Red Hat Certified Engineer (RHCE) Exam - EX294 — Questions and Answers

Question 1: How do you output or display the value of a variable in Ansible?

print: var_name
log: var_name
debug: var=var_name (Correct answer)
echo var_name

Correct answer: debug: var=var_name

The `debug` module in Ansible is specifically designed to output variables or messages during playbook execution. Using `debug: var=var_name` will display the current value of the specified variable to the console. This is an essential tool for debugging playbooks, verifying variable contents, and tracing execution flow.

Question 2: Which command sets an expiry date of 2026-12-31 for user `jdoe`?

chage -e 2026-12-31 jdoe
passwd --expire 2026-12-31 jdoe
usermod --expiry 2026-12-31 jdoe
chage -E 2026-12-31 jdoe (Correct answer)

Correct answer: chage -E 2026-12-31 jdoe

`chage -E` sets the account expiration date for a user in YYYY-MM-DD format.

Question 3: Which RPM command extracts files from an RPM package without installing it (similar to extracting a tar archive)?

rpm2cpio package.rpm | cpio -idmv (Correct answer)
rpm -e --extract package.rpm
rpm -ivh --extract package.rpm
rpm --unpack package.rpm

Correct answer: rpm2cpio package.rpm | cpio -idmv

'rpm2cpio' converts an RPM to a cpio archive, which 'cpio -idmv' then extracts, allowing file recovery without installation.

Question 4: Which command lists all running containers in Podman?

podman list
podman ps (Correct answer)
podman images
podman containers

Correct answer: podman ps

`podman ps` lists all currently running containers, similar to `docker ps`.

Question 5: Which command resizes an XFS file system to fill its logical volume after expansion?

resize2fs
tune2fs
fsck
xfs_growfs (Correct answer)

Correct answer: xfs_growfs

`xfs_growfs` expands an XFS file system to use all available space in its underlying block device.

Question 6: Which command mounts all file systems listed in `/etc/fstab` that are not currently mounted?

mount --all
systemctl mount
mountall
mount -a (Correct answer)

Correct answer: mount -a

`mount -a` reads `/etc/fstab` and mounts all file systems that have not already been mounted.

Question 7: What field in `/etc/passwd` specifies the user's default shell?

4th field
6th field
5th field
7th field (Correct answer)

Correct answer: 7th field

The seventh (last) field in `/etc/passwd` specifies the user's login shell.

Question 8: Which command analyzes SELinux denials and suggests fixes using audit2why?

sealert | audit2why
seinfo | audit2why
ausearch -m avc | audit2why (Correct answer)
sestatus | audit2why

Correct answer: ausearch -m avc | audit2why

`ausearch -m avc` extracts AVC denial messages which are then piped to `audit2why` for human-readable explanations.

Question 9: What is a key advantage of Podman over Docker in RHEL?

Only supports privileged containers
Supports rootless containers without a background daemon (Correct answer)
Requires a root daemon to manage containers
Cannot run systemd services inside containers

Correct answer: Supports rootless containers without a background daemon

Podman is daemonless and supports rootless containers, improving security by not requiring a privileged background service.

Question 10: Which Podman command maps host port 8080 to container port 80?

podman run -P 8080:80 httpd
podman run -p 8080:80 httpd (Correct answer)
podman run --port 8080:80 httpd
podman run -e 8080:80 httpd

Correct answer: podman run -p 8080:80 httpd

The `-p host_port:container_port` flag maps a host port to the container's internal port.

Question 11: Which file is the Podman/OCI equivalent of a Dockerfile?

Podfile
BuildSpec
PodSpec
Containerfile (Correct answer)

Correct answer: Containerfile

A `Containerfile` is the OCI standard equivalent of a `Dockerfile`, supported natively by Podman and Buildah.

Question 12: What does `2>&1` do in a bash command?

Duplicates the command output
Runs command in background twice
Redirects stderr to stdout (Correct answer)
Redirects stdout to stderr

Correct answer: Redirects stderr to stdout

`2>&1` redirects file descriptor 2 (stderr) to wherever file descriptor 1 (stdout) currently points.

Question 13: Which command loads a compiled SELinux policy module named `mypolicy.pp`?

audit2allow --load mypolicy.pp
semodule --add mypolicy.pp
semodule -i mypolicy.pp (Correct answer)
semanage module -i mypolicy.pp

Correct answer: semodule -i mypolicy.pp

`semodule -i` installs/loads a compiled SELinux policy module (`.pp` file) into the kernel.

