Red Hat Certified System Administrator (RHCSA, EX200-style) Practice Exam

What the Red Hat Certified System Administrator (RHCSA, EX200-style) exam covers

• Operate Running Systems189 questions
• Local Storage and File Systems175 questions
• Users and Groups177 questions
• Deploy and Manage Software169 questions
• Manage Security134 questions
• Manage Containers71 questions

Free Red Hat Certified System Administrator (RHCSA, EX200-style) practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 915-question bank.

1. Question 1Operate Running Systems

   Which command shows boot messages from the current boot's journal?

   • Awho -b
   • Buptime
   • Clast reboot
   • Djournalctl -bCorrect
   ✓ Correct answer: D

   The journalctl command with the -b (boot) flag displays log messages from the current boot session, including early initramfs messages, kernel startup information, and service initialization logs. This is the primary method to review boot-time events and troubleshoot startup issues on RHEL systems.

   Why the other options are wrong

   • Awho -b is incorrect because this displays the last system reboot time but not the detailed boot messages.
   • Buptime is incorrect because this shows how long the system has been running, not the boot messages or initialization logs.
   • Clast reboot is incorrect because this lists reboot history but does not provide the detailed journal messages from the current or past boots.
2. Question 2Users and GroupsSelect all that apply

   You want to harden a new user 'fin1' so the password expires in 90 days and the user gets a 7-day warning before expiry. Which TWO commands together achieve this on the existing account? (Choose TWO)

   • Achage -M 90 fin1Correct
   • Bchage -W 7 fin1Correct
   • Cchage -m 90 fin1
   • Dchage -I 7 fin1
   ✓ Correct answer: A, B

   The chage command manages password aging for a user account. The -M flag sets the maximum number of days a password remains valid before the user must change it, so '-M 90' enforces a 90-day expiry. The -W flag sets the number of days before expiry that the user receives a warning, so '-W 7' provides a 7-day advance notice. These two commands together satisfy both requirements.

   Why the other options are wrong

   • CThe lowercase -m flag sets the minimum number of days that must pass before a password can be changed again, not the maximum age.
   • DThe uppercase -I flag sets the number of inactive days after a password expires before the account is locked, not the warning period.
3. Question 3Operate Running Systems

   You need to follow new log messages for the httpd unit in real time, watching them appear as they are written to the journal. Which command does this?

   • Ajournalctl -u httpd -fCorrect
   • Bjournalctl -u httpd --tail
   • Cjournalctl -u httpd -r
   • Dtail -u httpd /var/log/journal
   ✓ Correct answer: A

   The -f (--follow) option behaves like tail -f for the journal: it shows the most recent entries and then continuously appends new ones as they arrive. Combining it with -u httpd limits the live stream to messages from the httpd unit, ideal for watching a service while reproducing a problem.

   Why the other options are wrong

   • Bjournalctl -u httpd --tail is wrong because journalctl has no --tail option; following live output uses -f and -n controls how many recent lines to print.
   • Cjournalctl -u httpd -r is wrong because -r reverses output to show newest first but does not follow new entries in real time.
   • Dtail -u httpd /var/log/journal is wrong because the journal is stored in a binary format that tail cannot parse, and tail has no -u option.
4. Question 4Local Storage and File Systems

   A swap file /swapfile is currently active and you must delete it cleanly to reclaim disk space. Which ordered sequence is correct and safe?

   • Aswapoff /swapfile ; remove the fstab line ; rm -f /swapfileCorrect
   • Brm -f /swapfile ; swapoff /swapfile ; remove the fstab line
   • Cswapoff /swapfile ; rm -f /swapfile (no fstab change needed)
   • Dtruncate -s 0 /swapfile ; swapoff /swapfile
   ✓ Correct answer: A

   The safe order is to deactivate the swap file with swapoff first, so the kernel stops using it and moves its pages back to RAM or other swap, then remove its /etc/fstab entry (and run systemctl daemon-reload) so it is not activated again at the next boot, and finally delete the file with rm to free the disk space. Skipping a step leaves an active swap area, a broken fstab entry, or wasted space.

