Red Hat Certified System Administrator EX200 practice test

A system administrator needs to find all regular files larger than 10MB in /var/log. Which find command should they use?

Trap 1: find /var/log -type f -size -10M

Finds files smaller than 10MB.

Trap 2: find /var/log -type d -size +10M

Finds directories, not files.

Trap 3: find /var/log -type f -size 10M

Finds files exactly 10MB.

A
find /var/log -type f -size -10M
Why wrong: Finds files smaller than 10MB.
B
find /var/log -type d -size +10M
Why wrong: Finds directories, not files.
C
find /var/log -type f -size 10M
Why wrong: Finds files exactly 10MB.
D
find /var/log -type f -size +10M
Correct syntax for larger than 10MB.

Question 2easymultiple choice

A user needs to view the last 15 lines of a log file that is constantly being updated. Which command should they use?

Trap 1: tail -f /var/log/messages

Follows file, not just last 15 lines.

Trap 2: cat /var/log/messages

Shows entire file.

Trap 3: head -15 /var/log/messages

Shows first 15 lines.

A
tail -n 15 /var/log/messages
Shows last 15 lines.
B
tail -f /var/log/messages
Why wrong: Follows file, not just last 15 lines.
C
cat /var/log/messages
Why wrong: Shows entire file.
D
head -15 /var/log/messages
Why wrong: Shows first 15 lines.

Read the full network assurance explanation →

Question 3mediummulti select

Which TWO statements about systemd journal and rsyslog are correct?

Trap 1: rsyslog reads log messages directly from the journal files in…

rsyslog does not read journal files; it receives messages via socket or from journald forwarding.

Trap 2: The command 'journalctl --list-boots' lists only the current boot's…

--list-boots lists all boots for which journal data is available, not just the current.

Trap 3: The command 'journalctl -u sshd.service' outputs the same as 'tail…

/var/log/messages is a text file; journalctl outputs from the binary journal, and they may not be identical.

A
rsyslog reads log messages directly from the journal files in /var/log/journal.
Why wrong: rsyslog does not read journal files; it receives messages via socket or from journald forwarding.
B
The command 'journalctl --list-boots' lists only the current boot's journal entries.
Why wrong: --list-boots lists all boots for which journal data is available, not just the current.
C
The command 'journalctl -u sshd.service' outputs the same as 'tail -f /var/log/messages' for SSH logs.
Why wrong: /var/log/messages is a text file; journalctl outputs from the binary journal, and they may not be identical.
D
The journal stores logs in a structured binary format, allowing filtering by fields like _UID or _SYSTEMD_UNIT.
journald uses structured logging with various metadata fields.
E
The journal can forward log messages to rsyslog by setting ForwardToSyslog=yes in /etc/systemd/journald.conf.
This configuration enables forwarding from journald to syslog.

Question 4hardmultiple choice

A system administrator needs to ensure that a specific process continues to run even if it crashes. The process is started by a systemd service unit. Which approach ensures the process is automatically restarted by systemd, with a delay of 30 seconds after each crash, and does not count restarts towards the failure limit?

Trap 1: Restart=on-failure and RestartSec=30

on-failure only restarts on non-zero exit codes or signals; a clean exit (exit code 0) would not trigger restart.

Trap 2: Restart=always, RestartSec=30, StartLimitIntervalSec=0

Setting StartLimitIntervalSec=0 without StartLimitBurst=0 still uses the default StartLimitBurst value (5), so after 5 restarts the service will stop.

Trap 3: Restart=always and RestartSec=30

Without StartLimitIntervalSec and StartLimitBurst settings, the default restart limits will eventually stop the service after multiple crashes.

A
Restart=always, RestartSec=30, StartLimitIntervalSec=0, StartLimitBurst=0
These settings disable the restart rate limit and ensure the service restarts every 30 seconds regardless of crash behavior.
B
Restart=on-failure and RestartSec=30
Why wrong: on-failure only restarts on non-zero exit codes or signals; a clean exit (exit code 0) would not trigger restart.
C
Restart=always, RestartSec=30, StartLimitIntervalSec=0
Why wrong: Setting StartLimitIntervalSec=0 without StartLimitBurst=0 still uses the default StartLimitBurst value (5), so after 5 restarts the service will stop.
D
Restart=always and RestartSec=30
Why wrong: Without StartLimitIntervalSec and StartLimitBurst settings, the default restart limits will eventually stop the service after multiple crashes.

Question 5mediummultiple choice

A system administrator needs to ensure that a web server running Apache httpd starts automatically after a system reboot. Which command should the administrator use to enable the httpd service?

Trap 1: systemctl daemon-reload

Reloads systemd configuration, not related to enabling services.

Trap 2: systemctl start httpd

Starts the service now, but does not enable it for boot.

Trap 3: systemctl reenable httpd

Not a valid systemctl subcommand.

A
systemctl daemon-reload
Why wrong: Reloads systemd configuration, not related to enabling services.
B
systemctl start httpd
Why wrong: Starts the service now, but does not enable it for boot.
C
systemctl reenable httpd
Why wrong: Not a valid systemctl subcommand.
D
systemctl enable httpd
Enables the service to start at boot.

Question 6easymultiple choice

Refer to the exhibit. The administrator wants to create a single file system that spans the entire 20 GB disk /dev/sdb. All data on the disk can be discarded. Which steps are required to create an XFS file system on the whole disk?

Exhibit

Refer to the exhibit.

# lsblk /dev/sdb
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sdb 8:16 0 20G 0 disk
├─sdb1 8:17 0 2G 0 part
├─sdb2 8:18 0 2G 0 part
└─sdb3 8:19 0 16G 0 part

# blkid /dev/sdb1
/dev/sdb1: UUID="abc123" TYPE="xfs"
# blkid /dev/sdb2
/dev/sdb2: UUID="def456" TYPE="ext4"
# blkid /dev/sdb3
/dev/sdb3: UUID="ghi789" TYPE="swap"

Trap 1: Run mkfs.xfs /dev/sdb directly; it will overwrite the partition…

mkfs.xfs on whole disk with existing partition table may fail or require -f, but best practice is to remove partitions first.

Trap 2: Use pvcreate /dev/sdb, then vgcreate, lvcreate, and format the…

LVM is not required; the question asks for a single file system on the whole disk, not logical volumes.

Trap 3: Run mkfs.xfs -f /dev/sdb; it will force creation of XFS on the…

While -f can force, creating a file system without partitions is unusual and not standard practice for a disk with partitions.

A
Run mkfs.xfs /dev/sdb directly; it will overwrite the partition table and create a file system.
Why wrong: mkfs.xfs on whole disk with existing partition table may fail or require -f, but best practice is to remove partitions first.
B
Use pvcreate /dev/sdb, then vgcreate, lvcreate, and format the logical volume with mkfs.xfs.
Why wrong: LVM is not required; the question asks for a single file system on the whole disk, not logical volumes.
C
Run mkfs.xfs -f /dev/sdb; it will force creation of XFS on the whole disk without partition table.
Why wrong: While -f can force, creating a file system without partitions is unusual and not standard practice for a disk with partitions.
D
Use fdisk to delete all partitions, create a new partition spanning the whole disk, then run mkfs.xfs on the new partition.
Correct procedure: remove partitions, create single partition, format with XFS.