc. Which command should be used?

A.grep -r "*.conf" /etc

B.locate /etc/*.conf

C.ls /etc/*.conf

D.find /etc -name "*.conf"

AnswerD

find /etc -name "*.conf" is the correct choice because find recursively descends into all subdirectories of /etc, applying the -name test to every file and directory it encounters. The -name test compares the filename (basename) against the glob pattern "*.conf" using standard glob matching, and the double quotes ensure the shell passes the pattern to find rather than expanding it to existing filenames. This command outputs the full path of every file under /etc whose name ends in .conf, making it the proper tool for this name-based recursive search.

Why this answer

The `find` command is designed to search for files and directories based on criteria such as name, type, or size. Using `find /etc -name "*.conf"` recursively searches the entire `/etc` directory tree for files ending in `.conf`, which is the standard and most reliable method for this task.

Exam trap

The trap here is that candidates confuse `grep` (for content search) with `find` (for file search), or assume `ls` with a glob is sufficient, overlooking the need for recursion across subdirectories.

How to eliminate wrong answers

Option A is wrong because `grep -r` searches for text patterns inside file contents, not for filenames; it would attempt to match the literal string "*.conf" within files, not find files with that extension. Option B is wrong because `locate` relies on a pre-built database (updated by `updatedb`) and may not reflect recent changes or include all files under `/etc` by default; also, the pattern `/etc/*.conf` is a shell glob, not a valid `locate` argument. Option C is wrong because `ls /etc/*.conf` only lists files matching the glob in the immediate `/etc` directory, not in subdirectories, and will fail or produce errors if no matches are found or if there are too many matches.

Practice this question →

3

MCQeasy

Which command displays the current system time, timezone, and whether NTP synchronization is active?

A.ntpq -p

B.date

C.timedatectl

D.cal

AnswerC

timedatectl is the correct command because it gives a consolidated, systemd-based view of the time and timezone configuration. Running it with no arguments prints local time, universal time (UTC), RTC time, the currently configured timezone (e.g., 'Europe/Amsterdam'), and whether NTP synchronization is active or enabled. It also supports subcommands like set-timezone to change the configuration, making it the standard utility for this purpose on modern Linux distributions. Thus it directly and unambiguously displays both the current system time and the timezone, plus related status information.

Why this answer

The `timedatectl` command (option C) is the correct tool in Red Hat Enterprise Linux (RHEL) for querying and configuring system time, timezone, and NTP synchronization status. It displays the current local time, timezone, and whether NTP is active or enabled in a single, clear output, making it the standard utility for these tasks in systemd-based systems.

Exam trap

The trap here is that candidates often choose `ntpq -p` (option A) because they associate it with NTP, but they overlook that it does not show the system time or timezone, which the question explicitly requires.

How to eliminate wrong answers

Option A is wrong because `ntpq -p` only shows the list of NTP peers and their synchronization status (e.g., delay, offset, jitter), but it does not display the current system time or timezone. Option B is wrong because `date` outputs the current date and time but does not show the timezone name or NTP synchronization status. Option D is wrong because `cal` simply displays a calendar for a given month or year and has no relation to time, timezone, or NTP.

Practice this question →

4

MCQhard

During boot, a server fails to mount an NFS filesystem listed in /etc/fstab. Which troubleshooting step should be taken first to isolate the issue?

A.Check the status of remote-fs.target with 'systemctl status remote-fs.target'

B.Check the status of nfs-client.target with 'systemctl status nfs-client.target'

C.Try to manually mount the NFS share with 'mount /mnt/nfs'

D.View kernel messages with 'dmesg | grep -i nfs'

AnswerA

Checking 'systemctl status remote-fs.target' is the correct first step because systemd uses this target to synchronize the activation of all remote filesystem mounts, including NFS, during the boot sequence. If the target is in a 'failed' or 'degraded' state, the status output will directly show which mount unit failed and why, allowing you to then inspect that specific unit's logs or configuration rather than guessing. This target is explicitly ordered after network-online.target and pulls in the mount units, so its state is the authoritative indicator of whether boot-time NFS mounting was attempted and completed.

Why this answer

When an NFS filesystem fails to mount during boot, the first step is to check whether the remote-fs.target unit is active. This target is responsible for triggering the mounting of all remote filesystems (including NFS) after the network is available. If remote-fs.target is not active or has failed, the NFS mount will not be attempted, and troubleshooting should start here before investigating the NFS share itself.

Exam trap

Red Hat often tests the misconception that NFS client services (nfs-client.target) are responsible for mounting NFS filesystems, when in fact the mounting is orchestrated by remote-fs.target, and troubleshooting should start there.

How to eliminate wrong answers

Option B is wrong because nfs-client.target is a target that only ensures NFS client services (like rpcbind and nfs-idmapd) are started, but it does not directly control the mounting of filesystems listed in /etc/fstab; the actual mount is governed by remote-fs.target. Option C is wrong because attempting to manually mount the share with 'mount /mnt/nfs' assumes the issue is with the share or network, but if the boot failure is due to a missing or misconfigured remote-fs.target, the manual mount might succeed and mislead the troubleshooting; the correct first step is to check the target status. Option D is wrong because viewing kernel messages with 'dmesg | grep -i nfs' can provide useful details after the target status is verified, but it is not the first step; the boot failure may be caused by a target dependency issue that dmesg would not directly reveal.

Practice this question →

5

MCQmedium

An administrator needs to measure the execution time of the command 'backup.sh'. Which command prefix should be used?

A.time

B.date

C.watch

D.timeout

AnswerA

The `time` utility, whether the Bash reserved word or the external `/usr/bin/time` binary, is specifically designed to measure how long a command takes to complete. It reports real (wall-clock), user, and system CPU time consumed by the command, typically written to stderr. For example, `time ls -lR /etc` prints a timing summary after the command finishes, making it the correct tool for measuring execution duration.

Why this answer

The 'time' command is the correct prefix to measure the execution time of a command in Linux. When placed before 'backup.sh', it runs the script and then outputs the real, user, and system time consumed, providing the precise measurement the administrator needs.

Exam trap

The trap here is that candidates may confuse 'time' with 'timeout' because both involve time, but 'timeout' controls execution duration while 'time' measures it.

How to eliminate wrong answers

Option B is wrong because 'date' displays or sets the system date and time, not the execution duration of a command. Option C is wrong because 'watch' repeatedly runs a command at a specified interval (default 2 seconds) to monitor its output, not to measure its execution time. Option D is wrong because 'timeout' runs a command with a time limit and kills it if it exceeds that limit, which is for controlling runtime, not measuring it.

Practice this question →

6

MCQmedium

A system administrator needs to find all regular files larger than 10MB in /var/log. Which find command should they use?

A.find /var/log -type f -size -10M

B.find /var/log -type d -size +10M

C.find /var/log -type f -size 10M

D.find /var/log -type f -size +10M

AnswerD

The plus sign in `-size +10M` is the "greater than" operator, so this command finds all regular files over 10 MiB in /var/log. The `-type f` option filters for regular files only, excluding directories, symlinks, and special files. This is the correct way to identify large files with find.

Why this answer

It uses `-type f` to select only regular files and `-size +10M` to match files larger than 10 megabytes. The `+` prefix in the `-size` test means 'greater than', which is the correct syntax for finding files exceeding a given size.

Exam trap

Red Hat often tests the `+` and `-` prefix syntax for `-size`, and the trap here is that candidates confuse `-size +10M` with `-size 10M` or `-size -10M`, or they mistakenly use `-type d` instead of `-type f` when the question specifies regular files.

How to eliminate wrong answers

Option A is wrong because `-size -10M` uses the `-` prefix, which means 'less than 10MB', not 'greater than'. Option B is wrong because `-type d` selects directories, not regular files, and the question specifically asks for regular files. Option C is wrong because `-size 10M` without a `+` or `-` prefix matches files exactly 10MB in size, not files larger than 10MB.

Practice this question →

7

Multi-Selecthard

Which THREE commands can be used to monitor real-time process status and update the display every 2 seconds? (Choose three.)

Select 3 answers

A.htop

B.top -d 2

C.ps aux

D.watch -n 2 ps aux

E.at 2

AnswersA, B, D

htop is an ncurses-based interactive process viewer that updates its display continuously by default, refreshing CPU, memory, and per-process statistics roughly once per second while it remains in the foreground. It redraws the screen in place, so you see live changes without rerunning a command, and it also lets you sort, filter, and signal processes interactively. Because it keeps running and updating until you quit, it is a genuine real-time process monitor.

Why this answer

Option A, htop, is correct because it is an interactive real-time process viewer that continuously refreshes its display (by default every second, and its refresh interval is configurable), so it can monitor process status in real time. Option B, top -d 2, is correct because top is the classic real-time process monitor and the -d 2 flag explicitly sets the screen update delay to 2 seconds. Option D, watch -n 2 ps aux, is correct because watch repeatedly executes the given command at a fixed interval, and -n 2 makes it rerun ps aux every 2 seconds, producing a refreshed process listing.

Option C, ps aux, is not correct because ps is a one-shot snapshot command that prints process information once and exits, with no continuous refresh. Option E, at 2, is not correct because at is a job-scheduling utility for running commands at a specified future time, not a real-time process monitoring tool.

Exam trap

Red Hat often tests the distinction between snapshot commands (like `ps aux`) and real-time monitoring tools (like `top`, `htop`, or `watch`), trapping candidates who think `ps aux` can update continuously without an external wrapper like `watch`.

Practice this question →

8

MCQmedium

Refer to the exhibit. Why did the sshd service fail?

A.The service binary is missing.

B.The service start was requested too many times in quick succession.

C.The configuration file /etc/ssh/sshd_config has a syntax error.

D.The system ran out of memory.

AnswerB

The log literally contains the message 'start request repeated too quickly', which is systemd's rate-limiting protection for units that crash immediately after starting. When a service fails more than StartLimitBurst times within StartLimitIntervalSec, systemd refuses to attempt further starts until the interval elapses or the unit is reset. The sshd service has hit this start limit, so the failure is correctly explained by too many rapid restart attempts, not by a faulty binary, bad config, or memory exhaustion.

Why this answer

B is correct because systemd's `StartLimitIntervalSec` and `StartLimitBurst` settings (default: 10 seconds and 5 starts) prevent rapid service restarts. When `sshd` fails repeatedly within the interval, systemd marks it as failed with the status 'start-limit-hit' to avoid resource exhaustion from restart loops.

Exam trap

The trap here is that candidates assume the failure is due to a configuration error or missing binary, but the 'start-limit-hit' status is a systemd mechanism that explicitly indicates too many restart attempts, not a problem with the service itself.

How to eliminate wrong answers

Option A is wrong because if the service binary were missing, `systemctl status sshd` would show 'Exec format error' or 'No such file or directory', not a start-limit-hit failure. Option C is wrong because a syntax error in `/etc/ssh/sshd_config` would cause `sshd` to exit with a specific error message in the journal (e.g., 'Bad configuration option'), not a start-limit-hit from systemd. Option D is wrong because out-of-memory conditions produce OOM-killer logs or 'Cannot allocate memory' errors in the journal, not the start-limit-hit status shown in the exhibit.

Practice this question →

9

Multi-Selecteasy

Which TWO commands can be used to view the contents of a compressed file named 'data.log.gz' without decompressing it permanently? (Choose exactly two.)

Select 2 answers

A.gunzip data.log.gz

B.zcat data.log.gz

C.zless data.log.gz

D.gzip -d data.log.gz

E.bzcat data.log.gz

AnswersB, C

zcat data.log.gz reads the gzip-compressed file, decompresses it, and writes the result to standard output, leaving data.log.gz completely unchanged. Its non-destructive, streaming behavior makes it ideal for piping into tools like head or grep, or for redirecting to another file. Note that zcat is functionally equivalent to gunzip -c.