   Why the other options are wrong

   • Brm -f /swapfile ; swapoff /swapfile ; remove the fstab line is incorrect because deleting the file while it is still active swap leaves the kernel using a now-unlinked file and can cause errors or instability.
   • Cswapoff /swapfile ; rm -f /swapfile (no fstab change needed) is incorrect because if an fstab entry remains, swapon -a at boot will fail or log errors trying to activate a missing file.
   • Dtruncate -s 0 /swapfile ; swapoff /swapfile is incorrect because the kernel refuses to truncate a swap file that is in use (the truncate fails with a text file busy error), so nothing is freed, and the order is reversed: the swap must be deactivated with swapoff before the file is removed.
5. Question 5Users and Groups

   You must set a group password on 'releng' so that users not already in the group can join it temporarily with newgrp by entering that password. Which command sets the group password interactively?

   • Agpasswd relengCorrect
   • Bpasswd -g releng
   • Cgroupmod -p releng
   • Dgpasswd -d releng
   ✓ Correct answer: A

   Invoking gpasswd with only a group name enters interactive mode and prompts you to enter and confirm a new group password, which is stored (hashed) in /etc/gshadow. A non-member can then run 'newgrp releng' and supply that password to temporarily switch their primary group to releng. This is the intended use of group passwords.

   Why the other options are wrong

   • Bpasswd -g releng is incorrect because passwd changes USER passwords; it has no -g option to set a group password.
   • Cgroupmod -p releng is incorrect because groupmod -p expects an already-encrypted password string as an argument (non-interactive) and 'releng' here is parsed as that hash, not as the group name, making the command malformed.
   • Dgpasswd -d releng is incorrect because -d removes a user from a group and requires a username; it does not set a group password.
6. Question 6Deploy and Manage Software

   After several updates you want DNF to discard all cached metadata and downloaded packages under /var/cache/dnf so the next operation rebuilds the cache from the repositories. Which command clears the entire DNF cache?

   • Adnf clean allCorrect
   • Bdnf autoremove
   • Cdnf makecache --refresh
   • Ddnf history clean
   ✓ Correct answer: A

   The dnf clean all command removes all cached data DNF maintains under /var/cache/dnf, including downloaded package RPMs, repository metadata, and the metadata expiration database, forcing the next dnf operation to download fresh metadata. It is the broadest clean operation and is used to recover from stale or corrupted cache content.

   Why the other options are wrong

   • Bdnf autoremove is incorrect because autoremove uninstalls orphaned dependency packages and does not touch the metadata or package cache.
   • Cdnf makecache --refresh is incorrect because makecache downloads and rebuilds the cache rather than clearing it; --refresh forces a metadata refresh but leaves stale cached files in place rather than purging them.
   • Ddnf history clean is incorrect because dnf history has no clean subcommand (its subcommands are list, info, redo, replay, rollback, store, undo and userinstalled); clearing the cache is the job of dnf clean.
7. Question 7Manage Security

   You opened the http service in the public zone at runtime only, then made no other runtime changes. Rather than re-issuing every command with --permanent, you want to persist the current runtime state in one command. Which command copies the entire runtime configuration to permanent?

   • Afirewall-cmd --runtime-to-permanentCorrect
   • Bfirewall-cmd --reload
   • Cfirewall-cmd --permanent-to-runtime
   • Dfirewall-cmd --save-config
   ✓ Correct answer: A

   The --runtime-to-permanent option writes the complete current runtime configuration of all zones into the permanent on-disk configuration files under /etc/firewalld/. This is the quickest way to make ad hoc runtime changes survive a reboot when you are confident the entire current runtime state is what you want to keep. It is the inverse of firewall-cmd --reload, which loads permanent into runtime.

   Why the other options are wrong

   • Bfirewall-cmd --reload is incorrect because reload discards the current runtime and reloads from the permanent files, which would erase your runtime-only http rule rather than save it.
   • Cfirewall-cmd --permanent-to-runtime is incorrect because no such option exists; loading permanent into runtime is done with --reload.
   • Dfirewall-cmd --save-config is incorrect because firewall-cmd has no --save-config option; persisting runtime state is done with --runtime-to-permanent.
8. Question 8Manage Containers

   Which command displays a running container's low-level metadata such as network settings and mounts in JSON?

