Red Hat Certified Engineer (RHCE) Exam - EX294 — Questions and Answers

Question 1: What does the `podman inspect` command return?

CPU/memory usage of a container
Runtime logs of a container
Detailed JSON metadata about a container or image (Correct answer)
Network traffic of a running container

Correct answer: Detailed JSON metadata about a container or image

`podman inspect` outputs detailed JSON metadata including configuration, mounts, network settings, and state of a container or image.

Question 2: Which command changes the primary group of user `jdoe` to `developers`?

usermod -G developers jdoe
gpasswd developers jdoe
groupmod -u developers jdoe
usermod -g developers jdoe (Correct answer)

Correct answer: usermod -g developers jdoe

`usermod -g` changes the primary (login) group of the specified user.

Question 3: What services need to run at boot for NFS (Network File System) to function correctly?

httpd and rpcbind
nfs-server and nfslock
sshd and nfslock
rpcbind, nfs, and nfslock (Correct answer)

Correct answer: rpcbind, nfs, and nfslock

For NFS (Network File System) to function correctly, several services must be running and enabled at boot. `rpcbind` handles RPC (Remote Procedure Call) program number-to-port mappings, which is essential for NFS communication. The `nfs` service is the core NFS server, and `nfslock` provides crucial file locking services for data integrity when multiple clients access shared files.

Question 4: Which directory contains DNF/YUM repository configuration files on RHEL?

/etc/yum.conf.d/
/var/lib/dnf/repos/
/etc/yum.repos.d/ (Correct answer)
/etc/dnf/repos/

Correct answer: /etc/yum.repos.d/

Repository .repo files are stored in /etc/yum.repos.d/ and are read by both YUM and DNF.

Question 5: What is `buildah` used for in the RHEL container toolchain?

Running containers as systemd services
Building and modifying OCI container images (Correct answer)
Managing container networks
Orchestrating multi-container pods

Correct answer: Building and modifying OCI container images

`buildah` is a tool for building OCI-compliant container images, used as the build backend for Podman.

Question 6: What does the `$?` variable represent in a bash script?

Current script's PID
Exit code of the last command (Correct answer)
Number of arguments passed
Current user's UID

Correct answer: Exit code of the last command

`$?` holds the exit status of the most recently executed foreground command (0 = success, non-zero = failure).

Question 7: Which command sets an expiry date of 2026-12-31 for user `jdoe`?

chage -e 2026-12-31 jdoe
passwd --expire 2026-12-31 jdoe
chage -E 2026-12-31 jdoe (Correct answer)
usermod --expiry 2026-12-31 jdoe

Correct answer: chage -E 2026-12-31 jdoe

`chage -E` sets the account expiration date for a user in YYYY-MM-DD format.

Question 8: How do you add a Samba user?

adduser -s engineer1
useradd -m -s /sbin/nologin engineer1
smbpasswd -a engineer1 (Correct answer)
samba-adduser engineer1

Correct answer: smbpasswd -a engineer1

To add a user to Samba, you use the `smbpasswd` command with the `-a` (add) option, followed by the username. This command prompts for a new Samba password for the specified user, which is separate from their system password. This allows users to authenticate specifically with Samba shares.

Question 9: Which command scans for available LVM physical volumes on the system?

pvdisplay
pvlist
pvscan (Correct answer)
pvcheck

Correct answer: pvscan

`pvscan` scans all supported LVM block devices in the system for physical volumes.

Question 10: Which command mounts all file systems listed in `/etc/fstab` that are not currently mounted?

mount -a (Correct answer)
systemctl mount
mountall
mount --all

Correct answer: mount -a

`mount -a` reads `/etc/fstab` and mounts all file systems that have not already been mounted.

Question 11: What keyword is used for looping over a list (which can be a variable) in Ansible?

loop (Correct answer)
repeat
iterate
cycle

Correct answer: loop

The `loop` keyword in Ansible is used to iterate over lists, dictionaries, or sequences of items within a task. It allows the same task to be executed multiple times, once for each item in the specified list or variable. This significantly simplifies and condenses playbooks when performing repetitive operations on multiple similar entities.

Question 12: How do you enable a DNF module stream named 'nodejs:18' on RHEL 8/9?

dnf module switch-to nodejs:18
dnf enable-module nodejs:18
dnf module enable nodejs:18 (Correct answer)
dnf stream enable nodejs:18

Correct answer: dnf module enable nodejs:18

'dnf module enable <module>:<stream>' enables the specified stream without installing any packages.

