Hands-on Lab·Red Hat Certified System Administrator

RHCSA on RHEL 10 Changes

RHEL 10 changed enough that older RHCSA material is actively misleading, and the corrections circulating about it are not all correct either. Each claim here is checked against the running system: the container domain really is gone and Flatpak really did replace it, but RHEL 10 did not move to DNF 5 and it did not remove iptables.

Start Here Guide 3 of 67 Beginner

OSRHEL 10.0 (Coughlan)
Kernel6.12.0-55.9.1.el10_0
dnf4.20.0
Flatpak1.16.0
TimeAbout 13 min
Reviewed23 August 2026

Written against the versions above. Checked on RHEL 10.0 (Coughlan), kernel 6.12.0-55.9.1.el10_0. Point releases can change package sets, so the value of this guide is the *method* - `rpm -q` and `command -v` settle these questions in seconds and a forum post does not.

Every command on this page runs on RHCSA-A01.
Server Name	IP Address	OS	Roles	CPU	RAM	HDD
RHCSA-A01	192.168.0.31	RHEL 10.0 (Coughlan)	Practice node (graded) - spare /dev/sda	2 Core	4 GB	50 GB + 15 GB

Before you start

A RHEL 10 machine.
Everything here is read-only except one temporary firewall rule, which is removed.

Claim: containers are on the exam. False.
This is the big one, and it is true - the domain is gone.

Podman is still installed:
```
podman version 5.4.0
```
But Red Hat removed the entire Manage containers section from EX200 for RHEL 10. Every objective that used to live there - pulling images, skopeo, building from a Containerfile, running a container as a systemd service, attaching persistent storage - is no longer examined.

What replaced it is Flatpak, under Manage software:
```
Flatpak 1.16.0
rhel	system,oci,no-gpg-verify
```
Two new objectives, "configure access to Flatpak repositories" and "install and remove Flatpak software packages", and they are covered in guide 15.

If your study material has a Podman chapter, that is a chapter of RHEL 9 material. It is good to know and it is not on this exam.
bash Example session
```
$podman --version; echo "podman is present on the machine - and EX200 for RHEL 10 no longer examines it"podman version 5.4.0podman is present on the machine - and EX200 for RHEL 10 no longer examines it$flatpak --version; flatpak remotes; echo "--- Flatpak is what replaced it in the objectives"Flatpak 1.16.0rhel	system,oci,no-gpg-verify--- Flatpak is what replaced it in the objectives
```
Expected resultPodman installed and unexamined; Flatpak installed and examined.

Success conditionYou will not spend a week on a domain that was deleted.
Claim: RHEL 10 uses DNF 5. False.
Widely repeated, and not true of this release:
```
4.20.0
/usr/bin/dnf-3
```
```
dnf-4.20.0-12.el10_0.noarch
package dnf5 is not installed
```
dnf is DNF 4, the binary is literally called dnf-3, and there is no dnf5 package on the system. Fedora moved to DNF 5; RHEL 10.0 did not follow it.

This matters because the two differ in output format and in some subcommand behaviour, and material written against dnf5 will show you output you never see. Every dnf command in this path is DNF 4, because that is what the exam machine runs.

The check is worth internalising as a habit rather than a fact: rpm -q and readlink -f $(command -v ...) answer "what am I actually running" in two seconds, and on an exam with no internet that is the only way to answer it at all.
bash Example session
```
$dnf --version | head -1; readlink -f $(command -v dnf)4.20.0/usr/bin/dnf-3$rpm -q dnf dnf5 2>&1 | head -2dnf-4.20.0-12.el10_0.noarchpackage dnf5 is not installed
```
Expected resultdnf 4.20.0 at /usr/bin/dnf-3, and no dnf5 package.

Success conditionYou will not type dnf5 syntax at a dnf 4 machine.
Claim: iptables was removed. False, and worth understanding.
The command is present:
```
/usr/sbin/iptables
```
What was removed is the legacy implementation, not the interface:
```
package iptables is not installed
package iptables-services is not installed
iptables-nft-1.8.11-8.el10_0.x86_64
```
iptables-nft is a compatibility shim. It accepts iptables syntax and programs nftables underneath, which is why nft can see what firewalld is doing:
```
table inet firewalld
```
So iptables commands work, and you should still not use them. The exam objective says *"restrict network access using firewalld and firewall-cmd"*, and firewalld owns the ruleset - hand-written iptables rules and firewalld will fight over the same tables. Use firewall-cmd, covered in guide 55.

