EX200 Essential Tools Practice Question
Which THREE commands can be used to monitor real-time process status and update the display every 2 seconds? (Choose three.)
⚠ Common exam trap
Red Hat often tests the distinction between snapshot commands (like `ps aux`) and real-time monitoring tools (like `top`, `htop`, or `watch`), trapping candidates who think `ps aux` can update continuously without an external wrapper like `watch`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
htop
Option A, htop, is correct because it is an interactive real-time process viewer that continuously refreshes its display (by default every second, and its refresh interval is configurable), so it can monitor process status in real time. Option B, top -d 2, is correct because top is the classic real-time process monitor and the -d 2 flag explicitly sets the screen update delay to 2 seconds. Option D, watch -n 2 ps aux, is correct because watch repeatedly executes the given command at a fixed interval, and -n 2 makes it rerun ps aux every 2 seconds, producing a refreshed process listing. Option C, ps aux, is not correct because ps is a one-shot snapshot command that prints process information once and exits, with no continuous refresh. Option E, at 2, is not correct because at is a job-scheduling utility for running commands at a specified future time, not a real-time process monitoring tool.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
htop
Why this is correct
htop is an ncurses-based interactive process viewer that updates its display continuously by default, refreshing CPU, memory, and per-process statistics roughly once per second while it remains in the foreground. It redraws the screen in place, so you see live changes without rerunning a command, and it also lets you sort, filter, and signal processes interactively. Because it keeps running and updating until you quit, it is a genuine real-time process monitor.
- ✓
top -d 2
Why this is correct
top is an interactive, full-screen process viewer that runs continuously and refreshes its display at a fixed interval, and the -d 2 option explicitly sets that delay to 2 seconds between screen updates. This polling loop gives you a live, evolving view of CPU usage, memory consumption, and process states as long as the program is running. Since top itself keeps updating in real time and does not exit after one pass, it satisfies the requirement for real-time process monitoring.
- ✗
ps aux
Why it's wrong here
ps aux is a snapshot command: it reads the current process table, prints the complete list once, and then exits, with no built-in repeat or refresh mechanism. As a standalone command, it shows only the processes that existed at the exact moment it ran, so it cannot reveal changes over time. Therefore, ps aux alone is not real-time monitoring; it only produces a static picture, although it can be turned into a recurring display by an external wrapper like watch.
- ✓
watch -n 2 ps aux
Why this is correct
watch -n 2 ps aux is a valid real-time monitoring approach because watch repeatedly executes the given command at the specified interval, in this case every 2 seconds, clearing the screen and redisplaying the fresh output each time. While ps aux is inherently a snapshot, watch makes it into a monitoring loop that continues until terminated, so you see an updated process listing at regular intervals. This combines the portability of ps with a periodic refresh, making it a legitimate real-time monitoring command, even though it does not provide the interactive features of top or htop.
- ✗
at 2
Why it's wrong here
at 2 is a job scheduler, not a monitoring tool: the at command reads a command or script from standard input and executes it once at a specified time, such as 2 o'clock or a relative time like 'now + 2 minutes'. It does not loop, does not refresh output, and is designed for deferred one-shot execution, not for observing processes over time. Therefore, at 2 is entirely unrelated to real-time process monitoring and cannot be used to watch ongoing process activity.
Go deeper
Related to this question
About these practice questions
One of 427 original EX200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This EX200 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX200 exam.