RHCSA Cheat Sheet 2026

The 30 highest-yield RHCSA facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Which command displays the last 20 lines of a file named 'syslog'? → tail -20 syslog
2. How do you configure a system to use 192.168.1.1 as the DNS server persistently using NetworkManager? → nmcli con mod ipv4.dns 192.168.1.1, then restart connection
3. Which firewall-cmd option makes a rule survive a system reboot? → --permanent
4. A cron job must run every 15 minutes. Which crontab expression is correct? → */15 * * * * /script.sh
5. In Bash, what does the `test -f /etc/passwd` command check? → Whether /etc/passwd exists and is a regular file
6. Which command adds a label 'BACKUP' to an ext4 filesystem on /dev/sdb1? → tune2fs -L BACKUP /dev/sdb1
7. Which /etc/fstab field controls the order of filesystem checks at boot? → Field 6 (pass)
8. Which command shows the current SELinux mode and displays whether it is enforcing, permissive, or disabled? → sestatus
9. Your goal is to access an SMB share. Which of the following commands exemplifies the appropriate syntax? → mount -o username=sambauser1 //server/share /somewhere
10. What command verifies the syntax of the SSH server configuration file without restarting the service? → sshd -t
11. Which file on RHEL must be updated to allow the new SSH port through the SELinux policy? → semanage port -a -t ssh_port_t -p tcp NEWPORT
12. Which command makes firewalld configuration changes survive a system reboot? → firewall-cmd --permanent followed by --reload
13. What is the effect of running `chmod g+s /shared/dir`? → Files in the dir inherit the group of the directory
14. What command is used to make a shell script executable? → chmod +x script.sh
15. How do you run a container in detached (background) mode using Podman? → podman run -d nginx
16. A developer needs traffic from 10.0.0.0/8 to always be treated as 'trusted'. What is the best approach? → firewall-cmd --zone=trusted --add-source=10.0.0.0/8 --permanent
17. A cron job must run as user 'deploy' every weekday at 7:30 AM. Which crontab entry is correct? → 30 7 * * 1-5 deploy /script.sh
18. What does the last field (pass) in an /etc/fstab entry control? → The order in which fsck checks filesystems at boot
19. Which command would you use to restore the default SELinux context on a file? → restorecon /path/file
20. How can a cron job be created for a specific user? → Log in as that user and type crontab -e to open the cron editor
21. Where is the authorized public keys file stored for SSH key-based login on RHEL? → ~/.ssh/authorized_keys
22. Which command resets a forgotten root password in RHEL 8 by interrupting the boot process and appending 'rd.break' to the kernel line? → Editing the GRUB entry at boot
23. In a systemd `.socket` unit, which directive specifies the port or path the socket listens on? → ListenStream=
24. What is the purpose of the `~/.ssh/known_hosts` file? → Stores fingerprints of previously connected SSH servers
25. Which `systemctl` command shows the current default boot target? → systemctl get-default
26. Which command can be used to view a file page by page, allowing both forward and backward navigation? → less
27. Which command extracts a tarball named 'backup.tar.gz' into the current directory? → tar -xzf backup.tar.gz
28. What command generates a systemd unit file for an existing Podman container named 'myapp'? → podman generate systemd myapp
29. Which file must be edited to set system-wide defaults for new user accounts such as home directory skeleton and shell? → /etc/default/useradd
30. Which RPM query shows all configuration files owned by the 'sshd' package? → rpm -qc openssh-server