The distinction matters outside the exam too: "iptables was removed" would mean older tooling breaks, and it does not.
bash Example session
```
$command -v iptables || echo "iptables: not present"/usr/sbin/iptables$rpm -q iptables iptables-services iptables-nft 2>&1 | head -3package iptables is not installedpackage iptables-services is not installediptables-nft-1.8.11-8.el10_0.x86_64$command -v nft && sudo nft list tables 2>&1 | head -3/usr/sbin/nfttable inet firewalld$sudo firewall-cmd --state; sudo firewall-cmd --get-default-zonerunningpublic
```
Expected resultiptables present via the nft backend, with firewalld owning the tables.

Success conditionYou know which firewall tool the exam wants, and why the other one still exists.

Claim: network-scripts are gone. True, completely.

ls: cannot access '/etc/sysconfig/network-scripts/': No such file or directory

Not deprecated, not empty - absent. RHEL 9 deprecated the ifcfg-* format; RHEL 10 removed both the directory and the NetworkManager-initscripts-updown package that read it.

Connections live in keyfiles now:

NAME  UUID                                  TYPE      FILENAME
eth0  60a1ee98-8808-3444-94e0-538c9a8db587  ethernet  /etc/NetworkManager/system-connections/eth0.nmconnection

Any instruction to "edit /etc/sysconfig/network-scripts/ifcfg-eth0" is now impossible to follow, and that phrase appears in a great deal of RHCSA material still online. The replacement is nmcli, or editing the .nmconnection keyfile directly and running nmcli connection reload - both are in guide 52.

Note nmcli -f ... FILENAME, which prints exactly which file backs each connection. That is the fastest way to find what to edit.

bash Example session

$ls /etc/sysconfig/network-scripts/ 2>&1; echo "--- and the modern location:"; sudo ls /etc/NetworkManager/system-connections/ 2>&1ls: cannot access '/etc/sysconfig/network-scripts/': No such file or directory--- and the modern location:eth0.nmconnection$rpm -q NetworkManager-initscripts-updown 2>&1 | head -1package NetworkManager-initscripts-updown is not installed$sudo nmcli -f NAME,UUID,TYPE,FILENAME connection show 2>&1 | head -5NAME  UUID                                  TYPE      FILENAMEeth0  60a1ee98-8808-3444-94e0-538c9a8db587  ethernet  /etc/NetworkManager/system-connections/eth0.nmconnectionlo    f1321c50-1e3a-4910-832f-9390289c99b3  loopback  /run/NetworkManager/system-connections/lo.nmconnection

Expected resultNo network-scripts directory, and keyfiles in their place.

Success conditionYou will not look for a directory that no longer exists.

Claim: X.org is gone. True for the server.
```
package xorg-x11-server-Xorg is not installed
```
RHEL 10 is Wayland only. This barely affects EX200 - the exam is a text environment and the machine here boots to multi-user.target:
```
multi-user.target
```
It is listed because it is the change most likely to matter *outside* the exam, and because it interacts with the objective that does exist: "configure systems to boot into a specific target automatically". graphical.target is still a valid target and is still selectable, so the objective is unaffected even though the display server underneath it has changed. See guide 23.

The pattern across all five claims is the same. Two things everybody repeats are wrong, and both were settled in one command. On an exam with no internet, rpm -q, command -v and readlink -f are how you check anything - and they are faster than remembering.
bash Example session
```
$rpm -q xorg-x11-server-Xorg 2>&1 | head -1package xorg-x11-server-Xorg is not installed$systemctl get-default; echo "--- available graphical targets:"; systemctl list-unit-files --type=target 2>/dev/null | grep -E "graphical|multi-user" | head -3multi-user.target--- available graphical targets:graphical.target              static   -multi-user.target             indirect disabled
```
Expected resultNo X.org server package, booting to multi-user.target.

Success conditionYou can verify a claim about your own system instead of trusting a search result.

Troubleshooting

A guide says to edit ifcfg-eth0 and the file does not exist.

Why: The guide predates RHEL 10.

Fix:Use nmcli, or edit the .nmconnection keyfile and run nmcli connection reload.
dnf5 is not found.

Why: RHEL 10.0 ships DNF 4.

Fix:Use dnf. The syntax in this path is DNF 4 throughout.
iptables rules vanish or conflict.

Why: firewalld owns the nftables ruleset and rewrites it.

Fix:Manage the firewall with firewall-cmd, not iptables.
Practice material spends a chapter on Podman.

Why: It targets RHEL 8 or 9.

Fix:Skip it for EX200 on RHEL 10. Learn Flatpak instead.

Official sources

← All RHCSA guides

RHCSA on RHEL 10 Changes

Before you start

Claim: containers are on the exam. False.

Claim: RHEL 10 uses DNF 5. False.

Claim: iptables was removed. False, and worth understanding.

Claim: network-scripts are gone. True, completely.

Claim: X.org is gone. True for the server.

Troubleshooting

Official sources