Red Hat Certified System Administrator (RHCSA, EX200-style) Practice Exam

What the Red Hat Certified System Administrator (RHCSA, EX200-style) exam covers

• Operate Running Systems345 questions
• Local Storage and File Systems320 questions
• Users and Groups323 questions
• Deploy and Manage Software308 questions
• Manage Security244 questions
• Manage Containers130 questions

Free Red Hat Certified System Administrator (RHCSA, EX200-style) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 1,670.

1. Question 1Operate Running Systems

   Which command shows the systemd boot target / default target on RHEL?

   • Asystemctl get-defaultCorrect
   • Bchmod default
   • Cls /default
   • Dping default
   ✓ Correct answer: A

   The systemctl get-default command displays the currently configured default target (boot goal) in systemd, which controls what services and facilities the system initializes during startup. This is the standard RHEL method for viewing the persistent default target setting across reboots.

   Why the other options are wrong

   • Bchmod default is incorrect because chmod modifies file permissions, not systemd targets.
   • Cls /default is incorrect because /default is not a valid directory or systemd interface; systemd targets are defined in /etc/systemd/system/ and /lib/systemd/system/.
   • Dping default is incorrect because ping is a network connectivity diagnostic tool unrelated to systemd target management.
2. Question 2Users and Groups

   You set 'chage -d 0 alice'. What is the effect at alice's next login?

   • AHer password aging is disabled so it will never prompt her to change it again
   • BHer password is treated as expired and she is forced to change it immediately upon next loginCorrect
   • CHer account itself expires on day 0 and she can no longer log in until it is re-enabled
   • DHer maximum password age is set to 0 days, blocking her from ever setting a new one
   ✓ Correct answer: B

   chage -d 0 sets the date of the last password change to the epoch (day 0), which makes the password immediately expired. At alice's next login she is forced to set a new password before she can continue, a common way to require a password change on first use.

   Why the other options are wrong

   • AThat describes 'chage -d -1' or disabling aging; '-d 0' sets the last-change date to the epoch and forces an immediate change, it does not disable prompting.
   • CAccount expiration is set with 'chage -E', not '-d'; '-d 0' affects the password's last-change field and still permits login to change the password.
   • DMaximum password age is controlled by '-M'; '-d 0' sets the last-change date, so it expires the current password rather than setting a max age of 0.
3. Question 3Operate Running Systems

   A service unit shows "Active: failed" and its failed state lingers in systemctl output even after you fixed the underlying problem and restarted it successfully. Which command clears the residual failed state?

   • Asystemctl reset-failed <unit>Correct
   • Bsystemctl daemon-reexec
   • Csystemctl clean <unit>
   • Dsystemctl mask <unit>
   ✓ Correct answer: A

   The reset-failed subcommand clears the recorded failure state and resets the restart-attempt counters for a unit (or all units if none is named), removing it from the list of failed units. It is appropriate after the root cause is resolved so the unit no longer appears as failed. Note that a successful restart sets the unit active but does not always purge the historical failed marker, which reset-failed removes.

   Why the other options are wrong

   • Bsystemctl daemon-reexec is incorrect because it re-executes the systemd manager itself to apply a systemd upgrade and does not target an individual unit's failed state.
   • Csystemctl clean <unit> is incorrect because clean removes a unit's runtime, cache, or state files (per RuntimeDirectory, etc.), not the failed status flag.
   • Dsystemctl mask <unit> is incorrect because mask links the unit to /dev/null to make it unstartable, which neither fixes nor clears a failed state.
4. Question 4Operate Running Systems

   A RHEL 10 server boots into the graphical desktop, but you need it to boot into a text-only environment with networking and multi-user services on every future boot. Which command makes this persistent?