Question 13: Which command installs a package named 'httpd' using DNF on RHEL 8/9?

rpm -i httpd
apt install httpd
yum add httpd
dnf install httpd (Correct answer)

Correct answer: dnf install httpd

DNF is the default package manager on RHEL 8/9 and uses 'dnf install <package>' to install packages.

Question 14: What command deletes user `jdoe` along with their home directory?

usermod -d jdoe
userdel -r jdoe (Correct answer)
deluser --remove-home jdoe
useradd -d jdoe

Correct answer: userdel -r jdoe

`userdel -r` removes the user account and recursively deletes their home directory and mail spool.

Question 15: What is a key advantage of Podman over Docker in RHEL?

Supports rootless containers without a background daemon (Correct answer)
Cannot run systemd services inside containers
Only supports privileged containers
Requires a root daemon to manage containers

Correct answer: Supports rootless containers without a background daemon

Podman is daemonless and supports rootless containers, improving security by not requiring a privileged background service.

Question 16: What is the relevant SELinux boolean associated with the sharing of home directories on Samba?

selinux_share_home
samba_share_home
samba_enable_home_dirs (Correct answer)
enable_samba_home_dirs

Correct answer: samba_enable_home_dirs

SELinux uses booleans to control specific system behaviors and permissions. To allow Samba to share users' home directories, the `samba_enable_home_dirs` boolean must be enabled. This boolean grants Samba the necessary permissions to access and serve content from user home directories, which are typically restricted by default for security reasons.

Question 17: What log file contains SELinux denial messages (AVC denials)?

/var/log/secure
/var/log/selinux.log
/var/log/messages
/var/log/audit/audit.log (Correct answer)

Correct answer: /var/log/audit/audit.log

SELinux AVC (Access Vector Cache) denial messages are written to `/var/log/audit/audit.log` by the auditd daemon.

Question 18: Which command lists pending `at` jobs?

Both A and B (Correct answer)
at -l
at --list
atq

Correct answer: Both A and B

Both `atq` and `at -l` list pending at jobs; `atq` is a traditional shorthand while `at -l` is the long form.

Question 19: Which file is the Podman/OCI equivalent of a Dockerfile?

PodSpec
Podfile
Containerfile (Correct answer)
BuildSpec

Correct answer: Containerfile

A `Containerfile` is the OCI standard equivalent of a `Dockerfile`, supported natively by Podman and Buildah.

Question 20: Which command restores default SELinux file contexts recursively on `/var/www/html`?

fixfiles /var/www/html
semanage fcontext /var/www/html
chcon -R /var/www/html
restorecon -Rv /var/www/html (Correct answer)

Correct answer: restorecon -Rv /var/www/html

`restorecon -Rv` restores SELinux contexts to their policy defaults recursively and shows what was changed.

Question 21: Which command creates a volume group named `vg_data` from physical volume `/dev/sdb`?

vgcreate vg_data /dev/sdb (Correct answer)
lvcreate vg_data /dev/sdb
mkfs.xfs vg_data /dev/sdb
pvcreate vg_data /dev/sdb

Correct answer: vgcreate vg_data /dev/sdb

`vgcreate` creates a new LVM volume group from one or more physical volumes.

Question 22: What does `2>&1` do in a bash command?

Runs command in background twice
Redirects stdout to stderr
Duplicates the command output
Redirects stderr to stdout (Correct answer)

Correct answer: Redirects stderr to stdout

`2>&1` redirects file descriptor 2 (stderr) to wherever file descriptor 1 (stdout) currently points.

Question 23: What does the `z` option do when used with `cp` (e.g., `cp -Z`)?

Preserves SELinux context
Compresses the file during copy
Skips SELinux context entirely
Sets the context to default policy (Correct answer)

Correct answer: Sets the context to default policy

`cp -Z` sets the SELinux context of copied files to the default policy context for the destination.

Question 24: Which registry configuration file defines trusted registries for Podman image pulls?

/etc/podman/registries.conf
/etc/containers/registries.conf (Correct answer)
/usr/share/containers/trusted.conf
/etc/containers/storage.conf

Correct answer: /etc/containers/registries.conf

`/etc/containers/registries.conf` defines trusted registries, unqualified search registries, and blocked registries for container tools.

Question 25: Which Podman command maps host port 8080 to container port 80?

podman run -p 8080:80 httpd (Correct answer)
podman run --port 8080:80 httpd
podman run -P 8080:80 httpd
podman run -e 8080:80 httpd

Correct answer: podman run -p 8080:80 httpd

The `-p host_port:container_port` flag maps a host port to the container's internal port.

Question 26: Which directory contains skeleton files copied to a new user's home directory?

/var/skel
/etc/skel (Correct answer)
/home/template
/etc/default

Correct answer: /etc/skel

Files in `/etc/skel` are automatically copied into the home directory when a new user is created with `useradd -m`.

