RHCSA: Red Hat System Administrator Study Guide

Domain 1: Operate Running Systems

Key concepts you must know · 345 practice questions

systemctl get-default shows the persistent default boot target; systemctl set-default multi-user.target changes it, and systemctl isolate <target> switches the running system immediately without persisting across reboot.
To reset a lost root password: interrupt GRUB and append rd.break to the kernel line, then mount -o remount,rw /sysroot, chroot /sysroot, passwd root, and create /.autorelabel before exiting so SELinux contexts are fixed on next boot.
Common systemd targets are multi-user.target (text, like old runlevel 3), graphical.target (GUI, runlevel 5), rescue.target (single-user with most services), and emergency.target (minimal, root filesystem mounted read-only).
hostnamectl set-hostname server1.example.com sets the static hostname persistently in /etc/hostname; hostnamectl status also shows transient and pretty hostnames plus OS and kernel info.
journalctl -u <unit> filters the systemd journal by service unit; -b limits to the current boot, -f follows live, -p err filters by priority, and --since/--until filter by time.
The systemd journal is volatile by default; create /var/log/journal (and restart systemd-journald or set Storage=persistent in journald.conf) to make it persist across reboots.
Limit journal disk usage with journalctl --vacuum-size=200M or --vacuum-time=2weeks at runtime, or set SystemMaxUse= in /etc/systemd/journald.conf for a permanent cap.
find searches the filesystem live: find /var -type f -size +100M finds large files, find / -user bob finds files by owner, and find / -perm -4000 finds SUID files.
tar -czpf home.tar.gz /home creates a gzip-compressed archive preserving permissions (-p); -x extracts, -t lists, and -j uses bzip2 while -J uses xz compression.
Process priority is set with nice (launch with a niceness) and renice (change a running PID); niceness ranges from -20 (highest priority) to 19 (lowest), and only root can lower the value.
Signals: kill -15 (SIGTERM) requests graceful shutdown and can be caught; kill -9 (SIGKILL) forces termination and cannot be caught or ignored; kill -1 (SIGHUP) often reloads config.
A process in state D is in uninterruptible sleep (usually blocked on I/O) and cannot be killed even with SIGKILL until the I/O completes; high %wa in top indicates I/O wait.
Schedule recurring tasks with systemd timers (OnCalendar= with Persistent=true to run missed jobs after downtime) or cron; crontab -e edits the current user's jobs and changes take effect immediately.
After editing or adding any unit file you must run systemctl daemon-reload before systemctl will see the change; a unit symlinked to /dev/null is masked and must be unmasked before it can start.

Domain 2: Local Storage and File Systems

Key concepts you must know · 320 practice questions

Standard MBR partitioning uses fdisk and GPT-aware tasks use gdisk or parted; after partitioning a running disk run partprobe or udevadm settle so the kernel re-reads the partition table.
Create swap with mkswap /dev/vdb2 then activate with swapon /dev/vdb2; make it persistent with an /etc/fstab entry using type swap, and verify with swapon --show or free -h.
Always reference filesystems in /etc/fstab by UUID= or LABEL= rather than device names like /dev/vdb1, because kernel device naming can change between boots.
After editing /etc/fstab run mount -a to mount everything and catch syntax errors; a bad fstab entry can drop the system into emergency mode at boot, so always test before rebooting.
Use the nofail option (and _netdev for network filesystems) on non-critical or NFS mounts so a missing device does not block boot; _netdev defers the mount until networking is up.
mkfs.xfs creates the default RHEL filesystem; XFS can grow online with xfs_growfs but cannot be shrunk; ext4 (mkfs.ext4) can be shrunk offline with resize2fs.
Mount an NFS export by adding an entry of type nfs with the server:/export source plus _netdev and nofail options, then mount -a; the nfs-utils package must be installed.
XFS user quotas require the uquota (or gquota for groups) mount option at mount time; configure limits with xfs_quota -x -c 'limit bhard=5g alice' /mountpoint.
tmpfs is a RAM-backed filesystem; mount it with type tmpfs and a size= option (e.g. size=512M) for fast temporary storage that is cleared on reboot.
Stratis provides a simplified storage management layer over device-mapper and XFS via the stratisd service and stratis CLI, creating pools and filesystems with single commands.
lsblk shows block devices and mount points in a tree, blkid shows UUIDs and filesystem types, and df -h shows mounted filesystem usage while du -sh summarizes directory size.
Linux permissions are read(4)/write(2)/execute(1) per owner/group/other; chmod 640 gives owner read-write, group read, others nothing, and chmod uses either octal or symbolic (u+x) notation.
The sticky bit (chmod +t or leading 1, e.g. 1777 on /tmp) lets only a file's owner or root delete or rename files inside a world-writable directory.
chown user:group file changes ownership; chgrp changes only group; chown :group is equivalent to chgrp, and only root can give away ownership of a file.

