EX200 quick review

Memory hook: Quote paths; check status; know where output goes.

Must remember

pwd, ls -la, cd, mkdir, cp, mv and rm manipulate the filesystem. Quote expansions such as "$path" so spaces and wildcard characters are not interpreted unexpectedly. man, info and /usr/share/doc are local references; use man -k to find a topic.

Gzip and bzip2 compress streams; tar bundles files and metadata. A hard link is another name for the same inode on the same filesystem; a symbolic link stores a path and may cross filesystems or become dangling. ln source hard and ln -s target soft differ accordingly.

Scripts need an interpreter line and execute permission when run directly. $1 is the first argument, $? the previous exit status; zero conventionally means success. $(command) captures output. A simple pattern:

#!/bin/bash
if [ -f "$1" ]; then
  for word in ready set go; do
    printf '%s\n' "$word"
  done
else
  printf '%s\n' 'File not found' >&2
  exit 1
fi

Use ssh user@host for a remote shell and su - user for a login-like user environment. Edit with a terminal editor and verify the saved content; an unsaved editor buffer is not configuration.

Choose under exam pressure

Traps

• A pipe does not automatically include stderr.
• A symlink does not keep its target alive after the target is removed.

Practise this topic

Memory hook: Identity, mode bits and labels must all agree.

Must remember

• useradd, usermod, userdel, groupadd and groupmod manage local accounts. id USER verifies identity and supplementary groups; getent passwd USER respects configured identity sources. Use usermod -aG to append group membership; omitting -a can replace existing supplementary groups.
• passwd changes passwords and chage -l USER inspects aging. Locking a password does not necessarily revoke SSH keys or existing sessions. Use sudo for delegated privilege; edit sudoers through visudo to check syntax.
• For a regular file, r/w/x mean read/change/execute. For a directory, they mean list names/change entries/traverse. Deleting a file depends mainly on its parent directory permissions, with sticky-bit rules when present.
• chmod 640 file gives owner rw, group r, others none. chown user:group file changes ownership. Setgid on a shared directory helps new files inherit its group; sticky limits removal of other users' entries. umask removes default permission bits; it does not add execute permission to ordinary newly created files.
• SELinux adds mandatory policy checks beyond Unix permissions. Enforcing blocks prohibited actions; permissive records denials without enforcing them. Inspect getenforce, ls -Z, ps -eZ and audit messages.
• restorecon restores configured labels. semanage fcontext defines persistent path-label rules; chcon alone may be overwritten by relabeling. semanage port maps a nonstandard service port to its allowed type. getsebool inspects booleans; setsebool -P persists a supported policy toggle.

Practical drill: create a shared directory for a group, then explain why a web service still needs the correct SELinux type even when Unix permissions allow reading.

Choose under exam pressure

Traps

• Do not solve a labeling error by disabling SELinux.
• chmod 777 does not bypass SELinux and usually grants excessive access.

Practise this topic

Memory hook: Installed is not running; running is not enabled.

Must remember

RPM is the package format/database; rpm -q checks installed packages and rpm -V verifies recorded file properties. DNF resolves dependencies and repository metadata. dnf repolist, dnf info, dnf install, dnf remove and dnf upgrade serve different jobs. Repository definitions normally live under /etc/yum.repos.d/; understand base URLs, enabled flags and signature checking.

Flatpak applications use remotes, application IDs and runtimes. flatpak remotes, flatpak search, flatpak list, flatpak install and flatpak uninstall manage this separate ecosystem. User installations and system installations differ; the account and scope must match the task.

systemctl start affects the present; enable configures boot activation. enable --now does both. disable does not automatically stop a running service; mask prevents activation via its normal unit path. Use status, is-active, is-enabled and list-units to verify. After editing a unit or drop-in, run daemon-reload before restarting the service.

journalctl -u SERVICE -b narrows logs to one service and boot; journalctl -b -1 reads the previous boot when retained. Persistent journaling requires appropriate journal storage configuration and a persistent journal directory; otherwise reboot may discard useful evidence. Traditional logs under /var/log remain relevant.

Use ps, top, free, vmstat and df to separate CPU, memory and storage pressure. kill -TERM requests graceful termination; SIGKILL cannot be handled for cleanup. A higher nice value means lower scheduling priority. nice starts with an adjustment; renice changes one. Inspect tuned-adm active and available profiles before selecting a workload-specific tuning profile.

Choose under exam pressure

Traps

• Masking is stronger than disabling.
• Installing a package does not prove its daemon is configured or listening.

Practise this topic

Memory hook: Disk to PV to VG to LV to filesystem to mount.

Must remember

Inspect before modifying: lsblk -f, blkid, findmnt, pvs, vgs and lvs reveal the device graph. A partition table such as GPT divides a disk; creating or formatting the wrong device destroys data. Practice only on disposable disks.

LVM layers physical volumes into a volume group, then allocates logical volumes. pvcreate, vgcreate/vgextend and lvcreate operate at those layers. Extending the LV alone does not necessarily grow the filesystem. lvextend -r can resize the supported filesystem as well; understand the underlying operation and available free extents.

XFS can grow while mounted and cannot shrink. ext4 supports growth and can shrink while unmounted with the correct sequence. Never shrink an LV below its filesystem. VFAT suits compatibility but lacks normal Unix ownership/permission semantics; mount options supply effective access behavior.

An ephemeral mount command does not survive reboot. /etc/fstab records source, mountpoint, filesystem type, options, dump and fsck fields. UUIDs or filesystem labels avoid unstable device-name assumptions. Test a change with findmnt --verify and an appropriate mount check before reboot; a bad required mount can interrupt boot.

Swap can use a suitable partition or LV: initialise it with mkswap, activate with swapon, verify with swapon --show, and configure persistence. Do not reinitialise a device containing useful data.

For NFS, match server export, network access and client mount options. autofs uses maps to mount paths on demand and expire idle mounts; verify by accessing the trigger path, not only looking at an idle mount table. Ownership IDs and permissions still matter on shared storage.

Choose under exam pressure

Traps

• XFS does not support shrinking.
• A mounted directory can hide existing files beneath the mountpoint without deleting them.

Practise this topic

Memory hook: Address, route, name, socket, policy.

Must remember

Diagnose in layers. ip -br address shows addresses; ip route/ip -6 route show routes; getent hosts NAME tests configured name resolution; ss -lntup identifies listening sockets. A successful ping does not prove a TCP service works.

NetworkManager connection profiles preserve settings. nmcli connection show lists profiles; nmcli device status shows devices. Know how to set IPv4/IPv6 addresses, prefix, gateway, DNS and automatic activation on the intended profile, then activate and verify it. A temporary ip address add is not a persistent profile. A hostname can be set with hostnamectl; /etc/hosts and DNS resolve names through configured lookup order.

firewalld assigns connections/interfaces to zones. Services bundle ports; explicit port rules name port and protocol. Runtime changes affect now; --permanent changes saved configuration and needs a reload to become runtime state. A reload can discard unsaved runtime rules. Check --get-active-zones, --list-all and both runtime/permanent settings for the correct zone.

SSH key authentication uses a private key on the client and a public key in the server account's authorized keys. Protect ownership and modes of the home directory, .ssh and authorized_keys; SELinux labels also matter. Validate daemon syntax with sshd -t before a controlled reload. Keep a recovery session when changing remote connectivity in a practice VM.

scp and sftp transfer data through SSH. Confirm source/destination syntax and preserve the correct owner and labels afterward. A running service, enabled boot unit, listening address, firewall rule and valid authentication are independent checks.

Choose under exam pressure

Traps

• Opening a firewall port does not make an application listen.
• A rule in the wrong zone may have no effect on the intended interface.

Practise this topic

Memory hook: Make it work now, at boot and after failure.

Must remember

systemd targets group units. get-default inspects the default boot target; set-default changes future boots; isolate transitions the running system and can stop unrelated services. Know multi-user, graphical, rescue and emergency behavior rather than treating every target as a simple runlevel synonym.

The bootloader loads a kernel and initial RAM filesystem before the real root filesystem is mounted. For authorised recovery on a disposable RHEL VM, practise interrupting boot, editing kernel arguments, entering the supported recovery environment, remounting the necessary root filesystem writable and changing the intended configuration. Password recovery may require a chroot and subsequent SELinux relabel. Firmware, bootloader passwords or encrypted storage can change the process: do not memorise one sequence as universal.

Use grubby to inspect or manage supported kernel arguments and keep boot configuration consistent with the system's bootloader layout. A working current boot is not proof that changed boot arguments will work next time.

at schedules a one-time job; inspect pending jobs with atq. cron repeats using minute, hour, day-of-month, month and day-of-week fields. User crontabs and system crontabs differ because system entries include the execution user. Jobs run with a limited environment; use absolute paths and handle output.

systemd timers activate service units using calendar or monotonic timing. systemctl list-timers verifies scheduling. Persistent calendar timers can catch a missed run when configured accordingly. Enable the timer, not merely the one-shot service.

chrony synchronises time; inspect chronyc sources and chronyc tracking. The daemon running is not proof of synchronisation. Correct time supports authentication, certificates and trustworthy logs.

Practical finish: verify changes, reboot the practice VM, then retest mounts, network access, services, SELinux and scheduled work. Persistent results are part of EX200 preparation.

Choose under exam pressure

Traps

• set-default does not immediately isolate the running system.
• An enabled timer with a broken service command still fails its job.

Practise this topic