Question 27: Which command creates a Pod named `mypod` with port 8080 exposed?

podman pod create --name mypod -p 8080:8080 (Correct answer)
podman create pod mypod --port 8080
podman pod new mypod -p 8080
podman pod start mypod -p 8080

Correct answer: podman pod create --name mypod -p 8080:8080

`podman pod create --name mypod -p 8080:8080` creates a new Pod and configures port mapping on the infra container.

Question 28: Which command lists all running containers in Podman?

podman images
podman containers
podman list
podman ps (Correct answer)

Correct answer: podman ps

`podman ps` lists all currently running containers, similar to `docker ps`.

Question 29: Which Ansible module is used for creating and editing filesystems?

filesystem
mount (Correct answer)
disk
fs

Correct answer: mount

In Ansible, the `mount` module is used to manage filesystems, including ensuring they are mounted or unmounted to a desired state. While it doesn't directly create a filesystem (like `mkfs`), it handles the configuration of mount points and ensures the correct state of filesystem mounts. It can also manage entries in `/etc/fstab` for persistent mounts.

Question 30: Which command installs a locally downloaded RPM file '/tmp/mypkg.rpm' while automatically resolving dependencies?

Both B and C are correct (Correct answer)
rpm -ivh /tmp/mypkg.rpm
dnf install /tmp/mypkg.rpm
dnf localinstall /tmp/mypkg.rpm

Correct answer: Both B and C are correct

Both 'dnf install /path/to/file.rpm' and 'dnf localinstall' resolve dependencies; plain 'rpm -i' does not resolve deps automatically.

Question 31: What is the primary container tool used in RHEL 8+ instead of Docker?

containerd
rkt
Podman (Correct answer)
LXC

Correct answer: Podman

Red Hat replaced Docker with Podman in RHEL 8, offering a daemonless, rootless container experience compatible with Docker CLI syntax.

Question 32: What command builds a container image from a `Containerfile` in the current directory?

podman build -t myimage . (Correct answer)
podman make myimage
podman compile -t myimage .
podman create -f Containerfile

Correct answer: podman build -t myimage .

`podman build -t myimage .` builds an image named `myimage` from the Containerfile in the current directory.

Question 33: What command generates an SELinux policy module from audit denials to allow a previously blocked action?

semodule -a mypolicy
audit2allow -M mypolicy (Correct answer)
grep AVC /var/log/audit/audit.log | semodule -i
semanage module mypolicy

Correct answer: audit2allow -M mypolicy

`audit2allow -M mypolicy` reads AVC denials and creates a compiled `.pp` policy module that can be loaded with `semodule -i`.

Question 34: What does the `at` command do?

Lists currently scheduled jobs
Runs a command at a specific future time once (Correct answer)
Shows process scheduling priority
Schedules recurring cron jobs

Correct answer: Runs a command at a specific future time once

The `at` command schedules a command or script to run once at a specified future time, unlike cron which runs jobs repeatedly.

Question 35: Which special cron string runs a job every day at midnight?

@midnight
@daily
0 0 * * *
All of the above (Correct answer)

Correct answer: All of the above

`@midnight`, `@daily`, and `0 0 * * *` are all valid cron expressions that schedule a job to run at midnight every day.

Question 36: How do you mount an NFS share from the command line?

mount -t nfs /nfs_share server.example.com:/mnt
mount nfs server.example.com:/nfs_share /mnt
mount -nfs server.example.com:/mnt /nfs_share
mount -t nfs server.example.com:/nfs_share /mnt (Correct answer)

Correct answer: mount -t nfs server.example.com:/nfs_share /mnt

To manually mount an NFS share from the command line, the `mount` command is used with the `-t nfs` option to specify the filesystem type. The syntax requires the remote server and export path (`server.example.com:/nfs_share`) followed by the local mount point (`/mnt`). This command temporarily mounts the NFS share for immediate access.

Question 37: How do you save the output from an Ansible module to a variable?

var_name = ansible_module module_name
save: var_name = module_name
register: var_name (Correct answer)
ansible save var_name module_name

Correct answer: register: var_name

In Ansible, the `register` keyword is used to capture the output of a task and store it in a variable. This allows subsequent tasks in the playbook to access and utilize the information returned by the preceding module. For example, the output of a shell command or a module's state can be registered and then used for conditional logic or further processing.

Question 38: (SHELL) How do you tell if a file is of a certain type?

file /var/cache/man/whatis
type /var/cache/man/whatis
test -f /var/cache/man/whatis (Correct answer)
ls -t /var/cache/man/whatis

Correct answer: test -f /var/cache/man/whatis

The `test` command (or its shorthand `[ ]`) is a fundamental shell command used to check file types and other conditions. The `-f` option specifically tests if a given path refers to a regular file that exists. This is commonly used in shell scripts for conditional logic, allowing scripts to behave differently based on file properties.

Question 39: Which command lists all SELinux booleans and their current state?

getsebool -a
Both A and B (Correct answer)
semanage boolean -l
seinfo -b

Correct answer: Both A and B

Both `semanage boolean -l` and `getsebool -a` list all SELinux booleans with their current and default states.

Question 40: How do you mount an NFS share using fstab?

fstab mount nfsserver:/exports /mount-point nfs
nfs mount nfsserver:/exports /mount-point
nfsserver:/exports /mount-point nfs defaults 0 0 (Correct answer)
mount -t nfs nfsserver:/exports /mount-point

Correct answer: nfsserver:/exports /mount-point nfs defaults 0 0

To automatically mount an NFS share at boot, an entry must be added to the `/etc/fstab` file. The correct format specifies the remote NFS share (`nfsserver:/exports`), the local mount point (`/mount-point`), the filesystem type (`nfs`), mount options (`defaults`), and dump/pass values (`0 0`). This ensures the share is available every time the system starts.

Question 41: What command lists all cron jobs for the current user?

cron -list
cat /etc/crontab
crontab -e
crontab -l (Correct answer)

Correct answer: crontab -l

`crontab -l` lists (displays) the current user's crontab without editing it.

Question 42: What is the purpose of `skopeo` in a RHEL container workflow?

Manages container networks
Scans containers for vulnerabilities
Builds container images from source
Inspects and copies container images between registries without running them (Correct answer)

Correct answer: Inspects and copies container images between registries without running them

`skopeo` is a tool for inspecting, copying, and deleting container images in various registries without needing to pull them locally.

Question 43: What does the `#!/usr/bin/env bash` shebang offer over `#!/bin/bash`?

Faster script execution
Portability — uses the first `bash` found in PATH (Correct answer)
Enables strict mode automatically
Only works on RHEL

Correct answer: Portability — uses the first `bash` found in PATH

`#!/usr/bin/env bash` uses `env` to locate `bash` in the PATH, making the script more portable across systems where bash may not be at `/bin/bash`.

Question 44: What command creates a group named `devops` with GID 1050?

groupadd -g 1050 devops (Correct answer)
groupmod -g 1050 devops
useradd -g 1050 devops
newgroup -g 1050 devops

Correct answer: groupadd -g 1050 devops

`groupadd -g 1050 devops` creates a new group named `devops` with the specified GID.

Question 45: What command pulls the `httpd` image from the Red Hat registry?

podman get httpd
podman fetch httpd:latest
podman pull registry.access.redhat.com/ubi8/httpd-24 (Correct answer)
podman download httpd

Correct answer: podman pull registry.access.redhat.com/ubi8/httpd-24

`podman pull` downloads a container image from a specified registry, using the full image path for Red Hat registries.

Question 46: Which Ansible configuration groups are commonly used to define default settings and privilege escalation options?

[default], [escalation]
[defaults], [privilege_escalation] (Correct answer)
[common], [privilege]
[global], [escalation]

Correct answer: [defaults], [privilege_escalation]

In the `ansible.cfg` file, the `[defaults]` section is used to define general configuration options that apply globally to Ansible operations. The `[privilege_escalation]` section (or `[become]` in newer versions) is specifically where settings related to privilege escalation, such as `become_method` and `become_user`, are configured. These sections enable centralized management of Ansible's behavior and security settings.

Question 47: What does `ausearch -m AVC -ts recent` do?

Lists recently loaded SELinux modules
Displays recent SELinux AVC denial messages (Correct answer)
Shows recent sudo denials
Shows all audit events from today

Correct answer: Displays recent SELinux AVC denial messages

`ausearch -m AVC -ts recent` searches the audit log for recent AVC (SELinux denial) messages from the last 10 minutes.

Question 48: What command creates a new user named `jdoe` with a home directory?

adduser jdoe
useradd -m jdoe (Correct answer)
usermod -m jdoe
newuser jdoe

Correct answer: useradd -m jdoe

`useradd -m jdoe` creates the user and the `-m` flag ensures the home directory is created.

Question 49: Which command adds user `jdoe` to the supplementary group `wheel`?

gpasswd -a wheel jdoe
useradd -G wheel jdoe
groupadd wheel jdoe
usermod -aG wheel jdoe (Correct answer)

Correct answer: usermod -aG wheel jdoe

`usermod -aG wheel jdoe` appends the user to the `wheel` group without removing existing group memberships.

