Domain 1: Operate Running Systems
- systemctl get-default shows the persistent default boot target; systemctl set-default multi-user.target changes it, and systemctl isolate <target> switches the running system immediately without persisting across reboot.
- To reset a lost root password: interrupt GRUB and append rd.break to the kernel line, then mount -o remount,rw /sysroot, chroot /sysroot, passwd root, and create /.autorelabel before exiting so SELinux contexts are fixed on next boot.
- Common systemd targets are multi-user.target (text, like old runlevel 3), graphical.target (GUI, runlevel 5), rescue.target (single-user with most services), and emergency.target (minimal, root filesystem mounted read-only).
- hostnamectl set-hostname server1.example.com sets the static hostname persistently in /etc/hostname; hostnamectl status also shows transient and pretty hostnames plus OS and kernel info.
- journalctl -u <unit> filters the systemd journal by service unit; -b limits to the current boot, -f follows live, -p err filters by priority, and --since/--until filter by time.
- The systemd journal is volatile by default; create /var/log/journal (and restart systemd-journald or set Storage=persistent in journald.conf) to make it persist across reboots.
- Limit journal disk usage with journalctl --vacuum-size=200M or --vacuum-time=2weeks at runtime, or set SystemMaxUse= in /etc/systemd/journald.conf for a permanent cap.
- find searches the filesystem live: find /var -type f -size +100M finds large files, find / -user bob finds files by owner, and find / -perm -4000 finds SUID files.
- tar -czpf home.tar.gz /home creates a gzip-compressed archive preserving permissions (-p); -x extracts, -t lists, and -j uses bzip2 while -J uses xz compression.
- Process priority is set with nice (launch with a niceness) and renice (change a running PID); niceness ranges from -20 (highest priority) to 19 (lowest), and only root can lower the value.
- Signals: kill -15 (SIGTERM) requests graceful shutdown and can be caught; kill -9 (SIGKILL) forces termination and cannot be caught or ignored; kill -1 (SIGHUP) often reloads config.
- A process in state D is in uninterruptible sleep (usually blocked on I/O) and cannot be killed even with SIGKILL until the I/O completes; high %wa in top indicates I/O wait.
- Schedule recurring tasks with systemd timers (OnCalendar= with Persistent=true to run missed jobs after downtime) or cron; crontab -e edits the current user's jobs and changes take effect immediately.
- After editing or adding any unit file you must run systemctl daemon-reload before systemctl will see the change; a unit symlinked to /dev/null is masked and must be unmasked before it can start.
Domain 2: Local Storage and File Systems
- Standard MBR partitioning uses fdisk and GPT-aware tasks use gdisk or parted; after partitioning a running disk run partprobe or udevadm settle so the kernel re-reads the partition table.
- Create swap with mkswap /dev/vdb2 then activate with swapon /dev/vdb2; make it persistent with an /etc/fstab entry using type swap, and verify with swapon --show or free -h.
- Always reference filesystems in /etc/fstab by UUID= or LABEL= rather than device names like /dev/vdb1, because kernel device naming can change between boots.
- After editing /etc/fstab run mount -a to mount everything and catch syntax errors; a bad fstab entry can drop the system into emergency mode at boot, so always test before rebooting.
- Use the nofail option (and _netdev for network filesystems) on non-critical or NFS mounts so a missing device does not block boot; _netdev defers the mount until networking is up.
- mkfs.xfs creates the default RHEL filesystem; XFS can grow online with xfs_growfs but cannot be shrunk; ext4 (mkfs.ext4) can be shrunk offline with resize2fs.
- Mount an NFS export by adding an entry of type nfs with the server:/export source plus _netdev and nofail options, then mount -a; the nfs-utils package must be installed.
- XFS user quotas require the uquota (or gquota for groups) mount option at mount time; configure limits with xfs_quota -x -c 'limit bhard=5g alice' /mountpoint.
- tmpfs is a RAM-backed filesystem; mount it with type tmpfs and a size= option (e.g. size=512M) for fast temporary storage that is cleared on reboot.
- Stratis provides a simplified storage management layer over device-mapper and XFS via the stratisd service and stratis CLI, creating pools and filesystems with single commands.
- lsblk shows block devices and mount points in a tree, blkid shows UUIDs and filesystem types, and df -h shows mounted filesystem usage while du -sh summarizes directory size.
- Linux permissions are read(4)/write(2)/execute(1) per owner/group/other; chmod 640 gives owner read-write, group read, others nothing, and chmod uses either octal or symbolic (u+x) notation.
- The sticky bit (chmod +t or leading 1, e.g. 1777 on /tmp) lets only a file's owner or root delete or rename files inside a world-writable directory.
- chown user:group file changes ownership; chgrp changes only group; chown :group is equivalent to chgrp, and only root can give away ownership of a file.
Domain 3: Users and Groups
- useradd creates accounts and updates /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow; useradd -u 1500 -d /home/sara -s /bin/bash sara sets a specific UID, home, and shell.
- usermod -aG wheel bob appends a supplementary group; omitting -a with -G replaces all supplementary groups, so usermod -G wheel alice removes alice from every other secondary group.
- Lock an account with usermod -L user (or passwd -l), unlock with -U; a non-login service account uses a shell of /sbin/nologin so it cannot log in interactively.
- Members of the wheel group get sudo access by default in RHEL; add a user with usermod -aG wheel <user>, and group membership only takes effect at next login or after newgrp.
- chage manages password aging: chage -E 2026-12-31 user sets account expiration, -M sets max password age, -m sets minimum, and chage -l user lists current settings.
- Systemwide account defaults come from /etc/login.defs (UID/GID ranges, password aging) and /etc/default/useradd (default shell, home base, skel directory).
- /etc/skel holds files copied into each new user's home directory at creation time; edit it to give every new user a default shell config or files.
- id user and getent passwd user return identity information; id shows UID, primary GID, and all groups, while getent also queries network sources like LDAP via NSS.
- Set up a collaborative shared directory by creating a group, chgrp-ing the directory to it, and setting the setgid bit (chmod g+s) so new files inherit the directory's group.
- A restrictive default umask such as 027 (set in /etc/profile or /etc/bashrc) makes new files group-readable and inaccessible to others by removing those permission bits.
- Centralize authentication by joining a domain with SSSD (configured via realm join or authselect) and define sudo rules centrally rather than on each host.
- Passwords are hashed in /etc/shadow (root-only readable), not in the world-readable /etc/passwd; passwd changes a user's hash and prompts for confirmation.
- userdel removes an account but leaves the home directory unless userdel -r is used; groupdel removes a group, and groupmod -n renames one.
- Grant a group a specific command set via a sudoers rule edited with visudo (e.g. %admins ALL=(ALL) NOPASSWD: /usr/bin/systemctl), preferably in a drop-in file under /etc/sudoers.d/.
Domain 4: Deploy and Manage Software
- dnf is the RHEL 8/9 package manager: dnf install/remove/update manage packages and resolve dependencies from repos, while rpm -i installs a single local file without resolving dependencies.
- Install a local RPM with its dependencies using dnf install ./package.rpm; dnf provides /usr/sbin/httpd and rpm -qf <path> identify which package supplies a file.
- Add a repository by creating a .repo file in /etc/yum.repos.d/ or running dnf config-manager --add-repo <url>; each repo needs a unique id, baseurl, and enabled setting.
- Enable GPG signature checking by importing the key and setting gpgcheck=1 in the repo definition so dnf verifies package authenticity before installing.
- DNF application streams (modules) let you pick a software version: dnf module list shows streams, dnf module enable nodejs:18 selects one, then dnf install nodejs installs it.
- Only one stream of a module can be enabled at a time; switching to a different stream often requires dnf module reset <name> first to clear the prior selection.
- dnf history lists transactions; dnf history undo <id> reverses one, dnf history redo replays it, and dnf history userinstalled lists packages a user explicitly installed.
- Install a specific version with dnf install package-1.2.3-4.el9; dnf info <pkg> and rpm -qi <pkg> show package version, size, and description details.
- Build a local/internal repository directory with createrepo_c /path/to/repo, then point clients' .repo files at it so packages download once and are served internally.
- RHEL keeps multiple installed kernels (default protect_running_kernel and installonly_limit=3) so GRUB can boot a previous kernel; grubby --set-default selects the default kernel.
- Register systems and attach subscriptions with subscription-manager register and subscription-manager attach so Red Hat CDN repositories become available.
- dnf repolist shows enabled repositories with IDs and package counts; dnf repolist --all also lists disabled repos, and dnf clean all clears cached metadata.
- metadata_expire in /etc/dnf/dnf.conf or a repo file controls how long cached repo metadata is trusted before dnf refreshes it from the source.
- dnf group install (e.g. 'Development Tools') installs predefined package groups; dnf grouplist shows available groups and dnf groupinfo details their contents.
Domain 5: Manage Security
- SELinux enforces Mandatory Access Control by labeling processes and files with security contexts (user:role:type:level) and applying policy, independent of standard user/group DAC permissions.
- getenforce shows the current mode (Enforcing, Permissive, or Disabled); setenforce 0/1 changes it at runtime, and the persistent mode is set in /etc/selinux/config; sestatus gives a full summary.
- Set persistent SELinux file contexts with semanage fcontext -a -t httpd_sys_content_t '/web(/.*)?' then apply with restorecon -Rv /web; restorecon resets labels to the policy-defined value.
- chcon changes a context immediately but the change is reverted by a relabel or restorecon; only a semanage fcontext rule survives a filesystem relabel, so prefer semanage for permanence.
- SELinux booleans toggle policy behavior: getsebool -a lists them, setsebool httpd_can_network_connect on sets it at runtime, and the -P flag (setsebool -P) makes it persist.
- Diagnose SELinux denials by reading AVC messages with ausearch -m AVC or sealert; never disable SELinux to fix a service - adjust the context, boolean, or port instead.
- Allow a non-standard port for a service by adding it to the right SELinux port type, e.g. semanage port -a -t http_port_t -p tcp 8888, so the service can bind to it.
- Generate a custom policy module from logged denials with audit2allow (e.g. ausearch -m AVC | audit2allow -M mymodule, then semodule -i mymodule.pp) only after confirming the access is legitimate.
- firewall-cmd manages firewalld; runtime changes are lost on reload unless made with --permanent followed by --reload, or captured with firewall-cmd --runtime-to-permanent.
- firewall-cmd --permanent --add-service=http and --add-port=8080/tcp open access; --zone=public --list-all shows a zone's active rules, services, and ports.
- firewalld groups rules into zones (public, internal, trusted, etc.); assign an interface to a restrictive zone and add only the services it needs to limit exposure.
- Harden SSH in /etc/ssh/sshd_config by setting PermitRootLogin no and PasswordAuthentication no, then restart sshd; require named users to escalate with sudo instead of direct root login.
- Configure key-based SSH login by generating a key pair with ssh-keygen on the client and copying the public key to the server with ssh-copy-id user@host.
- Persistent sudo privileges are defined in /etc/sudoers or drop-in files in /etc/sudoers.d/, always edited with visudo so syntax is validated before saving.
Domain 6: Manage Containers
- Red Hat uses Podman (daemonless, rootless-capable) rather than Docker on RHEL; most podman commands mirror the docker CLI syntax.
- podman run -d --name web -p 8080:80 IMAGE starts a detached, named container and publishes a host port to the container port.
- Rootless podman runs entirely as an unprivileged user: container root is mapped to the user’s subuid/subgid range via user namespaces, with no daemon and no host root.
- podman pull, podman images, and podman search manage images; podman rmi removes an image and podman rm removes a container.
- /etc/containers/registries.conf lists the search registries and short-name resolution; podman login authenticates to a registry such as registry.access.redhat.com.
- Persistent storage uses a bind mount or volume: podman run -v /host/dir:/data:Z IMAGE, where the :Z suffix relabels the host directory for SELinux so the container may access it.
- Named volumes are created with podman volume create and attached with -v volname:/path.
- Environment variables are passed with -e VAR=value or --env-file, and podman build -t name:tag . builds an image from a Containerfile (Red Hat’s name for a Dockerfile).
- To run a container as a systemd service, the modern method is a Quadlet .container unit under ~/.config/containers/systemd/ (rootless) or /etc/containers/systemd/ (root), then systemctl daemon-reload and systemctl start.
- The older approach is podman generate systemd --new --files --name CTR to emit a unit file that you enable with systemctl.
- loginctl enable-linger USER lets a rootless user’s systemd services start at boot without that user logging in - essential for rootless container services.
- podman ps -a lists all containers (running and stopped); podman logs and podman exec inspect and enter a running container.
- podman inspect and skopeo inspect show image/container metadata, and skopeo copy moves images between registries without a full pull/push.
- Rootless containers can only publish host ports >= 1024 by default, since binding privileged ports requires extra privilege.
Red Hat Certified System Administrator (RHCSA, EX200-style) exam tips
- RHCSA is 100% hands-on with no multiple-choice; practice executing real tasks in a RHEL 10 VM until commands are muscle memory, since you are graded on the resulting system state, not on theory.
- Make every change persistent and verify it survives a reboot - the most common point loss is configuring something at runtime (mounts, firewall rules, SELinux booleans) but forgetting to make it permanent.
- Reboot your exam machine at least once midway through to confirm nothing you changed breaks boot; a broken /etc/fstab or default target can cost you multiple tasks at the end if discovered too late.
- Lean on built-in documentation: man -k <keyword>, the examples in man pages, /usr/share/doc, and command --help are all available during the exam, so know how to search them quickly.
- Use UUIDs or LABELs in /etc/fstab, run mount -a to validate before rebooting, and remember to run restorecon and daemon-reload after changes that affect SELinux labels or unit files.
Study guide FAQ
Is CertGrid a hands-on Linux lab simulator?
No. The real Red Hat Certified System Administrator (RHCSA, EX200-style) exam is a hands-on, performance-based lab exam. CertGrid provides MCQ-style readiness practice to help you check concepts, commands, troubleshooting choices, and weak domains before doing hands-on labs - it is not a live lab simulator.
How long is the RHCSA exam and what is the passing score?
The EX200 exam is a 2.5-hour (150-minute) performance-based test. The passing score is 210 out of 300 points (70%), and results are typically emailed within a few business days rather than shown immediately.
Is the RHCSA exam multiple choice?
No. There are no multiple-choice or written questions. You are given live RHEL systems and a list of real administrative tasks to complete, and you are scored automatically on whether each task produced the correct, persistent end state.
Which RHEL version and tools should I study?
Current RHCSA tracks RHEL 10 (RHEL 8 is also widely used). Focus on systemd (systemctl, journalctl, timers), dnf and modules, LVM and XFS/Stratis storage, firewalld, and SELinux management with semanage, restorecon, and booleans.
Can I use the internet or notes during the exam?
No external internet, notes, or personal materials are allowed. However, the installed system documentation - man pages, man -k searches, /usr/share/doc, and command --help output - is available, so practice finding answers there.