Question 14: Which file defines defaults like `PASS_MAX_DAYS` for new user accounts?

/etc/security/limits.conf
/etc/login.defs (Correct answer)
/etc/default/useradd
/etc/pam.d/system-auth

Correct answer: /etc/login.defs

`/etc/login.defs` contains system-wide defaults for user account creation including password aging policies.

Question 15: What command displays the SELinux context of files in the current directory?

ls -Z (Correct answer)
ls -l
getfattr -Z
stat --selinux

Correct answer: ls -Z

`ls -Z` shows the SELinux security context (user:role:type:level) for each file alongside standard attributes.

Question 16: What is the primary container tool used in RHEL 8+ instead of Docker?

rkt
containerd
Podman (Correct answer)
LXC

Correct answer: Podman

Red Hat replaced Docker with Podman in RHEL 8, offering a daemonless, rootless container experience compatible with Docker CLI syntax.

Question 17: Which command adds user `jdoe` to the supplementary group `wheel`?

gpasswd -a wheel jdoe
groupadd wheel jdoe
useradd -G wheel jdoe
usermod -aG wheel jdoe (Correct answer)

Correct answer: usermod -aG wheel jdoe

`usermod -aG wheel jdoe` appends the user to the `wheel` group without removing existing group memberships.

Question 18: What is a Pod in the context of Podman?

A Podman daemon process
A group of containers sharing network and IPC namespaces (Correct answer)
A container image repository
A single privileged container

Correct answer: A group of containers sharing network and IPC namespaces

A Podman Pod is a group of containers that share a network namespace, IPC namespace, and optionally other namespaces, similar to a Kubernetes Pod.

Question 19: Which special cron string runs a job every day at midnight?

All of the above (Correct answer)
@midnight
@daily
0 0 * * *

Correct answer: All of the above

`@midnight`, `@daily`, and `0 0 * * *` are all valid cron expressions that schedule a job to run at midnight every day.

Question 20: What is the default physical extent size when creating an LVM volume group?

8 MB
1 MB
4 MB (Correct answer)
16 MB

Correct answer: 4 MB

The default physical extent size for LVM volume groups is 4 MB unless specified otherwise with `-s`.

Question 21: Which command installs a locally downloaded RPM file '/tmp/mypkg.rpm' while automatically resolving dependencies?

dnf localinstall /tmp/mypkg.rpm
rpm -ivh /tmp/mypkg.rpm
dnf install /tmp/mypkg.rpm
Both B and C are correct (Correct answer)

Correct answer: Both B and C are correct

Both 'dnf install /path/to/file.rpm' and 'dnf localinstall' resolve dependencies; plain 'rpm -i' does not resolve deps automatically.

Question 22: What file system type is recommended by Red Hat for XFS journaling on RHEL 8+?

btrfs
ext4
xfs (Correct answer)
vfat

Correct answer: xfs

XFS is the default and recommended file system for RHEL 8 and later due to its performance and scalability.

Question 23: What does the `#!/usr/bin/env bash` shebang offer over `#!/bin/bash`?

Faster script execution
Enables strict mode automatically
Portability — uses the first `bash` found in PATH (Correct answer)
Only works on RHEL

Correct answer: Portability — uses the first `bash` found in PATH

`#!/usr/bin/env bash` uses `env` to locate `bash` in the PATH, making the script more portable across systems where bash may not be at `/bin/bash`.

Question 24: What keyword is used for looping over a list (which can be a variable) in Ansible?

loop (Correct answer)
repeat
cycle
iterate

Correct answer: loop

The `loop` keyword in Ansible is used to iterate over lists, dictionaries, or sequences of items within a task. It allows the same task to be executed multiple times, once for each item in the specified list or variable. This significantly simplifies and condenses playbooks when performing repetitive operations on multiple similar entities.

Question 25: Which `for` loop syntax in bash iterates over a list of numbers 1 through 5?

for i in (1..5); do
for i in {1..5}; do (Correct answer)
for i = 1 to 5; do
for i in [1-5]; do

Correct answer: for i in {1..5}; do

Bash brace expansion `{1..5}` generates the sequence 1 2 3 4 5, which the `for` loop iterates over.