Why this answer

B is correct because `zcat` reads the contents of a gzip-compressed file and outputs them to standard output without permanently decompressing the file. It is functionally equivalent to `gunzip -c` and is the standard tool for viewing compressed text files in place.

Exam trap

Red Hat often tests the distinction between commands that permanently decompress (gunzip, gzip -d) versus those that only view the contents (zcat, zless, zmore), and candidates frequently confuse `bzcat` as a valid alternative for .gz files.

Practice this question →

10

MCQhard

An administrator wants to create a symbolic link named 'link_to_hosts' in /tmp that points to /etc/hosts. Which command is correct?

A.ln -s /tmp/link_to_hosts /etc/hosts

B.ln -s /etc/hosts /tmp/link_to_hosts

C.ln -s /etc/hosts link_to_hosts

D.ln -s /tmp/link_to_hosts /etc/hosts

AnswerB

This command correctly uses the syntax ln -s <target> <link_name>, with /etc/hosts as the target and /tmp/link_to_hosts as the new symlink. The link is created with absolute path /tmp/link_to_hosts, and accessing it will resolve to /etc/hosts. Because /tmp/link_to_hosts does not already exist, no files are overwritten, making this the correct way to create the requested link.

Why this answer

The `ln -s` command creates a symbolic link. The correct syntax is `ln -s TARGET LINK_NAME`. Option B correctly specifies the existing target file `/etc/hosts` first, followed by the new link path `/tmp/link_to_hosts`, which creates the symbolic link in `/tmp` pointing to `/etc/hosts`.

Exam trap

Red Hat often tests the argument order of `ln -s`, where candidates mistakenly place the link name before the target, confusing it with the `cp` or `mv` command syntax where the destination comes last.

How to eliminate wrong answers

Option A is wrong because it reverses the arguments, attempting to create a link named `/etc/hosts` pointing to `/tmp/link_to_hosts`, which would fail if `/etc/hosts` already exists or create an incorrect link. Option C is wrong because it omits the full path for the link name, creating `link_to_hosts` in the current working directory instead of `/tmp` as required. Option D is wrong because it is identical to Option A, with the same reversed argument order, leading to the same incorrect behavior.

Practice this question →

11

MCQeasy

Refer to the exhibit. Why does the 'bin' user have /sbin/nologin as its shell?

A.The user's home directory is missing.

B.The user is a system account that should not log in interactively.

C.The user is locked.

D.The shell is not installed.

AnswerB

The bin user is a system account (UID typically below 1000) created for running services and binaries rather than for human interactive use. Its login shell is deliberately set to /sbin/nologin in /etc/passwd, which causes any login attempt to print a message and exit immediately. This is a standard security precaution: system accounts should never provide an interactive shell, but they may still be used for non-interactive tasks like cron jobs or service startup. The exhibit shows nologin precisely because this account is not meant for shell access.

Why this answer

The /sbin/nologin shell is explicitly assigned to system accounts like 'bin' to prevent interactive logins. This shell prints a message and exits, ensuring that the account can only be used for non-interactive system processes, such as owning files or running daemons, without providing a login session.

Exam trap

Red Hat often tests the distinction between a locked account (password disabled) and a non-interactive shell (shell set to /sbin/nologin), leading candidates to confuse the two mechanisms for restricting access.

How to eliminate wrong answers

Option A is wrong because a missing home directory does not cause the shell to be set to /sbin/nologin; the shell field in /etc/passwd is independent of the home directory. Option C is wrong because a locked account (e.g., with 'passwd -l') places an exclamation mark in the password hash field in /etc/shadow, not by changing the shell to /sbin/nologin. Option D is wrong because /sbin/nologin is a valid executable that is part of the util-linux package; if it were missing, the system would fall back to /bin/sh or display an error, but the shell field would not be set to a non-existent path by default.

Practice this question →

12

MCQmedium

An administrator needs to compress a directory 'data' into an archive named backup.tar.gz using gzip compression. Which command should they use?

A.gzip -r data > backup.tar.gz

B.tar -cjf backup.tar.gz data

C.tar -xzf backup.tar.gz data

D.tar -czf backup.tar.gz data

AnswerD

tar -czf backup.tar.gz data is correct because -c tells tar to create a new archive, -z pipes the tar stream through gzip for compression, and -f specifies the output file name. The operand data is the directory tar recursively reads into the archive, producing exactly the requested gzip-compressed tarball.

Why this answer

The `tar -czf` command creates a compressed archive: `-c` creates a new archive, `-z` filters the archive through gzip compression, `-f` specifies the archive filename `backup.tar.gz`, and `data` is the directory to archive. This produces a tarball compressed with gzip, matching the requirement exactly.

Exam trap

The trap here is confusing the compression flags: Red Hat often tests whether candidates know that `-z` is for gzip, `-j` for bzip2, and `-J` for xz, and that `-c` creates while `-x` extracts.

How to eliminate wrong answers

Option A is wrong because `gzip -r` compresses individual files recursively but does not create a single archive; redirecting output with `>` produces a corrupted file, not a valid tar.gz. Option B is wrong because `-j` specifies bzip2 compression, not gzip; this would create `backup.tar.bz2`, not `backup.tar.gz`. Option C is wrong because `-x` extracts an archive instead of creating one; this would attempt to extract from `backup.tar.gz` into the `data` directory, which is the opposite of the required action.

Practice this question →

13

Multi-Selectmedium

Which THREE of the following are valid methods to schedule a recurring task in Red Hat Enterprise Linux 8? (Choose exactly three.)

Select 3 answers

A.Using the 'batch' command

B.Creating a systemd timer unit

C.Using the 'at' command

D.Configuring /etc/anacrontab

E.Adding an entry in /etc/crontab

AnswersB, D, E

`systemd.timer` units are unit files with a `.timer` suffix that activate corresponding `.service` units on a schedule defined in `[Timer]` sections with directives like `OnCalendar=`, `OnBootSec=`, or `OnUnitActiveSec=`. Timers support calendar events, monotonic timers, persistent timers (`Persistent=true`), and can run missed jobs after boot, making them the modern replacement for cron on systems using systemd. They provide fine-grained control, logging integration with `journald`, and dependency management, so creating a timer unit is a fully valid scheduling method.

Why this answer

Systemd timer units are the modern, recommended method for scheduling recurring tasks in RHEL 8. They replace traditional cron-based scheduling by leveraging systemd's service and timer units, providing features like monotonic timers, calendar events, and integration with systemd's logging and dependency management.

Exam trap

Red Hat often tests the distinction between one-time scheduling tools (at, batch) and recurring scheduling tools (cron, anacron, systemd timers), leading candidates to mistakenly select 'at' or 'batch' for recurring tasks.

Practice this question →

14

MCQmedium

A system administrator runs the command 'ls -l' and sees that a file has permissions '-rwxr-xr-x'. The administrator wants to remove execute permission for the group and others while keeping it for the owner. Which chmod command should be used?

A.chmod u-x file

B.chmod 755 file

C.chmod go-x file

D.chmod a+x file

AnswerC

chmod go-x file is correct because the symbolic mode 'go-x' targets the group (g) and other (o) permission classes with a minus operation, stripping only their execute bits. The owner's existing execute permission is unaffected, which precisely matches the requirement to remove execute access from group and others while preserving the owner's access.

Why this answer

The command 'chmod go-x file' removes execute permission for group (g) and others (o) while leaving the owner's permissions unchanged. The current permissions '-rwxr-xr-x' indicate owner has rwx, group has r-x, and others have r-x, so removing execute from group and others yields '-rwxr--r--'.

Exam trap

The trap here is that candidates often confuse the symbolic notation (u, g, o, a) and may incorrectly choose 'chmod u-x' thinking it affects group/others, or they misapply numeric modes like 755 which set permissions absolutely rather than modifying them incrementally.

How to eliminate wrong answers

Option A is wrong because 'chmod u-x file' removes execute permission from the owner, not from group and others, which would change the file to '-rw-r-xr-x'. Option B is wrong because 'chmod 755 file' sets permissions to rwxr-xr-x (owner rwx, group r-x, others r-x), which is the current state and does not remove execute from group and others. Option D is wrong because 'chmod a+x file' adds execute permission for all (owner, group, others), which is the opposite of what is needed.

Practice this question →

15

MCQhard

A Red Hat Enterprise Linux server has been configured with a custom repository for offline updates. The administrator runs 'yum repolist' and the custom repository is not listed. Which command should be used to verify that the repository configuration file is valid and located in the correct directory?

A.yum repoinfo

B.cat /etc/yum.repos.d/custom.repo

C.yum check-repo

D.yum-config-manager --dump

AnswerB

Running cat /etc/yum.repos.d/custom.repo will print the exact bytes of the file to stdout, confirming both that the file exists in the proper /etc/yum.repos.d directory and what its repository configuration lines contain. If the file is missing, cat returns a nonzero exit status with a 'No such file or directory' error, so it provides an unambiguous, immediate pass/fail verification for this specific path.

Why this answer

The most direct way to verify that a repository configuration file is valid and located in the correct directory is to check its presence and syntax using 'cat /etc/yum.repos.d/custom.repo'. The repository configuration files must reside in /etc/yum.repos.d/ and have a .repo extension; if the file is missing or malformed, 'yum repolist' will not list the repository. This command simply reads the file, allowing the administrator to confirm its location and inspect its contents for errors.

Exam trap

The trap here is that candidates may assume a specialized yum subcommand exists for repository validation (like 'yum repoinfo' or 'yum check-repo'), when in fact the simplest and most reliable method is to directly inspect the configuration file with 'cat' or 'vim'.

How to eliminate wrong answers

Option A is wrong because 'yum repoinfo' is not a valid yum command; the correct command is 'yum repoinfo <repoid>' to display details about a repository that is already recognized, not to verify the configuration file's existence or validity. Option C is wrong because 'yum check-repo' is not a valid yum command; yum does not have a built-in 'check-repo' subcommand for validating repository configuration files. Option D is wrong because 'yum-config-manager --dump' is used to display the current yum configuration settings, not to verify the location or validity of a specific repository configuration file; it requires the repository to already be recognized.

Practice this question →

16

Multi-Selecteasy

Which THREE file descriptors are always available for every Unix process?

Select 3 answers

A.4: socket

B.3: log file

C.2: stderr

D.1: stdout

E.0: stdin

AnswersC, D, E

stderr, file descriptor 2, is one of the three standard streams that the kernel guarantees to be open for every process from the moment it starts. It is specifically designated for error and diagnostic output, and is intentionally unbuffered or line-buffered so messages appear immediately, even if stdout is redirected or fully buffered. This descriptor is inherited from the parent process and can be redirected via shell operators like 2>.

Why this answer

File descriptor 2 (stderr) is one of the three standard file descriptors that every Unix process inherits from its parent process. These descriptors are opened automatically by the kernel when a process starts, providing default channels for input (stdin, fd 0), output (stdout, fd 1), and error output (stderr, fd 2).

Exam trap

Red Hat often tests the misconception that file descriptors beyond 0, 1, and 2 are standard or always available, leading candidates to select options like '3: log file' or '4: socket' as if they were universally present.

Practice this question →

17

MCQhard

A system administrator is troubleshooting a cron job that runs a script as root. The script is located at /root/scripts/backup.sh and has permissions 755. The cron job is defined in /etc/crontab with the line: 0 2 * * * root /root/scripts/backup.sh. However, the script does not run at the scheduled time. The administrator checks the cron logs and finds no errors. The administrator then runs the script manually as root and it executes successfully. What is the most likely cause of the cron job not running?