Question 50: What command enables the SELinux boolean `httpd_can_network_connect` persistently?

setsebool -P httpd_can_network_connect on (Correct answer)
setsebool httpd_can_network_connect on
semanage boolean httpd_can_network_connect 1
togglesebool -P httpd_can_network_connect

Correct answer: setsebool -P httpd_can_network_connect on

`setsebool -P` sets the SELinux boolean persistently, surviving reboots by writing to the policy.

Question 51: Which RPM option is used to query which package owns a specific file?

rpm -qi /path/to/file
rpm -qf /path/to/file (Correct answer)
rpm -qc /path/to/file
rpm -ql /path/to/file

Correct answer: rpm -qf /path/to/file

'rpm -qf' (query file) shows which installed package owns the specified file path.

Question 52: What is the purpose of the `/etc/cron.deny` file?

Specifies blocked time ranges for cron jobs
Lists cron jobs that should never run
Disables the cron service
Lists users who are NOT allowed to use crontab (Correct answer)

Correct answer: Lists users who are NOT allowed to use crontab

Users listed in `/etc/cron.deny` are not permitted to create or modify crontab entries with the `crontab` command.

Question 53: Which LVM command extends an existing logical volume by 2GB?

pvextend -L +2G /dev/vg0/lv0
lvextend -L +2G /dev/vg0/lv0 (Correct answer)
lvresize -L +2G /dev/vg0/lv0
vgextend -L +2G /dev/vg0/lv0

Correct answer: lvextend -L +2G /dev/vg0/lv0

`lvextend -L +2G` increases the size of a logical volume by the specified amount.

Question 54: What is the SELinux context label for the standard SSH port (22) in the SELinux policy?

ssh_port_t (Correct answer)
sshd_port_t
net_port_t
http_port_t

Correct answer: ssh_port_t

Port 22 is labeled `ssh_port_t` in the SELinux policy, allowing the `sshd` process to bind to it.

Question 55: What does the `blkid` command display?

Disk partition sizes
Block device I/O statistics
UUID and type of block devices (Correct answer)
LVM logical volume details

Correct answer: UUID and type of block devices

`blkid` locates and prints block device attributes including UUID, label, and file system type.

Question 56: What is the purpose of the `/etc/fstab` file?

Configures LVM volume groups
Stores disk partition tables
Defines file systems to mount at boot (Correct answer)
Lists installed packages

Correct answer: Defines file systems to mount at boot

The `/etc/fstab` file contains static information about file systems and is read at boot to mount them automatically.

Question 57: What is the default UID range for regular users in RHEL 8?

100–65534
500–999
1000–60000 (Correct answer)
1–499

Correct answer: 1000–60000

In RHEL 8, regular users are assigned UIDs starting at 1000, as defined in `/etc/login.defs`.

Question 58: Which configurations in ansible.cfg are used for privilege escalation?

become, become_method, become_user, become_ask_pass (Correct answer)
escalation, method_privilege, user_privilege, ask_for_privilege
become, method_become, user_become, ask_become_pass
privilege, escalate_method, escalate_user, ask_for_become

Correct answer: become, become_method, become_user, become_ask_pass

In Ansible, privilege escalation, often referred to as 'become,' is configured using specific parameters in `ansible.cfg`. These include `become` to enable escalation, `become_method` for the method (e.g., sudo), `become_user` for the target user, and `become_ask_pass` to prompt for a password. These settings collectively define how Ansible gains elevated permissions on managed hosts.

Question 59: What is the purpose of `systemd.timer` units in RHEL?

Schedule tasks as a modern cron replacement using systemd (Correct answer)
Set system clock time zones
Manage service startup delays
Track service uptime

Correct answer: Schedule tasks as a modern cron replacement using systemd

Systemd timer units provide a modern alternative to cron for scheduling tasks, with better integration into systemd logging and dependency management.

Question 60: What field in `/etc/passwd` specifies the user's default shell?

4th field
5th field
6th field
7th field (Correct answer)

Correct answer: 7th field

The seventh (last) field in `/etc/passwd` specifies the user's login shell.

Red Hat Certified Engineer (RHCE) Exam - EX294

The RHCE EX294 is a performance-based exam that tests candidates' ability to use Red Hat Ansible Automation Platform to automate Linux system administration tasks across RHEL 9 systems. Candidates must demonstrate proficiency in writing playbooks, managing roles, using Ansible Vault, and deploying containerized workloads with Podman.

Questions

90 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

redhat.com — Test delivery, renewal, score validity, exam format, score release · verified Oct 2026