Question 26: What command builds a container image from a `Containerfile` in the current directory?

podman create -f Containerfile
podman make myimage
podman compile -t myimage .
podman build -t myimage . (Correct answer)

Correct answer: podman build -t myimage .

`podman build -t myimage .` builds an image named `myimage` from the Containerfile in the current directory.

Question 27: What is the correct syntax to add a new repository by providing a URL to a .repo file using DNF?

dnf repo-add <url>
dnf config-manager --add-repo <url> (Correct answer)
dnf addrepo --url <url>
dnf repository --new <url>

Correct answer: dnf config-manager --add-repo <url>

'dnf config-manager --add-repo <url>' downloads and saves the .repo file into /etc/yum.repos.d/.

Question 28: Which systemd command shows the output (logs) of a timer-triggered service?

systemctl status myservice.timer
timer-log myservice
journalctl -u myservice.service (Correct answer)
systemd-cat myservice

Correct answer: journalctl -u myservice.service

`journalctl -u myservice.service` shows the systemd journal logs for the service unit that the timer activates.

Question 29: How do you download an RPM package without installing it using DNF?

dnf install --downloadonly httpd (Correct answer)
dnf pull httpd
dnf fetch httpd
dnf get httpd

Correct answer: dnf install --downloadonly httpd

'dnf install --downloadonly <package>' downloads the RPM and its dependencies to the cache without installing them.

Question 30: What DNF command lists all currently installed packages on the system?

dnf list installed (Correct answer)
dnf query --all
dnf info all
dnf show installed

Correct answer: dnf list installed

'dnf list installed' displays all packages that are currently installed on the system.

Question 31: What command deletes user `jdoe` along with their home directory?

userdel -r jdoe (Correct answer)
useradd -d jdoe
usermod -d jdoe
deluser --remove-home jdoe

Correct answer: userdel -r jdoe

`userdel -r` removes the user account and recursively deletes their home directory and mail spool.

Question 32: What command enables the SELinux boolean for anonymous FTP uploads?

sebool -a allow_ftpd_anon_write on
enable_selinux_ftpd_anon_write
setsebool -P allow_ftp_write_anon on
setsebool -P allow_ftpd_anon_write on (Correct answer)

Correct answer: setsebool -P allow_ftpd_anon_write on

The `setsebool` command is used to modify SELinux boolean values, which control specific security policies. To enable anonymous FTP uploads, the `allow_ftpd_anon_write` boolean needs to be set to `on`. The `-P` flag makes this change persistent across system reboots, ensuring the setting remains active.

Question 33: How do you enable a Podman container to start automatically at system boot (as root)?

Add container to `/etc/rc.local`
Use `podman run --restart always`
podman enable --boot mycontainer
Generate a systemd unit with `podman generate systemd`, copy to `/etc/systemd/system/`, then `systemctl enable` (Correct answer)

Correct answer: Generate a systemd unit with `podman generate systemd`, copy to `/etc/systemd/system/`, then `systemctl enable`

Generate the systemd unit file with `podman generate systemd`, place it in `/etc/systemd/system/`, and enable it with `systemctl enable --now`.

Question 34: What is the purpose of the `/etc/cron.deny` file?

Specifies blocked time ranges for cron jobs
Lists cron jobs that should never run
Lists users who are NOT allowed to use crontab (Correct answer)
Disables the cron service

Correct answer: Lists users who are NOT allowed to use crontab

Users listed in `/etc/cron.deny` are not permitted to create or modify crontab entries with the `crontab` command.

Question 35: What command stops and removes a running container named `webserver` in one step?

podman rm -f webserver (Correct answer)
podman stop webserver && podman rm webserver
podman delete webserver
podman kill --rm webserver

Correct answer: podman rm -f webserver

`podman rm -f` force-stops and removes a running container in a single command.

Question 36: What does the `podman inspect` command return?

Detailed JSON metadata about a container or image (Correct answer)
Network traffic of a running container
Runtime logs of a container
CPU/memory usage of a container

Correct answer: Detailed JSON metadata about a container or image

`podman inspect` outputs detailed JSON metadata including configuration, mounts, network settings, and state of a container or image.

Question 37: What does the `at` command do?

Shows process scheduling priority
Lists currently scheduled jobs
Runs a command at a specific future time once (Correct answer)
Schedules recurring cron jobs

Correct answer: Runs a command at a specific future time once

The `at` command schedules a command or script to run once at a specified future time, unlike cron which runs jobs repeatedly.