A.The cron job line uses absolute path to the script but the script requires an environment variable that is not set in cron's minimal environment.

B.The script is not executable by the root user.

C.The cron daemon is not running.

D.The /etc/crontab file does not allow running scripts from /root.

AnswerA

Cron runs with a sparse environment that includes only a few default variables such as HOME, LOGIN, and SHELL, with PATH typically set to /usr/bin:/bin. It does not source /etc/profile or a user's ~/.bash_profile, so any custom environment variable that the script expects—for example, a database password or an application home—will be unset. Even though the script's absolute path is correct and it runs manually, the missing variable causes the script to fail under cron. The solution is to export the variable inside the script or define it explicitly in the crontab.

Why this answer

Cron jobs run with a minimal environment, setting only a few variables (such as HOME, SHELL, LOGNAME, and a default PATH) and not sourcing the user's shell startup files. The script at /root/scripts/backup.sh may rely on an environment variable (e.g., a database password or directory path) defined in root's interactive shell but not in cron's environment. When run manually as root, the variable is available, but cron does not source /root/.bashrc or /root/.bash_profile, causing the script to fail silently or not execute as expected.

Exam trap

Red Hat often tests the misconception that file permissions or cron daemon status are the primary causes of cron job failures, when in reality the minimal cron environment and missing environment variables are the subtle but frequent issue.

How to eliminate wrong answers

Option B is wrong because the script has permissions 755, which includes execute permission for the owner (root), so it is executable by root. Option C is wrong because if the cron daemon were not running, the cron logs would typically show an error or the job would not be logged at all; the administrator found no errors in the logs, indicating the daemon is active. Option D is wrong because /etc/crontab has no restriction on running scripts from /root; the root user can execute scripts from any directory, and the cron job specifies the user 'root' explicitly.

Practice this question →

18

MCQhard

A user is unable to delete a file named '-f' in the current directory. Which command will successfully remove it?

A.rm \-f

B.rm -- -f

C.rm -f

D.rm "-f"

AnswerB

The command `rm -- -f` uses the standard end-of-options delimiter `--`, which POSIX utilities use to signal that no more options follow. When rm encounters `--`, it stops option processing and treats every subsequent argument literally as an operand, so `-f` becomes a filename. This is the correct way to delete a file whose name begins with a dash, because the argument is never interpreted as the force flag.

Why this answer

The '--' double dash signals the end of command options to most Linux utilities, including rm. This allows rm to interpret '-f' as a literal filename rather than the '--force' option, enabling its deletion.

Exam trap

The trap here is that candidates assume quoting or escaping the dash will prevent option parsing, but only the '--' separator reliably tells rm to stop interpreting arguments as options.

How to eliminate wrong answers

Option A is wrong because 'rm \-f' escapes the hyphen with a backslash, but rm still interprets '-f' as the force option, not a filename. Option C is wrong because 'rm -f' is the standard force-delete option, which does not target a file named '-f' and will fail or delete unintended files. Option D is wrong because 'rm "-f"' uses quotes, but the shell still passes the string '-f' as an argument, which rm interprets as the force option, not a filename.

Practice this question →

19

MCQeasy

A system administrator needs to view the last 10 lines of the log file /var/log/messages in real time as new lines are added. Which command should be used?

A.tail -f /var/log/messages

B.less /var/log/messages

C.head -n 10 /var/log/messages

D.cat /var/log/messages

AnswerA

tail -f /var/log/messages is correct because tail by default prints the last 10 lines of the file, and the -f flag (follow) keeps the command running and continuously outputs newly appended lines as they are written. This makes it ideal for real-time monitoring of a live log, satisfying the requirement to view the last 10 lines and see updates without re-running the command.

Why this answer

The `tail -f /var/log/messages` command displays the last 10 lines of the file by default and then continues to output new lines as they are appended, providing real-time monitoring. The `-f` (follow) option keeps the file open and polls for changes, making it the correct tool for live log watching.

Exam trap

Red Hat often tests the distinction between `tail -f` and `tail` without `-f`, where candidates mistakenly think `tail` alone provides real-time updates, or confuse `head` and `tail` for viewing the end of a file.

How to eliminate wrong answers

Option B is wrong because `less` is a pager that shows the file content page by page but does not automatically follow new lines in real time (unless used with `+F` mode, which is not specified). Option C is wrong because `head -n 10` only shows the first 10 lines, not the last 10, and does not follow updates. Option D is wrong because `cat` dumps the entire file to stdout and exits, providing no real-time monitoring capability.

Practice this question →

20

MCQhard

A developer needs to compile software from source and install it under /opt/custom. To avoid affecting the system package manager, which approach should be used?

A.Compile and install with default paths, then use 'make uninstall' to remove

B.Compile with './configure --prefix=/opt/custom' and use 'checkinstall' to create an RPM

C.Compile with './configure --prefix=/usr' and then install

D.Compile with './configure --prefix=/opt/custom' and then 'make install'

AnswerD

Using './configure --prefix=/opt/custom' sets the installation root to a dedicated directory, typically /opt/custom. The subsequent 'make install' places all binaries, libraries, and configuration files under that single prefix, keeping the software isolated from system-managed areas. This avoids conflicts with the package manager and allows clean removal by simply deleting the /opt/custom directory.

Why this answer

Using `./configure --prefix=/opt/custom` sets the installation root to `/opt/custom`, which keeps the compiled software completely separate from the system-managed directories (e.g., `/usr`, `/usr/local`). Running `make install` then installs all files under this custom prefix, ensuring the system package manager (RPM/YUM/DNF) is not affected by the manual installation.

Exam trap

Red Hat often tests the misconception that `--prefix=/usr/local` is safe, but the trap here is that `/usr/local` can still be managed by the system package manager in some configurations, and the only way to guarantee no interference is to use a completely separate directory like `/opt/custom`.

How to eliminate wrong answers

Option A is wrong because compiling with default paths (typically `/usr/local`) still places files in a location that may conflict with system-managed packages, and `make uninstall` is unreliable (many Makefiles do not support it or leave residual files). Option B is wrong because `checkinstall` creates an RPM that, when installed, registers the software with the system package manager, which defeats the goal of avoiding package manager interference. Option C is wrong because `--prefix=/usr` installs directly into the system-managed directory, which can overwrite or conflict with RPM-managed files and corrupt the package database.

Practice this question →

21

MCQeasy

A new Linux administrator needs to read the manual page for the 'ls' command but also wants to search for the word 'color' within the manual. Which command accomplishes this?

A.man -k color

B.man ls and then type /color

C.man ls | grep color

D.man color

AnswerB

This is the correct approach because man ls opens the ls manual page in a pager (typically less), and typing the slash key (/) invokes the pager's interactive search function. Entering /color immediately jumps to the first occurrence of the string 'color' in the fully formatted page, and pressing 'n' cycles through subsequent matches. This lets you quickly locate the --color option's description right where it appears in the manual.

Why this answer

The man command opens the manual page for 'ls', and typing '/color' within the pager (usually less) performs an interactive forward search for the string 'color'. This allows the administrator to read the manual and search for the term in one session.

Exam trap

The trap here is that candidates may confuse 'man -k' (keyword search in manual page descriptions) with searching within a specific manual page, or they may think piping to grep is equivalent to the interactive search inside the man pager.

How to eliminate wrong answers

Option A is wrong because 'man -k color' searches the manual page name and short description (whatis database) for the keyword 'color', not within the content of a specific manual page. Option C is wrong because 'man ls | grep color' pipes the formatted output of the man page to grep, which searches for 'color' but does not allow interactive reading of the manual; it also may miss matches due to formatting escape sequences. Option D is wrong because 'man color' attempts to open a manual page named 'color', which does not exist as a standard command, and does not search within the 'ls' manual.

Practice this question →

22

MCQeasy

A system administrator needs to find all files modified in the last 24 hours under /var/log. Which command accomplishes this?

A.find /var/log -ctime -1

B.find /var/log -atime -1

C.find /var/log -mmin 1440

D.find /var/log -mtime -1

AnswerD

This is the correct command because -mtime -1 specifically filters on the modification time (mtime) and the leading minus sign means 'less than one day old,' i.e., files whose content was last changed within the past 24 hours. Unlike ctime or atime, mtime only updates when the file's data is written to, which is exactly what is needed to identify recently modified log files. In find's age arithmetic, -mtime -1 corresponds to 'less than one 24-hour period,' so it reliably catches all files modified since the same time yesterday.

Why this answer

`find /var/log -mtime -1` searches for files under `/var/log` whose modification time (`mtime`) is less than 1 day ago (i.e., modified within the last 24 hours). The `-mtime` flag checks the last modification time of file content, which is the standard criterion for 'modified' files.

Exam trap

The trap here is confusing `-mtime -1` (modified within the last 24 hours) with `-mtime 1` (modified exactly 1 day ago) or with `-ctime` (metadata change), leading candidates to pick options that check the wrong timestamp or an exact time rather than a range.

How to eliminate wrong answers

Option A is wrong because `-ctime -1` checks the last change time of file metadata (inode change), not the modification of file content; this includes permission or ownership changes, not just content edits. Option B is wrong because `-atime -1` checks the last access time (read time), which is unrelated to file modification and can be misleading due to access caching. Option C is wrong because `-mmin 1440` checks for files modified exactly 1440 minutes ago (i.e., exactly 24 hours ago), not within the last 24 hours; the `-mmin` flag with a positive number matches files modified exactly that many minutes ago, not a range.

Practice this question →

23

MCQeasy

A system administrator is trying to compress the contents of the directory /home/user/project into a tarball named project_backup.tar.gz using the command: tar -czf project_backup.tar.gz /home/user/project. The command completes without errors, but when the administrator tries to list the contents of the tarball using tar -tzf project_backup.tar.gz, it shows a leading slash (/) in the paths, like /home/user/project/file1. The administrator wants to create the tarball with relative paths instead. What change should be made to the tar command?

A.Use tar -czf project_backup.tar.gz --absolute-names /home/user/project

B.Use tar -czf project_backup.tar.gz -P /home/user/project

C.Use tar -czf project_backup.tar.gz -C /home/user project

D.Use tar -czf project_backup.tar.gz -h /home/user/project

AnswerC

Using -C /home/user makes tar change its working directory to /home/user before processing the file list, so the argument 'project' is interpreted as a relative path. The resulting archive therefore contains members like project/file1 rather than /home/user/project/file1, allowing the archive to be extracted into any directory without side effects. This is the standard, safe way to back up a directory subtree with relative pathnames.

Why this answer

The `-C` option changes the working directory to `/home/user` before archiving, so the argument `project` is interpreted as a relative path. This strips the leading slash and stores paths like `project/file1` instead of absolute paths. The `-C` option is the standard way to create tarballs with relative paths in a single command.

Exam trap

Red Hat often tests the `-C` option as the correct way to create tarballs with relative paths, and the trap here is that candidates mistakenly think `-P` or `--absolute-names` removes leading slashes, when in fact they preserve them.

How to eliminate wrong answers

Option A is wrong because `--absolute-names` (or `-P`) preserves absolute paths, which is the opposite of what the administrator wants. Option B is wrong because `-P` is the short form of `--absolute-names` and also preserves leading slashes, not removes them. Option D is wrong because `-h` (or `--dereference`) follows symlinks and archives the files they point to, but does not affect path stripping or relative path creation.

Practice this question →

24

MCQmedium

An administrator receives an alert that a process named 'apache2' is consuming excessive CPU. The administrator needs to identify the PID of the process and then change its priority to the lowest possible value (least favorable scheduling). Which sequence of commands should be used?

A.pidof apache2; renice -n 20 -p <PID>

B.pidof apache2; renice -n 19 -p <PID>

C.ps -C apache2 -o pid=; renice -n -20 -p <PID>

D.ps aux | grep apache2; nice -n 19 <PID>

AnswerB

The pidof apache2 command directly outputs the PID(s) of the apache2 process, which can be passed to renice using -p. The renice -n 19 -p <PID> command sets the niceness of the existing process to 19, the lowest possible priority (often called 'most nice'). This is the correct way to reduce a running process's CPU priority on Linux; note that lowering priority (raising nice value) can be done by the process owner without root.

Why this answer

`pidof apache2` retrieves the PID of the apache2 process, and `renice -n 19 -p <PID>` sets the priority to the lowest possible (least favorable) scheduling value. In Linux, `renice` accepts nice values from -20 (highest priority) to 19 (lowest priority), so 19 is the correct value for the least favorable scheduling.

Exam trap

Red Hat often tests the exact range of nice values (0-19 for non-root users, -20 to 19 for root) and the distinction between `nice` (for starting processes) and `renice` (for changing priority of running processes), leading candidates to confuse the two or use out-of-range values.

How to eliminate wrong answers

Option A is wrong because it uses `renice -n 20`, but the valid nice range is -20 to 19; a value of 20 is out of range and will be rejected or clamped. Option C is wrong because it uses `renice -n -20`, which sets the highest priority (most favorable scheduling), not the lowest. Option D is wrong because `nice` is used to start a new process with a given priority, not to change the priority of an existing process; also, the syntax `nice -n 19 <PID>` is incorrect as `nice` expects a command, not a PID.

Practice this question →

25

MCQeasy

A user needs to view the last 15 lines of a log file that is constantly being updated. Which command should they use?

A.tail -n 15 /var/log/messages

B.tail -f /var/log/messages

C.cat /var/log/messages

D.head -15 /var/log/messages

AnswerA

tail -n 15 /var/log/messages is correct because tail reads from the end of a file, and the -n 15 flag limits output to exactly the last 15 lines. Unless told otherwise, tail prints the final 10 lines; -n overrides this default to match the requested count. The command then exits, providing a clean, one-time snapshot of the most recent entries in the system log.

Why this answer

The `tail -n 15 /var/log/messages` command displays the last 15 lines of the specified log file without following it. This meets the requirement to view the last 15 lines of a file that is constantly being updated, as it provides a static snapshot of the most recent entries.

Exam trap

The trap here is that candidates often confuse `tail -f` (which follows the file in real time) with `tail -n` (which shows a specific number of lines from the end), leading them to choose option B when the requirement is for a static view of the last lines.

How to eliminate wrong answers

Option B is wrong because `tail -f /var/log/messages` continuously follows the file, displaying new lines as they are appended, which does not limit the output to the last 15 lines and is not suitable for a one-time view. Option C is wrong because `cat /var/log/messages` outputs the entire file content, which is impractical for viewing only the last 15 lines, especially in a large log file. Option D is wrong because `head -15 /var/log/messages` displays the first 15 lines, not the last 15 lines, which is the opposite of what the user needs.

Practice this question →

26

MCQeasy

A system administrator has created a new group named 'ops'. The administrator wants to add the existing user 'alice' to this group as a supplementary group without affecting her current group memberships. Which command should be used?

A.usermod -aG ops alice

B.usermod -G ops alice

C.groupadd ops alice

D.usermod -g ops alice

AnswerA

usermod -aG ops alice explicitly appends alice to the supplementary group ops while preserving any existing supplementary group memberships. The -a (append) flag works in conjunction with -G (supplementary groups) to add the specified group to the user's current group set rather than replacing it. This is the correct, non-destructive way to grant a user access to an additional secondary group.

Why this answer

The `-a` (append) flag combined with `-G` (supplementary groups) in `usermod` adds the user 'alice' to the 'ops' group without removing her from any existing supplementary groups. Without `-a`, the `-G` flag alone would replace the user's current supplementary group list with only the specified groups, which would remove her from any other groups she already belongs to.

Exam trap

The trap here is that candidates often forget the `-a` flag and choose `usermod -G ops alice`, mistakenly thinking it adds the user to the group, when in fact it replaces all supplementary group memberships.

How to eliminate wrong answers

Option B is wrong because `usermod -G ops alice` without the `-a` flag sets the user's supplementary groups to exactly 'ops', overwriting and removing all other supplementary group memberships. Option C is wrong because `groupadd` creates a new group, not a user; the syntax `groupadd ops alice` is invalid and would fail or be misinterpreted. Option D is wrong because `usermod -g ops alice` changes the user's primary group (the group listed in /etc/passwd) to 'ops', not a supplementary group, and would alter the default group ownership for files created by alice.

Practice this question →

27

MCQhard

An administrator needs to list the permissions, owner, group, and filenames of all files in /var/log, including hidden files, in a human-readable format. Which command does this?

A.ls -lh /var/log

B.ls -la /var/log

C.ls -ld /var/log

D.ls -lah /var/log

AnswerD

Combining -l, -a, and -h gives a long-format listing of every entry in /var/log including hidden dotfiles, with sizes expressed in human-readable units. This is the only option that simultaneously provides the required permissions/owner/group data for all contents and keeps the output easily readable, meeting every part of the request.

Why this answer

`ls -lah /var/log` combines the `-l` (long format), `-a` (show all files including hidden ones), and `-h` (human-readable sizes) flags. This meets all requirements: listing permissions, owner, group, filenames, and hidden files with sizes in KiB/MiB/GiB.

Exam trap

The trap here is that candidates may forget the `-a` flag for hidden files or the `-h` flag for human-readable sizes, assuming `-l` alone provides enough detail, or they might mistakenly choose `-ld` thinking it lists directory contents.

How to eliminate wrong answers

Option A is wrong because `ls -lh /var/log` omits the `-a` flag, so hidden files (those starting with a dot) are not listed. Option B is wrong because `ls -la /var/log` includes hidden files but lacks the `-h` flag, so file sizes are displayed in raw bytes rather than human-readable format. Option C is wrong because `ls -ld /var/log` uses the `-d` flag, which lists only the directory itself (its metadata) and not its contents.

Practice this question →

28

MCQmedium

A user wants to display the contents of a file in reverse line order. Which command should be used?

A.tail -r file

B.sort -r file

C.rev file

D.tac file

AnswerD

`tac` is the inverse of `cat` and writes each file to standard output with the lines listed in reverse order, meaning the last line appears first. The name comes from "cat" spelled backward, and it is a standard coreutils command available on RHEL. It preserves the exact content of every line while reversing only the line sequence, which exactly fulfills the user's request.

Why this answer

The `tac` command is the standard Linux utility for displaying a file in reverse line order. It reads the file from the last line to the first, effectively reversing the line sequence. This is the correct tool for the task described.

Exam trap

The trap here is that candidates may confuse `tac` with `tail` or `rev`, or incorrectly assume `sort -r` reverses line order, when in fact `tac` is the specific command for reversing line order in a file.

How to eliminate wrong answers

Option A is wrong because `tail -r` is not a valid command in standard Linux; `tail` displays the last lines of a file, and the `-r` flag is not supported. Option B is wrong because `sort -r` sorts lines in reverse alphabetical order, not reverse line order. Option C is wrong because `rev` reverses the characters within each line, not the order of lines themselves.

Practice this question →

29

MCQmedium

An administrator needs to schedule a script to run every Monday, Wednesday, and Friday at 2:30 PM. Which cron expression should be used?

A.30 14 * * 1,3,5

B.30 14 * * 1-5

C.14 30 * * 1,3,5

D.30 14 * * 0,2,4

AnswerA

The cron expression has the correct field order: minute (30), hour (14), day of month (*), month (*), and day of week (1,3,5). Numeric day-of-week values start at 0 for Sunday, so 1 is Monday, 3 is Wednesday, and 5 is Friday. Because the day-of-month and month fields are wildcards, the job would run solely on those weekdays at 2:30 PM.

Why this answer

Cron uses five fields (minute, hour, day-of-month, month, day-of-week). 2:30 PM is 14:30 in 24-hour format, so minute=30 and hour=14. The day-of-week field uses 0-7 (0 and 7 = Sunday), with Monday=1, Wednesday=3, Friday=5. The asterisks for day-of-month and month mean 'every day' and 'every month', so the expression `30 14 * * 1,3,5` runs the script at 2:30 PM on Monday, Wednesday, and Friday.

Exam trap

Red Hat often tests the 24-hour time format and the correct ordering of minute and hour fields, causing candidates to swap them (as in Option C) or to confuse the day-of-week numbering (Sunday=0 vs Monday=1) as seen in Option D.

How to eliminate wrong answers

Option B is wrong because `1-5` in the day-of-week field specifies Monday through Friday (days 1,2,3,4,5), which includes Tuesday and Thursday, not just Monday, Wednesday, and Friday. Option C is wrong because the fields are reversed: `14 30` would mean minute=14 and hour=30, which is invalid (hour 30 does not exist) and would never run at 2:30 PM. Option D is wrong because `0,2,4` in the day-of-week field corresponds to Sunday (0), Tuesday (2), and Thursday (4), which is the wrong set of days.

Practice this question →

30

MCQeasy

An administrator wants to display a list of all currently logged-in users. Which command is most appropriate?

A.who

B.w

C.last

D.users

AnswerA

The `who` command reads /var/run/utmp and outputs a roster of every currently active login session, including the username, terminal/line, login time, and remote host when applicable. This directly satisfies the administrator's requirement to display a list of all users currently logged into the system, with enough detail to identify each session. It is the canonical utility for this purpose.

Why this answer

The `who` command displays a list of currently logged-in users along with their terminal, login time, and originating host. It is the most straightforward and appropriate command for this specific task, as it directly queries the system's utmp database to show active sessions.

Exam trap

The trap here is that candidates often confuse `w` (which shows additional process information) with `who` for a simple user listing, or mistakenly think `last` shows current users because it lists login records.

How to eliminate wrong answers

Option B is wrong because `w` shows detailed information about currently logged-in users, including their current process and CPU usage, but it is more verbose than needed for simply listing users. Option C is wrong because `last` displays a history of previous logins and logouts from the wtmp file, not currently logged-in users. Option D is wrong because `users` prints only the usernames of currently logged-in users, but it does not show terminal or login time details, making it less comprehensive than `who` for a full list.

Practice this question →

31

MCQmedium

A system administrator needs to replace all occurrences of 'enabled' with 'disabled' in /etc/ssh/sshd_config, but only on lines that do not start with '#'. Which sed command accomplishes this?

A.sed '/^#/!s/enabled/disabled/g' /etc/ssh/sshd_config

B.sed 's/enabled/disabled/g' /etc/ssh/sshd_config

C.sed -n '/^#/!s/enabled/disabled/gp' /etc/ssh/sshd_config

D.sed '/^#/s/enabled/disabled/g' /etc/ssh/sshd_config

AnswerA

The address '/^#/!' uses negated matching: sed applies the following command only to lines that do not begin with '#', i.e., active configuration directives. The s/enabled/disabled/g substitution then replaces every occurrence of 'enabled' with 'disabled' on those lines, with the g flag ensuring all matches per line, not just the first. Because sed's default action prints every input line, the output stream contains the complete updated file, and comment lines remain untouched as required.

Why this answer

It uses an address range `/^#/!` to negate lines starting with `#` (comments), then applies the substitution `s/enabled/disabled/g` only to non-comment lines. The `!` operator inverts the match, so the command acts on lines that do NOT match the pattern, which is exactly what the requirement specifies.

Exam trap

The trap here is that candidates may confuse the `!` negation operator with the `-n` suppress-print option, or mistakenly apply the substitution to commented lines instead of non-commented lines, leading to incorrect configuration changes.

How to eliminate wrong answers

Option B is wrong because it applies the substitution to all lines, including commented lines, which violates the requirement to only change lines that do not start with `#`. Option C is wrong because the `-n` flag suppresses automatic printing, and `gp` prints only lines where a substitution occurred; this would output only changed lines, not the entire file, so it does not produce the full modified configuration. Option D is wrong because the address `/^#/` selects only lines that start with `#` (comments), so the substitution is applied to comments instead of non-comment lines, which is the opposite of what is needed.

Practice this question →

32

MCQhard

A system administrator notices that a server is responding slowly. The administrator runs `top` and sees a process named `backup_script` consuming 95% CPU. The process runs as root and is supposed to run nightly backups. However, the system load average is low. The administrator wants to investigate without killing the process. Which of the following is the best course of action?

A.Use `renice -n 19 -p <PID>` to lower the priority of the process.

B.Use `nice -n 19 ./backup_script` to start the process with lower priority next time.

C.Use `chrt -i 0 <PID>` to set the scheduling policy to idle.

D.Use `kill -STOP <PID>` to pause the process and then resume later.

AnswerA

renice changes the nice value of an already-running process; specifying -n 19 with -p <PID> sets it to the lowest dynamic priority while leaving the process in a Running (or sleepable) state. This reduces its CPU scheduler share so interactive workloads are less affected, and the backup continues making progress rather than being suspended or restarted.

Why this answer

`renice -n 19 -p <PID>` lowers the CPU scheduling priority of the running `backup_script` process to the lowest possible value (19), which reduces its CPU consumption without killing it. This allows the administrator to investigate the cause of the high CPU usage while minimizing the impact on other processes and system responsiveness.

Exam trap

Red Hat often tests the distinction between `nice` (for starting a new process) and `renice` (for adjusting an existing process), and candidates may confuse the two or think `nice` can be applied to a running process.

How to eliminate wrong answers

Option B is wrong because `nice` sets the priority of a new process, not an already running one; the administrator needs to adjust the priority of the currently running `backup_script`, not start a new instance. Option C is wrong because `chrt -i 0 <PID>` sets the scheduling policy to SCHED_IDLE, which is an idle scheduling class that only runs when no other process needs the CPU, but this is a more drastic change than needed and may not be appropriate for a backup script that should eventually complete; also, the `-i` option is for SCHED_IDLE, but the correct syntax for setting idle policy is `chrt -i 0 <PID>` (though `chrt` typically uses `-i` for idle, but the policy value 0 is for SCHED_OTHER, not idle — the trap is that `chrt -i` expects a priority argument, and 0 is not valid for idle). Option D is wrong because `kill -STOP` pauses the process, which would halt the backup entirely, preventing it from completing its work and potentially leaving data in an inconsistent state; the administrator wants to investigate without killing or stopping the process.

Practice this question →

33

Multi-Selectmedium

Which THREE actions will create a new empty file named 'testfile' in the current directory? (Choose three.)

Select 3 answers

A.> testfile

B.ls > testfile

C.touch testfile

D.cp /dev/null testfile

E.echo "content" > testfile

AnswersA, C, D

This is a shell redirection with no command preceding the operator. The shell opens (or creates) the file with O_CREAT and O_TRUNC flags, and because nothing is written to stdout, the resulting regular file has zero length. This is one of the classic methods for creating an empty file, and it will also truncate an existing file to zero bytes.

Why this answer

The shell redirection operator `>` without a preceding command truncates or creates the specified file. When used alone, `> testfile` opens 'testfile' for writing, which creates an empty file if it does not exist, or truncates it to zero length if it does. This is a standard POSIX shell feature.

Exam trap

The trap here is that candidates may think only `touch` creates an empty file, overlooking the shell redirection operator `>` used alone and the `cp /dev/null` technique, both of which are valid methods for creating or truncating files to empty.

Practice this question →

34

Multi-Selecthard

Which TWO methods can be used to permanently set the system's hostname to 'server01.example.com'?

Select 2 answers

A.hostnamectl set-hostname server01.example.com

B.echo '127.0.1.1 server01.example.com' >> /etc/hosts

C.echo 'server01.example.com' > /etc/hostname

D.hostname server01.example.com

E.echo 'HOSTNAME=server01.example.com' >> /etc/sysconfig/network

AnswersA, C

hostnamectl set-hostname server01.example.com writes the given name to /etc/hostname as the static hostname and also signals systemd-hostnamed to apply it immediately to the running kernel, so the change takes effect right away and remains after reboot. It is the systemd-native command and the official tool on RHEL systems; unlike writing /etc/hostname directly, it also updates the transient hostname by default and can set other metadata such as the pretty hostname. This is the recommended and most robust method.

Why this answer

`hostnamectl set-hostname server01.example.com` is the systemd-based command that permanently sets the hostname by writing to `/etc/hostname` and applying the change immediately via the `hostnamed` service. This is the recommended method on RHEL 8/9 systems, as it updates both the transient and static hostnames, ensuring persistence across reboots.

Exam trap

The trap here is that candidates confuse setting the hostname with hostname resolution, picking option B (editing `/etc/hosts`) because they think it permanently sets the hostname, when it only affects local DNS-like lookups and does not change the system's actual hostname.

Practice this question →

35

MCQmedium

A user complains that the 'ls' command no longer outputs colors. The administrator suspects a change in environment variables. Which command would help diagnose the issue?

A.set

B.declare

C.env

D.alias

AnswerC

The `env` command, when run without arguments, prints the complete environment that will be passed to child processes, making it the most direct way to verify whether `LS_COLORS` is defined and what its value is. Because `ls` relies on the `LS_COLORS` environment variable to know which color codes to use (assuming color output is enabled), `env` immediately exposes whether that variable is missing, empty, or malformed. It also allows filtering, e.g., `env | grep LS_COLORS`, for a concise check.

Why this answer

The `env` command displays all current environment variables, which directly affect the behavior of commands like `ls`. The `ls` command uses the `LS_COLORS` environment variable to determine color output; if this variable is missing or altered, colors will not appear. Running `env` allows the administrator to inspect the current environment and identify if `LS_COLORS` has been changed or unset.

Exam trap

The trap here is that candidates often confuse `env` with `set` or `declare`, thinking all three show the same information, but `env` specifically shows only exported environment variables, which is exactly what affects child processes like `ls`.

How to eliminate wrong answers

Option A is wrong because `set` displays shell variables (including local variables) and shell functions, not just environment variables; it may show environment variables but is not the standard tool for diagnosing environment-specific issues like `LS_COLORS`. Option B is wrong because `declare` is used to declare and display shell variables and attributes in Bash, but it is not the primary command for listing environment variables; it also shows local variables and functions, which can clutter the output. Option D is wrong because `alias` displays or defines command aliases, which are not environment variables; while an alias could override `ls` (e.g., `alias ls='ls --color=auto'`), the question specifically points to a change in environment variables, not aliases.

Practice this question →

36

MCQmedium

An administrator needs to terminate a hung process with PID 3456 that does not respond to 'kill -15 3456'. Which signal should be used next?

A.kill -9 3456

B.kill -15 3456

C.kill -19 3456

D.kill -1 3456

AnswerA

SIGKILL (signal 9) is the only signal that the Linux kernel delivers directly, bypassing any user-space signal handler in process 3456. Because neither the process nor its threads can catch, block, or ignore SIGKILL, the kernel immediately terminates the process and reaps its resources, making it the correct last resort for a hung process that has failed to respond to SIGTERM.

Why this answer

Kill -9 (SIGKILL) is the signal of last resort for a process that does not respond to SIGTERM (kill -15). SIGKILL cannot be caught, blocked, or ignored by the process; it forces immediate termination by the kernel. Since the process is hung and unresponsive to SIGTERM, SIGKILL is the appropriate next step.

Exam trap

Red Hat often tests the distinction between signals that can be caught/ignored (SIGTERM, SIGHUP) and those that cannot (SIGKILL, SIGSTOP), and candidates may mistakenly choose SIGSTOP (kill -19) thinking it will terminate the process, when it actually only suspends it.

How to eliminate wrong answers

Option B is wrong because kill -15 (SIGTERM) was already attempted and the process did not respond; repeating the same signal will not change the outcome. Option C is wrong because kill -19 (SIGSTOP) suspends a process rather than terminating it, which would leave the hung process in a stopped state, not resolve the issue. Option D is wrong because kill -1 (SIGHUP) typically causes a process to reread its configuration or terminate gracefully, but it is not a guaranteed termination signal and may be ignored or handled by the process, similar to SIGTERM.

Practice this question →

37

MCQmedium

An administrator notices that the /tmp directory is filling up quickly. They want to find all files in /tmp that are larger than 100 MB and owned by user 'ftp', then delete them. The administrator runs: find /tmp -type f -size 100M -user ftp -exec rm {} \;. However, this command deletes only files that are exactly 100 MB, not larger. Which find expression should be used instead?

A.find /tmp -type f -size 100M -user ftp -exec rm {} \;

B.find /tmp -type f -size +100M -user ftp -exec rm {} \;

C.find /tmp -type f -size +100M ! -size 100M -user ftp -exec rm {} \;

D.find /tmp -type f -size +100M -size -100M -user ftp -exec rm {} \;

AnswerB

The + in -size +100M correctly selects every regular file in /tmp owned by the ftp user whose size is greater than 100 MiB, because the plus sign means 'greater than' in find's size test. Combined with -type f to ensure only regular files are considered and -user ftp to restrict ownership, the -exec rm {} \; safely removes each matching file, replacing {} with the pathname. This is the simplest and most precise way to express the administrator's intention.

Why this answer

The `find` command uses `+` before a size value to match files larger than that size, not exactly equal. The original command omitted the `+`, so it matched only files exactly 100 MB. Adding `+100M` correctly selects files larger than 100 MB.

Exam trap

Red Hat often tests the subtle difference between exact size matching and size range matching using the `+` and `-` prefixes, trapping candidates who assume `-size 100M` means 'greater than or equal to' instead of 'exactly equal to'.

How to eliminate wrong answers

Option A is wrong because `-size 100M` matches files exactly 100 MB, not larger, so it fails to delete files exceeding that size. Option C is wrong because `-size +100M ! -size 100M` is redundant and incorrect; `-size +100M` already excludes files exactly 100 MB, and the negation adds no benefit while potentially causing confusion. Option D is wrong because `-size +100M -size -100M` is contradictory and matches no files, as a file cannot be both larger than 100 MB and smaller than 100 MB simultaneously.

Practice this question →

38

MCQhard

During a security audit, an administrator needs to list all TCP ports on which the system is listening, showing only the port numbers and the associated process names. Which command best achieves this?

A.netstat -tulpn

B.nmap -sT localhost

C.sudo ss -tlnp

D.lsof -i TCP:1-65535

AnswerC

sudo ss -tlnp is the correct modern command because ss is part of iproute2 and is the standard socket inspection utility in RHEL. The flags -t limit output to TCP, -l show only listening sockets, -n display numeric ports, and -p attach the PID and process name to each entry; sudo is required because process ownership information is only visible to root for sockets belonging to other users. This command directly reads kernel socket tables via /proc and gives a clean, complete list of all TCP listeners.

Why this answer

`sudo ss -tlnp` lists TCP listening sockets with numeric port numbers and process names. The `-t` flag filters for TCP, `-l` shows only listening sockets, `-n` displays numeric addresses/ports (avoiding DNS resolution), and `-p` reveals the process name. This command requires root privileges to see process information, hence `sudo`.

Exam trap

The trap here is that candidates often default to `netstat -tulpn` (Option A) because it is familiar, but Red Hat EX200 emphasizes `ss` as the modern replacement, and the question specifically asks for only TCP ports and process names, making `-u` (UDP) and the lack of `-l` (listening only) in the default `netstat` command incorrect.

How to eliminate wrong answers

Option A is wrong because `netstat -tulpn` lists both TCP and UDP sockets (due to `-u`), which is not requested, and it shows all sockets (including non-listening) unless combined with `-l`; also, `netstat` is deprecated in many distributions in favor of `ss`. Option B is wrong because `nmap -sT localhost` performs a TCP connect scan against the local host, which is an active scanning technique that may alter system state and does not simply list listening ports; it also requires root for certain scan types and does not show process names. Option D is wrong because `lsof -i TCP:1-65535` lists all open TCP file descriptors across the entire port range, which includes both listening and established connections, and it does not filter to only listening sockets without additional flags like `-sTCP:LISTEN`.

Practice this question →

39

Multi-Selecteasy

Which TWO commands can be used to view the kernel ring buffer?

Select 2 answers

A.journalctl -f

B.dmesg

C.cat /var/log/messages

D.systemctl status

E.journalctl -k

AnswersB, E

dmesg is the canonical command for viewing the kernel ring buffer, a fixed-size circular buffer in kernel memory where the kernel stores its own messages, such as driver initialization, hardware detection, and early boot errors. It reads from the buffer directly via the syslog(2) system call or /dev/kmsg, providing a concise snapshot of kernel-level events. This is the primary, in-memory source for kernel logs, not a file or a systemd-specific interface.

Why this answer

The kernel ring buffer stores kernel-related messages, such as hardware driver and boot messages. The `dmesg` command is specifically designed to print or control this buffer, making it a direct and correct tool for viewing kernel ring buffer messages.

Exam trap

The trap here is that candidates may confuse general log viewing commands (like `journalctl -f` or `cat /var/log/messages`) with the specific tools designed to read the kernel ring buffer, or forget that `journalctl -k` is the systemd-native way to access kernel messages.

Practice this question →

40

Multi-Selectmedium

Which TWO commands can be used to view the contents of a compressed file named 'archive.tar.gz' without extracting it?

Select 2 answers

A.gzip -d archive.tar.gz

B.tar -tzf archive.tar.gz

C.gunzip -c archive.tar.gz

D.tar -xf archive.tar.gz

E.zcat archive.tar.gz | tar -t

AnswersB, E

tar -tzf archive.tar.gz is the canonical one-step listing command: -t selects list mode, -z tells tar to transparently decompress the gzip layer, and -f specifies the archive filename. It reads the gzip-compressed tar stream, walks each tar header entry, and prints metadata such as filenames, permissions, sizes, and timestamps without extracting any files. This is the standard, safe way to inspect a .tar.gz archive's contents.

Why this answer

`tar -tzf archive.tar.gz` lists the contents of a gzip-compressed tar archive without extracting it. The `-t` option tells tar to list the table of contents, `-z` filters the archive through gzip decompression, and `-f` specifies the archive file. This command reads the archive metadata directly without writing any files to disk.

Exam trap

The trap here is that candidates confuse decompression commands (like `gunzip -c`) with listing commands, or they assume `tar -xf` can list contents because of the `-x` (extract) flag, but `-x` always writes files unless combined with `-t` which overrides it to list mode.

Practice this question →

41

MCQeasy

An administrator wants to gracefully terminate a process with PID 12345. Which command should be used?

A.kill -STOP 12345

B.kill -9 12345

C.kill -KILL 12345

D.kill -TERM 12345

AnswerD

Using -TERM sends SIGTERM, the default signal from kill, which politely asks the process to exit. Because SIGTERM can be caught and handled, a well-behaved process can flush buffers, close files, release resources, and perform other cleanup before its standard action (termination) completes. That makes it the canonical signal for graceful termination in an administrative context.

Why this answer

`kill -TERM` (or `kill -15`) sends the SIGTERM signal, which requests a process to terminate gracefully. This allows the process to perform cleanup tasks (e.g., closing files, releasing resources) before exiting, making it the standard way to stop a process politely.

Exam trap

Red Hat often tests the distinction between signals that allow graceful termination (SIGTERM) versus those that force immediate termination (SIGKILL), and candidates frequently confuse `kill -9` as the 'standard' way to stop a process, missing the 'graceful' requirement in the question.

How to eliminate wrong answers

Option A is wrong because `kill -STOP` sends SIGSTOP, which pauses (suspends) the process rather than terminating it; the process remains in a stopped state and can be resumed with SIGCONT. Option B is wrong because `kill -9` sends SIGKILL, which forcefully terminates the process without allowing any cleanup, which is not graceful. Option C is wrong because `kill -KILL` is equivalent to `kill -9` (SIGKILL), which also forcefully kills the process and does not permit graceful shutdown.

Practice this question →

42

MCQeasy

Which command displays the current working directory?

A.pwd

B.ls

C.dir

D.cd

AnswerA

pwd (print working directory) outputs the absolute pathname of the directory the shell is currently in, beginning from the root (/). It is both a shell builtin and a standalone program at /bin/pwd, and it reads the kernel's per-process current working directory. Without options it prints the logical path, while -P resolves symlinks to show the physical location.

Why this answer

The `pwd` command stands for 'print working directory' and is the standard Linux/Unix command to display the absolute path of the current directory. It is part of the GNU Core Utilities and is the correct tool for this task in the Red Hat Enterprise Linux environment tested in EX200.

Exam trap

Red Hat often tests the distinction between commands that navigate (`cd`), list contents (`ls`), and display the current path (`pwd`), and candidates may confuse `cd` with `pwd` because both are commonly used together in shell navigation.

How to eliminate wrong answers

Option B is wrong because `ls` lists the contents of a directory, not the current working directory path. Option C is wrong because `dir` is a command typically used in Windows or DOS environments to list directory contents, and it is not a standard command in Linux for displaying the working directory. Option D is wrong because `cd` is used to change the current working directory, not to display it.

Practice this question →

43

Multi-Selecteasy

Which two commands can be used to display the contents of a compressed .tar.gz archive without extracting it? (Choose two)

Select 2 answers

A.gzcat archive.tar.gz

B.less archive.tar.gz

C.tar -tzf archive.tar.gz

D.tar -tf archive.tar.gz

E.tar -xf archive.tar.gz

AnswersC, D

tar -tzf archive.tar.gz is the textbook explicit way to list a gzipped tarball's contents. The -z option tells tar to decompress the archive through gzip before reading it, -t selects list mode instead of extract mode, and -f names the archive file. The output is a path-by-path listing of every file and directory stored in the archive, with no data extracted to disk.

Why this answer

`tar -tzf` lists the contents of a gzip-compressed tar archive without extracting it. The `-t` flag tells tar to list the table of contents, `-z` handles the gzip decompression on the fly, and `-f` specifies the archive file. This is the standard way to inspect a .tar.gz file's contents without extraction.

Exam trap

Red Hat often tests the distinction between `-t` (list) and `-x` (extract), and candidates mistakenly choose `tar -xf` thinking it only displays contents, or they confuse `gzcat` with a listing tool.

Practice this question →

44

Multi-Selecthard

Which TWO of the following are valid examples of using redirection and pipes in bash to append the output of a command to a file while also displaying it on the terminal? (Choose exactly two.)

Select 2 answers

A.command 2>&1 | tee file

B.command | tee -a file

C.command > file

D.command |& tee -a file

E.command >> file

AnswersB, D

The pipeline command | tee -a file sends only stdout to tee, and the -a flag makes tee open the destination file in append mode, preserving any data already in the file. Tee also writes the same bytes to its own standard output, so the user still sees the command's output live on the terminal. This combination of appending to a persistent log and duplicating the stream to the terminal is exactly what makes it a valid redirection example.

Why this answer

`tee -a file` reads from stdin and writes both to stdout and appends to the named file. The pipe `|` sends the stdout of `command` to `tee`, so the output is displayed on the terminal and appended to `file`. The `-a` flag ensures append mode, not overwrite.

Exam trap

Red Hat often tests the distinction between `|` (stdout only) and `|&` (stdout and stderr), and the requirement for `-a` to append rather than overwrite, causing candidates to miss that option A lacks `-a` and option D correctly uses `|&` with `-a`.

Practice this question →

45

MCQmedium

A system is experiencing high CPU usage. The administrator suspects a process is stuck in an infinite loop. Which command can be used to identify the most CPU-intensive process in real-time?

A.top

B.lsof

C.ps aux

D.strace

AnswerA

top is a real-time process monitoring utility that continuously updates the list of running processes and sorts by CPU usage by default, making it easy to spot which process is consuming high CPU. It refreshes every few seconds and provides interactive sorting and filtering options, allowing administrators to quickly identify and act on the CPU-intensive process.

Why this answer

The `top` command provides a real-time, dynamic view of system processes, sorted by CPU usage by default. It continuously refreshes, making it ideal for identifying the most CPU-intensive process as it runs, which directly addresses the scenario of a suspected infinite loop causing high CPU usage.

Exam trap

Red Hat often tests the distinction between real-time monitoring (`top`) and static snapshots (`ps`), where candidates mistakenly choose `ps aux` because they see CPU columns, but fail to recognize that `ps` does not refresh dynamically to catch a looping process.

How to eliminate wrong answers

Option B is wrong because `lsof` lists open files and the processes using them, but it does not show CPU usage or sort processes by CPU consumption in real-time. Option C is wrong because `ps aux` provides a static snapshot of all processes with CPU usage at the moment of execution, but it does not update in real-time to track a rapidly changing CPU-intensive process. Option D is wrong because `strace` traces system calls and signals for a specific process, but it is not designed to identify the most CPU-intensive process; it is a debugging tool for analyzing a process's behavior, not for monitoring overall system CPU usage.

Practice this question →

46

MCQmedium

A script needs to be run at system boot for a specific user. Which method ensures the script runs with that user's environment?

A.Place the script in /etc/rc.d/rc.local

B.Add an entry to ~/.xprofile

C.Create a systemd user unit in ~/.config/systemd/user/

D.Add the script to the user's crontab with @reboot

AnswerC

A systemd user unit placed in ~/.config/systemd/user/ is managed by the per-user systemd manager and runs in the user's own runtime context, with access to the user's environment, PATH, and systemd user D-Bus. To have it launch at boot rather than only after login, the user must be enabled for lingering (loginctl enable-linger username), after which the user manager starts automatically at boot. This makes it the correct choice for boot-time per-user scripts.

Why this answer

Systemd user units, placed in ~/.config/systemd/user/, are executed in the user's own session context, inheriting the user's environment variables, PATH, and D-Bus session. This ensures the script runs with the specific user's environment at boot, as systemd starts the user manager (systemd --user) early in the boot process for each enabled user.

Exam trap

The trap here is that candidates often assume @reboot in crontab runs with the full user environment, but in reality cron provides a stripped-down environment (e.g., no D-Bus, no systemd user session), making it unsuitable for scripts that depend on user-specific services or graphical session variables.

How to eliminate wrong answers

Option A is wrong because /etc/rc.d/rc.local runs as root during system boot, not as a specific user, so it does not load the target user's environment (e.g., $HOME, $USER, or desktop session variables). Option B is wrong because ~/.xprofile is sourced only when the X display server starts (e.g., via a display manager), not at system boot, and it depends on a graphical session being available. Option D is wrong because @reboot in a user's crontab runs the script under the cron daemon's minimal environment, which lacks the full user session context (e.g., D-Bus, systemd user services, or graphical session variables), and cron may not start until after the user logs in.

Practice this question →

47

MCQmedium

A user reports that they cannot use the 'systemctl' command to manage services. The user is part of the 'wheel' group. Which configuration change is required to allow this?

A.Set the 'permissive' mode for systemd via systemd.conf

B.Add the user to the 'systemd-journal' group

C.Add the user to /etc/sudoers with 'ALL ALL=(ALL) ALL'

D.Ensure /etc/polkit-1/rules.d/10-admin.rules includes an admin rule for the wheel group

AnswerD

systemd's D-Bus service (org.freedesktop.systemd1) uses polkit to authorize actions such as starting, stopping, and enabling units. The default admin rule in /etc/polkit-1/rules.d/10-admin.rules (or equivalent) defines which users or groups—typically wheel—are considered administrators for these actions. Ensuring this rule actually includes the wheel group lets a member of wheel invoke systemctl directly without sudo, resolving the user's inability to use the command.

Why this answer

The 'systemctl' command requires PolicyKit authorization for non-root users to manage systemd services. The correct configuration is to add a PolicyKit rule in /etc/polkit-1/rules.d/10-admin.rules that grants the 'wheel' group administrative privileges, allowing them to invoke systemctl without a password or with appropriate authentication.

Exam trap

The trap here is that candidates often confuse group membership (like 'wheel' for sudo) with direct authorization via PolicyKit, assuming being in the 'wheel' group automatically grants all administrative privileges, when in fact systemctl relies on polkit rules for non-root users.

How to eliminate wrong answers

Option A is wrong because there is no 'systemd.conf' file; systemd uses 'system.conf' and 'user.conf' for daemon configuration, and 'permissive' mode is a SELinux concept, not a systemd setting. Option B is wrong because the 'systemd-journal' group only grants access to read systemd journal logs, not to manage services with systemctl. Option C is wrong because adding the user to /etc/sudoers with 'ALL ALL=(ALL) ALL' would allow them to run any command as root via sudo, but the question specifies using 'systemctl' directly, not via sudo, and the user is already in the 'wheel' group which typically has sudo access; the issue is about direct PolicyKit authorization for systemctl.

Practice this question →

48

MCQmedium

An administrator needs to monitor network traffic on a specific interface in real time. Which tool is most appropriate for this task?

A.tcpdump -i eth0

B.ip -s link

C.ss -tulpn

D.nload eth0

AnswerA

tcpdump -i eth0 is the correct tool because it uses libpcap to capture raw packets as they traverse the specified interface, displaying protocol headers and payloads in real time. It can apply BPF filters to narrow the traffic and, with root or CAP_NET_RAW, operates in promiscuous mode to see all frames, not just those addressed to the host.

Why this answer

tcpdump -i eth0 captures and displays packet headers in real time on the specified interface (eth0). It uses libpcap to intercept raw network frames at the data link layer, making it the standard tool for live traffic monitoring and analysis.

Exam trap

Red Hat often tests the distinction between tools that show aggregate statistics (ip -s link, nload) versus tools that capture individual packets (tcpdump), leading candidates to choose nload because it shows real-time data, but it does not show packet contents.

How to eliminate wrong answers

Option B is wrong because 'ip -s link' shows cumulative statistics (bytes, packets, errors) for interfaces, not real-time packet-by-packet traffic. Option C is wrong because 'ss -tulpn' lists current TCP/UDP sockets and listening services, not live network traffic on an interface. Option D is wrong because 'nload eth0' displays real-time bandwidth usage (in/out rates) but does not show individual packets or their contents; it is a traffic meter, not a packet capture tool.

Practice this question →

49

MCQeasy

Refer to the exhibit. What does the file permission -rw------- indicate about /etc/shadow?

A.Root user can read, write, and execute; group and others have no access.

B.Owner can read and write; group can read; others can read.

C.Owner can read; group can read; others cannot access.

D.Only root user can read and write; others have no access.

AnswerD

The permission string begins with a hyphen indicating a regular file, followed by 'rw-' for the owner, which is root (or the file's owning user). The subsequent '---' for group and '---' for others show those classes have zero access, so only the owner can read and write (and not execute). This matches typical root-owned file permissions.

Why this answer

The permission string `-rw-------` breaks down as: owner (root) has read (4) and write (2) permissions, and no execute (0); group has no permissions (---); others have no permissions (---). Since `/etc/shadow` is owned by root, only the root user can read and write the file, while all other users (including group members and others) have zero access. Option D correctly states this.

Exam trap

Red Hat often tests the misconception that `-rw-------` means the owner can execute, or that the hyphen in the execute position is easily overlooked, causing candidates to incorrectly assume execute permission is present.

How to eliminate wrong answers

Option A is wrong because the permission string shows no execute bit for the owner (the third character is `-`, not `x`), so the root user cannot execute the file; also, group and others have no access, but the statement incorrectly includes execute. Option B is wrong because it claims group and others can read, but the permission string shows `---` for both group and others, meaning no read access. Option C is wrong because it says the owner can only read, but the owner actually has both read and write permissions (the second character is `w`).

Practice this question →

50

MCQhard

A backup script uses tar to create an archive, but the administrator wants to exclude the /tmp directory from the backup. Which tar option should be added?

A.--exclude=/tmp

B.--ignore-failed-read

C.--exclude-from=/tmp

D.-X /tmp

AnswerA

The --exclude=/tmp option is correct because it directly tells GNU tar to skip the entire /tmp directory tree when creating the archive. The argument after --exclude is a shell glob pattern (or literal path) that tar matches against absolute paths while traversing the filesystem, so /tmp (and everything beneath it) will not be included. This is the standard, dedicated mechanism for omitting a directory from a backup.

Why this answer

The `--exclude=PATTERN` option in tar tells the command to skip files or directories matching the given pattern. By specifying `--exclude=/tmp`, the tar archive will omit the /tmp directory and all its contents, which is exactly what the administrator needs for the backup script.

Exam trap

The trap here is that candidates confuse `--exclude` (which excludes a pattern) with `--exclude-from` (which reads patterns from a file), leading them to pick option C or D, thinking they can pass a directory path directly to exclude it.

How to eliminate wrong answers

Option B is wrong because `--ignore-failed-read` tells tar to continue archiving even if it cannot read a file (e.g., due to permissions), but it does not exclude any directory. Option C is wrong because `--exclude-from=FILE` reads exclusion patterns from a file, not from a directory path; using `--exclude-from=/tmp` would try to read patterns from the /tmp directory itself, which is not a valid pattern file and would cause an error. Option D is wrong because `-X /tmp` is the short form of `--exclude-from`, which again expects a file containing patterns, not a directory to exclude; it would attempt to read exclusion patterns from /tmp, not exclude the /tmp directory.

Practice this question →

51

MCQeasy

A user reports that a script in their home directory fails to execute. The script has permissions -rw-r--r-- and is owned by the user. Which command will allow execution for the owner?

A.chmod u+r script.sh

B.chmod a+x script.sh

C.chmod u+x script.sh

D.chmod u-x script.sh

AnswerC

chmod u+x is the precise fix because it sets the execute permission for the owner (the user who owns the file) without altering permissions for anyone else. On Linux, a file must have its execute bit(s) set before the kernel will allow it to be run directly via a path like ./script.sh. Since the script's owner is the user who is running it, this user only needs owner execute permission, not group or other. This follows the minimal privilege principle and is the correct, targeted solution.

Why this answer

The script currently has permissions `-rw-r--r--`, meaning the owner has read and write but not execute. To allow the owner to execute it, you need to add the execute permission for the owner only. `chmod u+x script.sh` adds the execute bit for the user (owner) without affecting group or others, which is the precise requirement.

Exam trap

Red Hat often tests the distinction between adding execute permission for the owner only versus adding it for all users, and the trap here is that candidates might choose `a+x` (option B) thinking it is the simplest solution, but the question explicitly asks for execution for the owner.

How to eliminate wrong answers

Option A is wrong because `chmod u+r script.sh` adds read permission for the owner, but the owner already has read access; it does not add execute permission. Option B is wrong because `chmod a+x script.sh` adds execute permission for all (owner, group, and others), which is excessive and not the minimal change requested. Option D is wrong because `chmod u-x script.sh` removes execute permission from the owner, which would make the script even less executable.

Practice this question →

52

MCQhard

An administrator wants to ensure that when a user presses Ctrl+C during a long-running script, the script cleans up temporary files before exiting. Which approach should the script use?

A.Use 'trap' to catch SIGINT and run cleanup.

B.Use 'set -o ignoreeof' to ignore Ctrl+C.

C.Run the script in the background with '&'.

D.Use 'set -e' to exit on any error.

AnswerA

The `trap` built-in lets the script register a custom handler for signals such as SIGINT, which is what pressing Ctrl+C sends. When the signal is received, the shell suspends the current operation and runs the specified cleanup routine, allowing the administrator to remove temporary files, release locks, or log the interruption before exiting. Setting `trap cleanup INT` (or using a quoted command list) is the standard way to gracefully intercept an interrupt and maintain controlled state.

Why this answer

The `trap` command in Bash allows a script to catch signals like SIGINT (sent when Ctrl+C is pressed) and execute a custom function or command before exiting. By setting `trap cleanup SIGINT`, the script can remove temporary files or perform other cleanup actions automatically, ensuring a graceful termination.

Exam trap

Red Hat often tests the distinction between signals like SIGINT (Ctrl+C) and EOF (Ctrl+D), leading candidates to confuse `ignoreeof` with signal handling.

How to eliminate wrong answers

Option B is wrong because `set -o ignoreeof` prevents the shell from exiting on Ctrl+D (EOF), not Ctrl+C, and does not handle signal-based interruption. Option C is wrong because running a script in the background with `&` does not change how Ctrl+C affects the script; it still receives SIGINT and exits without cleanup. Option D is wrong because `set -e` causes the script to exit immediately if any command fails, but it does not catch or handle the SIGINT signal from Ctrl+C.

Practice this question →

53

MCQeasy

A user wants to set an environment variable named 'EDITOR' to the value '/usr/bin/vim' so that it is available in all future login sessions. Which file should the user add the export command to?

A.~/.bash_logout

B.~/.bash_profile

C./etc/bashrc

D.~/.bashrc

AnswerB

When a user logs in, Bash reads ~/.bash_profile as the user-specific startup file for login shells, which is exactly when persistent environment variables should be defined. Exporting editor in this file makes it available to the shell itself and to all child processes launched during that session, ensuring the setting is inherited system-wide from a user perspective. This is the canonical location for setting per-user environment variables.

Why this answer

The ~/.bash_profile file is executed for login shells, making it the correct place to set environment variables like EDITOR that should persist across all future login sessions. Adding 'export EDITOR=/usr/bin/vim' to this file ensures the variable is defined each time the user logs in.

Exam trap

Red Hat often tests the distinction between login and non-login shell startup files, and the trap here is that candidates mistakenly choose ~/.bashrc because they associate it with user-specific settings, not realizing it is not sourced by login shells.

How to eliminate wrong answers

Option A is wrong because ~/.bash_logout is executed when the user logs out, not at login, so it cannot set environment variables for future sessions. Option C is wrong because /etc/bashrc is a system-wide file that affects all users and is typically sourced by non-login shells, not the appropriate per-user file for login shell environment variables. Option D is wrong because ~/.bashrc is executed for interactive non-login shells (e.g., opening a terminal in a GUI), not for login shells, so it would not guarantee the variable is set in all future login sessions.

Practice this question →

54

MCQmedium

A developer needs to search for the string 'ERROR' in all files under /var/log, but wants to exclude files ending with '.gz'. Which command is correct?

A.grep -r --exclude='*.gz' 'ERROR' /var/log

B.grep -R --exclude='*.gz' 'ERROR' /var/log

C.grep -l 'ERROR' /var/log/*.gz

D.grep -v '*.gz' -r 'ERROR' /var/log

AnswerA

The -r flag makes grep recursively descend into /var/log and all of its subdirectories, while --exclude='*.gz' instructs grep to skip any file whose basename matches that glob, thereby avoiding compressed log files. This precisely implements the requested search: only uncompressed files under /var/log are examined for the string 'ERROR'. Using -r rather than the similar -R is also safer because -r does not dereference symbolic links, keeping the search confined to the named directory tree.

Why this answer

`grep -r` performs a recursive search through all files under /var/log, and the `--exclude='*.gz'` option tells grep to skip any files matching the glob pattern '*.gz'. This combination ensures that only non-compressed log files are searched for the string 'ERROR', meeting the requirement exactly.

Option B uses `-R` instead of `-r`. In GNU grep, `-R` implies `--dereference-recursive`, which follows symbolic links into other directories. This could lead to searching outside `/var/log` if any symlinks point elsewhere, making it less precise for the stated requirement. While `-r` and `-R` are often conflated, `-R` is not equivalent to `-r` when symlinks are present, and the standard recursive option is `-r`. Therefore, B is incorrect.

Exam trap

Red Hat often tests the distinction between `--exclude` (which filters files by name) and `-v` (which inverts line matches), leading candidates to mistakenly use `-v` with a glob pattern to try to exclude files.

How to eliminate wrong answers

Option B is wrong because `grep -R` is equivalent to `grep -r` in most implementations, but the key issue is that the `--exclude` pattern is incorrectly quoted with single quotes inside double quotes or vice versa; however, the primary flaw is that `-R` is not a standard grep option (it is often used for dereferencing symlinks, but the correct recursive flag is `-r`). Option C is wrong because `grep -l 'ERROR' /var/log/*.gz` only lists files matching 'ERROR' that end with '.gz', which is the opposite of what is needed (it excludes non-.gz files). Option D is wrong because `grep -v '*.gz'` treats '*.gz' as a regex pattern to invert matches on lines, not as a file exclusion pattern, and the `-r` flag is misplaced after the pattern; this command would search recursively but exclude lines containing the literal string '*.gz', not files ending with '.gz'.

Practice this question →

55

Multi-Selectmedium

Which TWO commands can be used to display the contents of a compressed log file without decompressing it first?

Select 2 answers

A.bzless /var/log/messages.bz2

B.zcat /var/log/messages.gz

C.grep 'error' /var/log/messages.gz

D.vim /var/log/messages.gz

E.less /var/log/messages.gz

AnswersA, B

bzless is the bzip2-aware counterpart of less; it invokes bzip2 to decompress the file on the fly and pipes the output into the less pager. This lets you interactively scroll through /var/log/messages.bz2 without first expanding it to disk, and bzless cleans up any temporary decompression stream when you quit. Because the file is bzip2-compressed, this command correctly renders the log contents.

Why this answer

`bzless` is a utility specifically designed to view bzip2-compressed files without decompressing them first. It decompresses the file on the fly and pipes the output to a pager, allowing you to scroll through the content. Similarly, option B is correct because `zcat` reads a gzip-compressed file and writes the decompressed data to standard output, effectively displaying the contents without permanently decompressing the file.

Exam trap

The trap here is that candidates often assume `less` or `grep` can handle compressed files natively, but they cannot; the correct approach is to use dedicated tools like `zcat`, `zless`, `bzcat`, or `bzless` that perform on-the-fly decompression.

Practice this question →

56

MCQhard

A company policy requires that all cron jobs run by non-root users must be logged to a specific file /var/log/usercron.log. The system administrator decides to use rsyslog to capture these messages. Which configuration directive should be added to /etc/rsyslog.conf or a file in /etc/rsyslog.d/ to achieve this?

A.user.* /var/log/usercron.log

B.cron.* /var/log/usercron.log

C.*.* /var/log/usercron.log

D.authpriv.* /var/log/usercron.log

AnswerB

The 'cron' facility is the designated syslog source for all messages generated by the cron daemon, such as job launches, completions, and errors. Using the '*' priority wildcard ensures that every severity level—from debug to emergency—is recorded, capturing the full cron activity stream without dropping lower-priority messages. This makes 'cron.*' the precise, policy-compliant directive for sending cron logging to /var/log/usercron.log.

Why this answer

The cron facility in rsyslog captures messages generated by the cron daemon, including cron jobs run by non-root users. By adding the directive `cron.* /var/log/usercron.log` to the rsyslog configuration, all cron messages (regardless of priority) are logged to the specified file, satisfying the policy requirement.

Exam trap

The trap here is that candidates may confuse the `cron` facility with the `user` facility, mistakenly thinking user cron jobs are logged under `user.*` instead of the dedicated `cron` facility.

How to eliminate wrong answers

Option A is wrong because `user.*` captures messages from user-level processes (e.g., user applications), not from the cron daemon; cron jobs are logged under the `cron` facility, not `user`. Option C is wrong because `*.*` logs all syslog messages from every facility to the file, which is overly broad and violates the policy of logging only cron jobs; it would also clutter the log with unrelated system messages. Option D is wrong because `authpriv.*` captures authentication and security-related messages (e.g., sudo, login), not cron job logs; this would miss all cron activity.

Practice this question →

57

MCQeasy

A system administrator needs to find all files in /var/log that have been modified in the last 2 hours. Which command should be used?

A.find /var/log -mmin -120

B.find /var/log -amin -120

C.find /var/log -mtime -0.08

D.find /var/log -cmin -120

AnswerA

The `-mmin -120` predicate is the correct choice because it directly tests modification time in minutes. A leading minus sign means "less than," so `-120` matches any file whose data was last modified within the last 120 minutes (i.e., less than two hours ago). This precisely answers the requirement to find files in `/var/log` that have been modified in the last two hours.

Why this answer

The `find` command with `-mmin -120` searches for files whose data was modified (changed content) within the last 120 minutes. This directly matches the requirement to find files modified in the last 2 hours in /var/log.

Exam trap

The trap here is confusing `-mmin` (modification time) with `-cmin` (change time) or `-amin` (access time), as candidates often misremember which flag tracks content changes versus metadata or access events.

How to eliminate wrong answers

Option B is wrong because `-amin -120` searches for files accessed (read) within the last 120 minutes, not modified. Option C is wrong because `-mtime -0.08` uses a fractional day value that is not precise for a 2-hour window; `-mtime` works in 24-hour increments and rounding can cause inaccuracies. Option D is wrong because `-cmin -120` searches for files whose status (metadata) changed within the last 120 minutes, which includes permission or ownership changes, not necessarily data modification.

Practice this question →

58

MCQmedium

An administrator needs to compress a directory containing subdirectories and files into a single archive file, with maximum compression, and exclude all '*.tmp' files. Which command should be used?

A.tar -czvf archive.tar.gz --exclude='*.tmp' /path/to/dir

B.tar -czvf archive.tar.gz /path/to/dir --exclude='*.tmp'

C.tar -cjvf archive.tar.bz2 --exclude='*.tmp' /path/to/dir

D.tar -czvf archive.tar.gz /path/to/dir

AnswerC

The -j flag invokes bzip2, which provides a considerably higher compression ratio than gzip, satisfying the 'maximum compression' requirement. Placing --exclude='*.tmp' before the source directory ensures the pattern is active before tar reads the files, so temporary files are omitted. The output suffix .tar.bz2 matches the flag and makes the archive self-descriptive.

Why this answer

The question specifies 'maximum compression'. Among common tar compression methods, bzip2 (via the -j flag) typically provides better compression ratios than gzip (-z), though it is slower. Option C uses `tar -cjvf` with the `--exclude` option placed correctly before the source directory, which is the proper syntax for tar exclusions.

This command creates a .tar.bz2 archive with maximum compression while excluding all *.tmp files. Option A uses gzip, which offers faster compression but lower ratios, making it incorrect for 'maximum compression'. Options B and D also fail: B has incorrect syntax (--exclude after the directory), and D omits the exclude option entirely.

Exam trap

Red Hat often tests the distinction between compression methods: gzip (-z) is faster but yields larger archives, while bzip2 (-j) provides better compression at the cost of speed. Candidates may assume -z is the default or best option, but for 'maximum compression', bzip2 is superior.

How to eliminate wrong answers

Option B is wrong because the `--exclude` option is placed after the source directory `/path/to/dir`, which causes tar to ignore the exclusion pattern — tar processes positional arguments in order, and the exclude pattern must precede the source path to take effect. Option C is wrong because it uses `-j` for bzip2 compression instead of `-z` for gzip; while bzip2 can achieve higher compression ratios, the question specifies 'maximum compression' in the context of the commonly used gzip format, and the output file extension `.tar.bz2` does not match the expected `.tar.gz` archive. Option D is wrong because it omits the `--exclude='*.tmp'` option entirely, so all `*.tmp` files will be included in the archive, failing the requirement to exclude them.

Practice this question →

59

MCQhard

Refer to the exhibit. The backup script runs every 5 minutes but generates errors. What is the most likely cause?

A.The script is owned by root.

B.The cron daemon is not running.

C.The script uses absolute paths.

D.The script is not executable.

AnswerD

This is the cause. The exhibit shows the script has permissions 644, meaning there is no execute bit set for the owner, group, or others. When cron encounters a script path in a crontab, it invokes that file directly via execve(), which requires at least one execute bit; otherwise the kernel returns EACCES and the job logs 'Permission denied' or sends a non-zero exit status. The file must be made executable, for example with 'chmod +x', for cron to run it successfully.

Why this answer

The cron job fails because the script lacks execute permissions. Cron requires that scripts specified in crontab entries have the executable bit set (chmod +x) for the user under whose crontab the job runs. Without this, the cron daemon cannot spawn the script as a process, resulting in errors.

Exam trap

Red Hat often tests the distinction between file ownership and file permissions, where candidates mistakenly assume root ownership is the problem, but the actual issue is the missing executable bit that cron strictly enforces.

How to eliminate wrong answers

Option A is wrong because ownership by root does not prevent a script from executing; root ownership is common and cron can run root-owned scripts if the crontab belongs to root or the script has appropriate permissions. Option B is wrong because if the cron daemon were not running, no cron jobs would execute at all, not just this one script — the question states the script runs but generates errors, implying the daemon is active. Option C is wrong because using absolute paths is actually a best practice in cron scripts to avoid PATH issues; absolute paths do not cause execution errors.

Practice this question →

60

Multi-Selectmedium

Which three of the following are valid methods to view the manual page for the 'ls' command? (Choose three)

Select 3 answers

A.help ls

B.man ls

C.whatis ls

D.info ls

E.ls --help

AnswersB, D, E

The `man` utility formats and displays the official manual page for `ls`, which is the canonical reference documentation on most Linux systems. The `ls(1)` man page from GNU coreutils describes all command-line options, exit statuses, and usage examples, and is rendered through a pager such as `less`. Manual pages are numbered by section, and `man ls` automatically finds the user-command entry in section 1. This provides the most comprehensive and authoritative offline documentation for the command.

Why this answer

The 'man' command is the primary method for viewing manual pages in Linux. Running 'man ls' displays the full manual page for the 'ls' command, including its description, options, and usage details.

Exam trap

Red Hat often tests the distinction between commands that provide full manual pages ('man', 'info') versus those that give brief summaries ('--help', 'whatis'), and the trap here is that candidates may mistakenly think 'help' or 'whatis' are valid methods for viewing the full manual page.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Essential Tools questions.

Start 20-question session