Domain 3: Users and Groups

Key concepts you must know · 323 practice questions

useradd creates accounts and updates /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow; useradd -u 1500 -d /home/sara -s /bin/bash sara sets a specific UID, home, and shell.
usermod -aG wheel bob appends a supplementary group; omitting -a with -G replaces all supplementary groups, so usermod -G wheel alice removes alice from every other secondary group.
Lock an account with usermod -L user (or passwd -l), unlock with -U; a non-login service account uses a shell of /sbin/nologin so it cannot log in interactively.
Members of the wheel group get sudo access by default in RHEL; add a user with usermod -aG wheel <user>, and group membership only takes effect at next login or after newgrp.
chage manages password aging: chage -E 2026-12-31 user sets account expiration, -M sets max password age, -m sets minimum, and chage -l user lists current settings.
Systemwide account defaults come from /etc/login.defs (UID/GID ranges, password aging) and /etc/default/useradd (default shell, home base, skel directory).
/etc/skel holds files copied into each new user's home directory at creation time; edit it to give every new user a default shell config or files.
id user and getent passwd user return identity information; id shows UID, primary GID, and all groups, while getent also queries network sources like LDAP via NSS.
Set up a collaborative shared directory by creating a group, chgrp-ing the directory to it, and setting the setgid bit (chmod g+s) so new files inherit the directory's group.
A restrictive default umask such as 027 (set in /etc/profile or /etc/bashrc) makes new files group-readable and inaccessible to others by removing those permission bits.
Centralize authentication by joining a domain with SSSD (configured via realm join or authselect) and define sudo rules centrally rather than on each host.
Passwords are hashed in /etc/shadow (root-only readable), not in the world-readable /etc/passwd; passwd changes a user's hash and prompts for confirmation.
userdel removes an account but leaves the home directory unless userdel -r is used; groupdel removes a group, and groupmod -n renames one.
Grant a group a specific command set via a sudoers rule edited with visudo (e.g. %admins ALL=(ALL) NOPASSWD: /usr/bin/systemctl), preferably in a drop-in file under /etc/sudoers.d/.

Domain 4: Deploy and Manage Software

Key concepts you must know · 308 practice questions

dnf is the RHEL 8/9 package manager: dnf install/remove/update manage packages and resolve dependencies from repos, while rpm -i installs a single local file without resolving dependencies.
Install a local RPM with its dependencies using dnf install ./package.rpm; dnf provides /usr/sbin/httpd and rpm -qf <path> identify which package supplies a file.
Add a repository by creating a .repo file in /etc/yum.repos.d/ or running dnf config-manager --add-repo <url>; each repo needs a unique id, baseurl, and enabled setting.
Enable GPG signature checking by importing the key and setting gpgcheck=1 in the repo definition so dnf verifies package authenticity before installing.
DNF application streams (modules) let you pick a software version: dnf module list shows streams, dnf module enable nodejs:18 selects one, then dnf install nodejs installs it.
Only one stream of a module can be enabled at a time; switching to a different stream often requires dnf module reset <name> first to clear the prior selection.
dnf history lists transactions; dnf history undo <id> reverses one, dnf history redo replays it, and dnf history userinstalled lists packages a user explicitly installed.
Install a specific version with dnf install package-1.2.3-4.el9; dnf info <pkg> and rpm -qi <pkg> show package version, size, and description details.
Build a local/internal repository directory with createrepo_c /path/to/repo, then point clients' .repo files at it so packages download once and are served internally.
RHEL keeps multiple installed kernels (default protect_running_kernel and installonly_limit=3) so GRUB can boot a previous kernel; grubby --set-default selects the default kernel.
Register systems and attach subscriptions with subscription-manager register and subscription-manager attach so Red Hat CDN repositories become available.
dnf repolist shows enabled repositories with IDs and package counts; dnf repolist --all also lists disabled repos, and dnf clean all clears cached metadata.
metadata_expire in /etc/dnf/dnf.conf or a repo file controls how long cached repo metadata is trusted before dnf refreshes it from the source.
dnf group install (e.g. 'Development Tools') installs predefined package groups; dnf grouplist shows available groups and dnf groupinfo details their contents.

Domain 5: Manage Security

Key concepts you must know · 244 practice questions

SELinux enforces Mandatory Access Control by labeling processes and files with security contexts (user:role:type:level) and applying policy, independent of standard user/group DAC permissions.
getenforce shows the current mode (Enforcing, Permissive, or Disabled); setenforce 0/1 changes it at runtime, and the persistent mode is set in /etc/selinux/config; sestatus gives a full summary.
Set persistent SELinux file contexts with semanage fcontext -a -t httpd_sys_content_t '/web(/.*)?' then apply with restorecon -Rv /web; restorecon resets labels to the policy-defined value.
chcon changes a context immediately but the change is reverted by a relabel or restorecon; only a semanage fcontext rule survives a filesystem relabel, so prefer semanage for permanence.
SELinux booleans toggle policy behavior: getsebool -a lists them, setsebool httpd_can_network_connect on sets it at runtime, and the -P flag (setsebool -P) makes it persist.
Diagnose SELinux denials by reading AVC messages with ausearch -m AVC or sealert; never disable SELinux to fix a service - adjust the context, boolean, or port instead.
Allow a non-standard port for a service by adding it to the right SELinux port type, e.g. semanage port -a -t http_port_t -p tcp 8888, so the service can bind to it.
Generate a custom policy module from logged denials with audit2allow (e.g. ausearch -m AVC | audit2allow -M mymodule, then semodule -i mymodule.pp) only after confirming the access is legitimate.
firewall-cmd manages firewalld; runtime changes are lost on reload unless made with --permanent followed by --reload, or captured with firewall-cmd --runtime-to-permanent.
firewall-cmd --permanent --add-service=http and --add-port=8080/tcp open access; --zone=public --list-all shows a zone's active rules, services, and ports.
firewalld groups rules into zones (public, internal, trusted, etc.); assign an interface to a restrictive zone and add only the services it needs to limit exposure.
Harden SSH in /etc/ssh/sshd_config by setting PermitRootLogin no and PasswordAuthentication no, then restart sshd; require named users to escalate with sudo instead of direct root login.
Configure key-based SSH login by generating a key pair with ssh-keygen on the client and copying the public key to the server with ssh-copy-id user@host.
Persistent sudo privileges are defined in /etc/sudoers or drop-in files in /etc/sudoers.d/, always edited with visudo so syntax is validated before saving.

Domain 6: Manage Containers

Key concepts you must know · 130 practice questions

Red Hat uses Podman (daemonless, rootless-capable) rather than Docker on RHEL; most podman commands mirror the docker CLI syntax.
podman run -d --name web -p 8080:80 IMAGE starts a detached, named container and publishes a host port to the container port.
Rootless podman runs entirely as an unprivileged user: container root is mapped to the user’s subuid/subgid range via user namespaces, with no daemon and no host root.
podman pull, podman images, and podman search manage images; podman rmi removes an image and podman rm removes a container.
/etc/containers/registries.conf lists the search registries and short-name resolution; podman login authenticates to a registry such as registry.access.redhat.com.
Persistent storage uses a bind mount or volume: podman run -v /host/dir:/data:Z IMAGE, where the :Z suffix relabels the host directory for SELinux so the container may access it.
Named volumes are created with podman volume create and attached with -v volname:/path.
Environment variables are passed with -e VAR=value or --env-file, and podman build -t name:tag . builds an image from a Containerfile (Red Hat’s name for a Dockerfile).
To run a container as a systemd service, the modern method is a Quadlet .container unit under ~/.config/containers/systemd/ (rootless) or /etc/containers/systemd/ (root), then systemctl daemon-reload and systemctl start.
The older approach is podman generate systemd --new --files --name CTR to emit a unit file that you enable with systemctl.
loginctl enable-linger USER lets a rootless user’s systemd services start at boot without that user logging in - essential for rootless container services.
podman ps -a lists all containers (running and stopped); podman logs and podman exec inspect and enter a running container.
podman inspect and skopeo inspect show image/container metadata, and skopeo copy moves images between registries without a full pull/push.
Rootless containers can only publish host ports >= 1024 by default, since binding privileged ports requires extra privilege.

RHCSA: Red Hat System Administrator exam tips

RHCSA is 100% hands-on with no multiple-choice; practice executing real tasks in a RHEL 10 VM until commands are muscle memory, since you are graded on the resulting system state, not on theory.
Make every change persistent and verify it survives a reboot - the most common point loss is configuring something at runtime (mounts, firewall rules, SELinux booleans) but forgetting to make it permanent.
Reboot your exam machine at least once midway through to confirm nothing you changed breaks boot; a broken /etc/fstab or default target can cost you multiple tasks at the end if discovered too late.
Lean on built-in documentation: man -k <keyword>, the examples in man pages, /usr/share/doc, and command --help are all available during the exam, so know how to search them quickly.
Use UUIDs or LABELs in /etc/fstab, run mount -a to validate before rebooting, and remember to run restorecon and daemon-reload after changes that affect SELinux labels or unit files.

Study guide FAQ

Is CertGrid a hands-on Linux lab simulator?

No. The real RHCSA: Red Hat System Administrator exam is a hands-on, performance-based lab exam. CertGrid provides MCQ-style readiness practice to help you check concepts, commands, troubleshooting choices, and weak domains before doing hands-on labs - it is not a live lab simulator.

How long is the RHCSA exam and what is the passing score?

The EX200 exam is a 2.5-hour (150-minute) performance-based test. The passing score is 210 out of 300 points (70%), and results are typically emailed within a few business days rather than shown immediately.

Is the RHCSA exam multiple choice?

No. There are no multiple-choice or written questions. You are given live RHEL systems and a list of real administrative tasks to complete, and you are scored automatically on whether each task produced the correct, persistent end state.

Which RHEL version and tools should I study?

Current RHCSA tracks RHEL 10 (RHEL 8 is also widely used). Focus on systemd (systemctl, journalctl, timers), dnf and modules, LVM and XFS/Stratis storage, firewalld, and SELinux management with semanage, restorecon, and booleans.

Can I use the internet or notes during the exam?

No external internet, notes, or personal materials are allowed. However, the installed system documentation - man pages, man -k searches, /usr/share/doc, and command --help output - is available, so practice finding answers there.

Official exam sources

The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.

Red Hat Certified System Administrator (RHCSA) - EX200link and content verified 8 September 2026Exam code EX200, and Red Hat describes it as "the performance-based Red Hat Certified System Administrator (RHCSA) exam". Our exam facts report it as a hands-on lab rather than a question count, which matches. This also supports the podman link on this guide: Red Hat's own skills list for EX200 covers container management.
Red Hat - Certification Program Guidelink and content verified 8 September 2026How Red Hat reports a performance-based exam: "Results include a pass/fail status and an objective-area breakdown", within five business days - "A pass or fail status. A score breakdown by objective area". No cut score in the guide, and none on the EX200 page either (also read 2026-09-08). Our page printed "210 / 300" as Red Hat's passing score; that figure is widely repeated but is not published by Red Hat, so the fact is now hidden and the note says whose threshold the 700 is. The 2.5-hour length is likewise not on Red Hat's page.

The vendor does not publish this. Red Hat publishes neither a cut score nor an exam length for EX200. The 210-out-of-300 and 2.5-hour figures this guide carried came from elsewhere, so both are UNRESOLVED rather than confirmed: the pass mark has been removed from display, and the duration is retained but unverified. Nothing about the objectives is in question - those are on Red Hat's page and match.

Related Linux resources

Test yourself: 915 RHCSA: Red Hat System Administrator practice questions

Red Hat Certified System Administrator (RHCSA, EX200-style) Study Guide