Question 38: What does `ausearch -m AVC -ts recent` do?

Lists recently loaded SELinux modules
Shows recent sudo denials
Shows all audit events from today
Displays recent SELinux AVC denial messages (Correct answer)

Correct answer: Displays recent SELinux AVC denial messages

`ausearch -m AVC -ts recent` searches the audit log for recent AVC (SELinux denial) messages from the last 10 minutes.

Question 39: How do you log in to a remote host using smbclient?

smbconnect //remotehost/shared -U user01%pass
smblogin //remotehost/shared -U user01
smbauth //localhost/shared -U user01
smbclient //localhost/shared -U user01%pass (Correct answer)

Correct answer: smbclient //localhost/shared -U user01%pass

The `smbclient` utility is used to access Samba shares from the command line. The correct syntax involves specifying the share path as `//hostname/sharename` and providing the username and password using the `-U user%password` format. This allows for direct authentication and interaction with the shared resource, similar to an FTP client.

Question 40: Which command installs a package named 'httpd' using DNF on RHEL 8/9?

dnf install httpd (Correct answer)
yum add httpd
rpm -i httpd
apt install httpd

Correct answer: dnf install httpd

DNF is the default package manager on RHEL 8/9 and uses 'dnf install <package>' to install packages.

Question 41: What command pulls the `httpd` image from the Red Hat registry?

podman pull registry.access.redhat.com/ubi8/httpd-24 (Correct answer)
podman get httpd
podman fetch httpd:latest
podman download httpd

Correct answer: podman pull registry.access.redhat.com/ubi8/httpd-24

`podman pull` downloads a container image from a specified registry, using the full image path for Red Hat registries.

Question 42: Which command lists all available DNF module streams for the 'php' application stream?

dnf streams list php
dnf module info php
dnf list modules php
dnf module list php (Correct answer)

Correct answer: dnf module list php

'dnf module list <module-name>' displays all available streams for that module along with their status (enabled/disabled/default).

Question 43: Which directory contains DNF/YUM repository configuration files on RHEL?

/etc/yum.conf.d/
/etc/dnf/repos/
/var/lib/dnf/repos/
/etc/yum.repos.d/ (Correct answer)

Correct answer: /etc/yum.repos.d/

Repository .repo files are stored in /etc/yum.repos.d/ and are read by both YUM and DNF.

Question 44: What is the default UID range for regular users in RHEL 8?

1–499
100–65534
1000–60000 (Correct answer)
500–999

Correct answer: 1000–60000

In RHEL 8, regular users are assigned UIDs starting at 1000, as defined in `/etc/login.defs`.

Question 45: Which Ansible module is used for creating and editing filesystems?

filesystem
fs
disk
mount (Correct answer)

Correct answer: mount

In Ansible, the `mount` module is used to manage filesystems, including ensuring they are mounted or unmounted to a desired state. While it doesn't directly create a filesystem (like `mkfs`), it handles the configuration of mount points and ensures the correct state of filesystem mounts. It can also manage entries in `/etc/fstab` for persistent mounts.

Question 46: Which file controls group passwords and membership when managed with `gpasswd`?

/etc/group
/etc/gshadow (Correct answer)
/etc/shadow
/etc/passwd

Correct answer: /etc/gshadow

`/etc/gshadow` stores encrypted group passwords and group administrator information managed by `gpasswd`.

Question 47: What does `${#VAR}` return in a bash script?

Value of VAR
PID of the variable owner
Length of the string in VAR (Correct answer)
Hash of VAR's content

Correct answer: Length of the string in VAR

`${#VAR}` is bash parameter expansion that returns the number of characters in the string value of VAR.

Question 48: Which command locks a user account to prevent login?

usermod -L jdoe
Both A and B (Correct answer)
passwd -l jdoe
chage -l jdoe

Correct answer: Both A and B

Both `usermod -L` and `passwd -l` lock a user account by prepending `!` to the password hash in `/etc/shadow`.

Question 49: Which command displays the disk usage of a mounted file system in human-readable format?

df -h (Correct answer)
du -h
fdisk -l
lsblk -h

Correct answer: df -h

`df -h` reports file system disk space usage in human-readable units like GB and MB.

Question 50: Which Ansible configuration groups are commonly used to define default settings and privilege escalation options?