   • Asystemctl set-default multi-user.targetCorrect
   • Bsystemctl isolate multi-user.target
   • Csystemctl set-default text.target
   • Dsystemctl enable multi-user.target
   ✓ Correct answer: A

   The systemctl set-default command updates the /etc/systemd/system/default.target symlink so it points at multi-user.target, which provides a full multi-user, networked, text-only environment without a graphical display manager. Because it changes the persistent symlink, the system boots into that target on every subsequent reboot.

   Why the other options are wrong

   • Bsystemctl isolate multi-user.target is incorrect because isolate switches the current running session to that target immediately but does not change the default symlink, so the next reboot would still go graphical.
   • Csystemctl set-default text.target is incorrect because there is no text.target in systemd; the correct unit name for the text-only multi-user environment is multi-user.target.
   • Dsystemctl enable multi-user.target is incorrect because enabling a target adds it to the boot but does not set it as the default boot goal; only set-default repoints the default.target symlink.
5. Question 5Operate Running Systems

   You want to open an interactive SFTP session to the host files1 as the user backup to manually browse and transfer files over the SSH protocol. Which command starts this session?

   • Asftp backup@files1Correct
   • Bftp backup@files1
   • Cssh sftp://backup@files1
   • Dscp -i backup@files1
   ✓ Correct answer: A

   The sftp command opens an interactive file-transfer session over SSH, presenting an FTP-like prompt where you can use get, put, ls, cd, and similar commands while the entire session is encrypted. The user@host argument specifies which account and server to connect to. SFTP uses the same SSH service (port 22) and authentication as ssh, so existing keys and credentials work.

   Why the other options are wrong

   • Bftp backup@files1 is incorrect because the plain ftp client uses the unencrypted FTP protocol, not SSH, and does not provide secure transfer.
   • Cssh sftp://backup@files1 is incorrect because ssh does not accept sftp:// URLs; the dedicated sftp client is used instead.
   • Dscp -i backup@files1 is incorrect because -i expects an identity (private key) file argument, and scp is non-interactive, so it cannot provide a browseable SFTP session.
6. Question 6Local Storage and File Systems

   After creating a new systemd .mount unit at /etc/systemd/system/data.mount, which command must you run before 'systemctl start data.mount' so systemd becomes aware of the newly created unit file?

   • Asystemctl daemon-reloadCorrect
   • Bmount -a
   • Csystemctl reset-failed data.mount
   • DUdevadm trigger
   ✓ Correct answer: A

   Whenever you add or edit a unit file on disk, systemd does not automatically re-read it; systemctl daemon-reload regenerates systemd's internal dependency graph from the on-disk unit files. Only after this reload will 'systemctl start data.mount' and 'systemctl enable data.mount' see the new mount unit.

   Why the other options are wrong

   • Bmount -a is incorrect because mount -a processes /etc/fstab entries, not standalone systemd .mount unit files placed under /etc/systemd/system.
   • Csystemctl reset-failed data.mount is incorrect because reset-failed only clears a lingering failed state; it does not load a brand-new unit file into systemd.
   • Dudevadm trigger is incorrect because udevadm re-fires kernel device events for udev rules and has nothing to do with reloading systemd unit definitions.
7. Question 7Users and Groups

   An /etc/shadow line reads 'guest:!!:19500:0:99999:7:::'. What does the '!!' in field 2 most directly indicate?

   • ANo valid password hash is set here, so password authentication can never succeedCorrect
   • BThe password is stored as an MD5 hash, which begins with the $1$ prefix in this field
   • CThe account expired 2 days ago, as recorded by the expiry field of this shadow entry
   • DThe user must change the password at the next login before an interactive shell is granted
   ✓ Correct answer: A

   A password field of !! (or just ! or *) is not a valid crypt() hash, so it can never match any supplied password, meaning the account cannot authenticate with a password. The !! pattern is what useradd writes when an account is created without a password being set, leaving it effectively locked until passwd assigns a real hash.

   Why the other options are wrong

   • BThe password is stored using the MD5 algorithm is incorrect because MD5 hashes begin with $1$ and a real hash would appear here, not !!.
   • CThe account expired 2 days ago is incorrect because account expiry is governed by field 8, which is empty here, and !! is in the password field.
   • DThe user must change the password at next login is incorrect because a forced change is signaled by a last-change date of 0 (field 3), whereas field 3 here is 19500, a normal date.
8. Question 8Deploy and Manage Software

   You need to know which packages were affected the last time the firewalld package itself was touched by any DNF transaction. Which command lists the transaction history filtered to that package?

   • Adnf history list firewalldCorrect
   • Bdnf history info firewalld
   • Cdnf list history firewalld
   • Ddnf provides firewalld
   ✓ Correct answer: A

   dnf history list accepts a package name and prints the table of all transactions in which that package was installed, upgraded, downgraded, reinstalled, or removed, showing the transaction IDs, actions, and dates relevant to firewalld. This is the standard way to list every DNF transaction that touched a named package.

   Why the other options are wrong

   • Bdnf history info is designed to show the full detail of a specific transaction (typically by transaction ID); for simply listing all transactions involving a named package, dnf history list <package> is the appropriate command.
   • Cdnf list filters packages by state and name and does not accept 'history' as an argument, so 'dnf list history firewalld' is not valid for transaction history.
   • Ddnf provides performs capability-to-package resolution and reports nothing about transaction history.
9. Question 9Deploy and Manage Software

   After defining a new local repository, you want to verify DNF recognizes it and see its package count and status WITHOUT installing anything. Which command lists configured repositories and shows whether the new repo is enabled?

   • Adnf repolist --allCorrect
   • Bdnf list --downloaded
   • Crpm -qa --repo
   • Ddnf history list
   ✓ Correct answer: A

   The 'dnf repolist' command displays the configured repositories; adding --all shows both enabled and disabled repos along with their status, so you can confirm a newly added repository is present and enabled. By default repolist shows only enabled repositories, but --all reveals everything defined in /etc/yum.repos.d, helping verify a freshly created local repo is recognized.

   Why the other options are wrong

   • Bdnf list --downloaded is incorrect because it lists packages whose RPM files are cached locally, not the configured repositories.
   • Crpm -qa --repo is incorrect because rpm queries the installed-package database and has no --repo option to enumerate repositories.
   • Ddnf history list is incorrect because it shows past transactions rather than the current repository configuration.
10. Question 10Operate Running Systems

    After 'systemctl daemon-reload', a service you edited still behaves oddly, and you want to see EXACTLY which files (the vendor unit plus every drop-in) systemd has merged to form the effective configuration, in load order. Which command shows this?

    • Asystemctl cat <unit>Correct
    • Bsystemctl show <unit>
    • Csystemctl list-dependencies <unit>
    • Dsystemd-analyze verify <unit>
    ✓ Correct answer: A

    systemctl cat concatenates and displays the actual on-disk unit definition, beginning with the primary unit file and then each drop-in override (with comment lines showing each file's path), exactly as systemd reads them. This is the fastest way to confirm which drop-in is supplying a directive and to spot a stray override that explains unexpected behavior. By contrast, systemctl show prints resolved property=value pairs, not the source files, so it is less useful when you need to locate the originating file.

    Why the other options are wrong

    • Bsystemctl show outputs the computed effective properties as key=value pairs but does not reveal which file each setting came from or show the raw directives.
    • Clist-dependencies maps the unit's dependency tree (Wants/Requires/After), not the merged configuration files.
    • Dsystemd-analyze verify lint-checks a unit for errors but does not display the merged source files in load order.

Related Linux resources

• Red Hat Certified System Administrator (RHCSA, EX200-style) study guideKey concepts
• Linux practice examsAll Linux
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• LPIC-1 practice examRelated
• LPIC-2 practice examRelated
• Linux Foundation Certified System Administrator (LFCS) practice examRelated

Red Hat Certified System Administrator (RHCSA, EX200-style) practice exam FAQ