   • Apodman stats web
   • Bpodman describe web
   • Cpodman inspect webCorrect
   • Dpodman logs web
   ✓ Correct answer: C

   The JSON includes configuration, state, network settings, mounts, and environment; you can filter it with --format to extract a single field.

   Why the other options are wrong

   • Apodman stats shows live CPU and memory usage, not the container's full configuration metadata.
   • Bpodman describe is not a valid Podman subcommand.
   • Dpodman logs prints the container's captured output, not its configuration.
9. Question 9Local Storage and File Systems

   On RHEL 10 the default /etc/auto.master already reads drop-in master-map files from /etc/auto.master.d. You saved a drop-in there containing the line below, but after reloading autofs nothing is mounted under /shares. Which file name will autofs actually read? ``` /shares /etc/auto.shares ```

   • A/etc/auto.master.d/shares.conf
   • B/etc/auto.master.d/.shares.autofs
   • C/etc/auto.master.d/shares.autofsCorrect
   • D/etc/auto.master.d/shares.map
   ✓ Correct answer: C

   When the master map includes a directory, autofs reads only the files in it whose names end in .autofs and ignores everything else, including dot files. A drop-in such as /etc/auto.master.d/shares.autofs is therefore read as if its lines were in auto.master, and /shares is then managed by the map /etc/auto.shares. After renaming the file, reload autofs so it rereads the master map.

   Why the other options are wrong

   • Ashares.conf is incorrect because autofs ignores files in the drop-in directory whose names do not end in .autofs.
   • B.shares.autofs is incorrect because autofs also ignores dot files, whose names start with a dot, even when they end in .autofs.
   • Dshares.map is incorrect because only names ending in .autofs are read from the drop-in directory; .map has no special meaning there.
10. Question 10Users and Groups

    Security policy requires that service-only accounts cannot be used for interactive login but must still own files and run daemons. What is the correct account design?

    • ACreate the account with useradd -M so it has no home directory
    • BCreate a normal user and share its password with no one
    • CLock the account's password with passwd -l
    • DCreate a system account with a non-login shell such as /sbin/nologinCorrect
    ✓ Correct answer: D

    Service accounts should be system accounts (low UID, no aging, often no home) whose login shell is set to /sbin/nologin. That shell refuses interactive logins while the account can still own files and run daemons, satisfying the security policy without breaking service operation.

    Why the other options are wrong

    • ACreating the account with useradd -M is incorrect because it only skips creating a home directory; the account keeps a login shell and can still log in interactively.
    • BCreate a normal user and share its password with no one still leaves an interactive-capable account and relies on secrecy rather than enforcing no-login.
    • CLocking the password with passwd -l is incorrect because it blocks password logins only; the account keeps an interactive shell and can still log in with another method such as an SSH key.

Who this Red Hat Certified System Administrator (RHCSA, EX200-style) practice exam is for

This practice set is for anyone preparing for the Red Hat Certified System Administrator (RHCSA, EX200-style) exam at the intermediate level - from first-time candidates building a foundation to experienced Linux practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Red Hat Certified System Administrator (RHCSA, EX200-style) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Treat your readiness score as knowledge readiness, then validate it with hands-on practice in a real environment before booking the Red Hat Certified System Administrator (RHCSA, EX200-style) exam.

Related Linux resources

• Red Hat Certified System Administrator (RHCSA, EX200-style) study guideKey concepts
• Linux practice examsAll Linux
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• Hands-on rhcsa labsLearn
• Hands-on lfcs labsLearn
• Hands-on podman labsLearn
• RHCSA command cheat sheetCheat sheet
• RHCSA verification cheat sheetCheat sheet
• LFCS command cheat sheetCheat sheet
• Debian and Red Hat, side by sideCheat sheet
• Docker to Podman translation sheetCheat sheet
• Podman command cheat sheetCheat sheet
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• CompTIA Linux+ (XK0-006) practice examRelated
• Linux Foundation Certified System Administrator (LFCS) practice examRelated
• LPIC-1 practice examRelated

Red Hat Certified System Administrator (RHCSA, EX200-style) practice exam FAQ