[global], [escalation]
[defaults], [privilege_escalation] (Correct answer)
[default], [escalation]
[common], [privilege]

Correct answer: [defaults], [privilege_escalation]

In the `ansible.cfg` file, the `[defaults]` section is used to define general configuration options that apply globally to Ansible operations. The `[privilege_escalation]` section (or `[become]` in newer versions) is specifically where settings related to privilege escalation, such as `become_method` and `become_user`, are configured. These sections enable centralized management of Ansible's behavior and security settings.

Question 51: What command lists all cron jobs for the current user?

cron -list
cat /etc/crontab
crontab -l (Correct answer)
crontab -e

Correct answer: crontab -l

`crontab -l` lists (displays) the current user's crontab without editing it.

Question 52: How do you undo the last DNF transaction (e.g., the most recent package installation)?

dnf history undo last (Correct answer)
dnf rollback last
dnf revert last
dnf undo

Correct answer: dnf history undo last

'dnf history undo last' reverses the most recent transaction by uninstalling installed packages or reinstalling removed ones.

Question 53: Which command runs a container from the `ubi8` image interactively with a bash shell?

podman exec -it ubi8 bash
podman create -it ubi8 bash
podman start -it ubi8 bash
podman run -it ubi8 bash (Correct answer)

Correct answer: podman run -it ubi8 bash

`podman run -it` creates and starts a container interactively (`-i`) with a pseudo-terminal (`-t`) and runs bash.

Question 54: How do you temporarily disable the repository with ID 'epel' for a single DNF command?

dnf --exclude-repo=epel install pkg
dnf install pkg --norepo=epel
dnf install pkg --disablerepo=epel (Correct answer)
dnf install pkg --repo=!epel

Correct answer: dnf install pkg --disablerepo=epel

The '--disablerepo=<repoid>' flag disables a specific repository only for the duration of that single command.

Question 55: What does the `z` option do when used with `cp` (e.g., `cp -Z`)?

Sets the context to default policy (Correct answer)
Compresses the file during copy
Skips SELinux context entirely
Preserves SELinux context

Correct answer: Sets the context to default policy

`cp -Z` sets the SELinux context of copied files to the default policy context for the destination.

Question 56: How do you install the SELinux GUI?

yum install -y selinux-policy-gui
yum install -y selinux-gui-tools
yum install -y policycoreutils-gui (Correct answer)
yum install -y selinux-gui

Correct answer: yum install -y policycoreutils-gui

On Red Hat-based systems, the graphical user interface (GUI) tools for managing SELinux are provided by the `policycoreutils-gui` package. Installing this package via `yum` (or `dnf` on newer systems) provides tools like `sealert` and `system-config-selinux` for easier SELinux configuration and troubleshooting, making policy management more accessible.

Question 57: Which command lists all SELinux booleans and their current state?

semanage boolean -l
getsebool -a
Both A and B (Correct answer)
seinfo -b

Correct answer: Both A and B

Both `semanage boolean -l` and `getsebool -a` list all SELinux booleans with their current and default states.

Question 58: Which option in `mkfs.xfs` sets a label for a new XFS file system?

-L (Correct answer)
-l
-n
-b

Correct answer: -L

The `-L` option in `mkfs.xfs` sets a label (name) for the newly created XFS file system.

Question 59: Which command restores default SELinux file contexts recursively on `/var/www/html`?

chcon -R /var/www/html
restorecon -Rv /var/www/html (Correct answer)
fixfiles /var/www/html
semanage fcontext /var/www/html

Correct answer: restorecon -Rv /var/www/html

`restorecon -Rv` restores SELinux contexts to their policy defaults recursively and shows what was changed.

Question 60: How do you enable a DNF module stream named 'nodejs:18' on RHEL 8/9?

dnf enable-module nodejs:18
dnf module enable nodejs:18 (Correct answer)
dnf stream enable nodejs:18
dnf module switch-to nodejs:18

Correct answer: dnf module enable nodejs:18

'dnf module enable <module>:<stream>' enables the specified stream without installing any packages.

Red Hat Certified Engineer (RHCE) Exam - EX294

The RHCE EX294 is a performance-based exam that tests candidates' ability to use Red Hat Ansible Automation Platform to automate Linux system administration tasks across RHEL 9 systems. Candidates must demonstrate proficiency in writing playbooks, managing roles, using Ansible Vault, and deploying containerized workloads with Podman.

Questions

90 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds