CertArea
All Red Hat exams

Free EX294 practice test: 30 questions with answers

30 original questions for Red Hat Certified Engineer (RHCE) exam, Red Hat Enterprise Linux, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions

EX294 exam guide: topics, cost and format

All 30 EX294 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Automation with Ansible (15 questions)

  1. Question 1

    An administrator wants to run the same playbook against a group of web servers defined in an inventory file. Which option selects only that group?

    1. ARunning ansible-playbook site.yml with no -i option so Ansible falls back to localhost as the target
    2. BHardcoding the IP addresses of each web server into the playbook's tasks
    3. Cansible-playbook -i inventory.ini site.yml with the hosts key set to the group name
    4. DRunning the playbook locally on the control node with connection: local so no remote hosts are reached
    Show answer and explanation
    Correct answer: C

    The hosts key in the play selects the inventory group, and the -i option points to the inventory file. Running without an inventory or on the control node only does not target the web servers, and hardcoding addresses is fragile.

  2. Question 2

    Which ansible.cfg setting tells Ansible where to find the default inventory file?

    1. Ahosts under the [connection] section
    2. Bvault_password under the [ssh] section
    3. Croles under the [privilege] section
    4. Dinventory under the [defaults] section
    Show answer and explanation
    Correct answer: D

    The inventory setting under [defaults] defines the default inventory path. The other keys belong to different concerns or are not inventory settings.

  3. Question 3

    A playbook must run commands with root privileges on managed hosts. Which play keyword enables privilege escalation?

    1. Abecome: true
    2. Broot: enabled
    3. Cprivileged: yes
    4. Dsudo_only: true
    Show answer and explanation
    Correct answer: A

    become: true enables privilege escalation, which uses sudo by default. The other keywords are not Ansible play directives.

  4. Question 4

    An Ansible task must install the httpd package only on hosts where it is not already present. Which module should be used?

    1. Aansible.builtin.copy to create a package file
    2. Bansible.builtin.dnf with name httpd and state present
    3. Cansible.builtin.shell with yum install httpd every time
    4. Dansible.builtin.debug to print a message
    Show answer and explanation
    Correct answer: B

    The dnf module with state present is idempotent and installs the package only when needed. Shell commands are not idempotent by default, copy places files, and debug prints messages.

  5. Question 5

    Which Ansible construct groups related tasks, handlers, templates, and variables into a reusable structure?

    1. AA role
    2. BA vault password file
    3. CA static host list
    4. DAn ad hoc command
    Show answer and explanation
    Correct answer: A

    Roles package tasks, handlers, files, templates and defaults into reusable units. A host list, ad hoc commands and vault files do not package reusable automation.

  6. Question 6

    A handler should restart a service only when a configuration file changes. How is the handler triggered?

    1. AThe handler is listed under the play's hosts key and fires on each host
    2. BThe handler is triggered by a variable set in the inventory file for that host
    3. CThe handler runs automatically at the start of each play, before tasks
    4. DThe task that changes the file uses notify with the handler name
    Show answer and explanation
    Correct answer: D

    A task that changes the file notifies the handler by name, and the handler runs once at the end if notified. The other options do not trigger handlers correctly.

  7. Question 7

    A template file must render a configuration with values from variables. Which module should be used in the task?

    1. Aansible.builtin.file
    2. Bansible.builtin.template
    3. Cansible.builtin.fetch
    4. Dansible.builtin.wait_for
    Show answer and explanation
    Correct answer: B

    The template module renders Jinja2 templates with variables before copying them. File manages attributes, fetch copies files from hosts to control node, and wait_for waits for conditions.

  8. Question 8

    Sensitive values such as passwords must be stored encrypted in an Ansible project. Which feature should be used?

    1. AA comment inside the playbook with password
    2. BAnsible Vault with an encrypted variables file
    3. CA plaintext variables file in the repo
    4. DAn environment variable logged by each task
    Show answer and explanation
    Correct answer: B

    Ansible Vault encrypts variable files so that secrets can be stored safely in source control. Plain files, comments and printed variables expose secrets.

  9. Question 9

    An administrator needs to run a loop over a list of users to create each account. Which keyword performs the iteration in a task?

    1. Aloop
    2. Bevery
    3. Crepeat_forever
    4. Dbatch_each
    Show answer and explanation
    Correct answer: A

    The loop keyword iterates over a list and runs the task once per item. The other keywords are not Ansible loop constructs.

  10. Question 10

    A task should run only when a variable named install_web is true. Which construct should be added?

    1. Aexecute_only_if: install_web
    2. Bwhen: install_web | bool
    3. Ccondition: install_web == 1
    4. Drun_on_hosts: install_web
    Show answer and explanation
    Correct answer: B

    The when keyword conditions the task on the variable's value, and bool ensures the comparison behaves as expected. The other options are not valid Ansible conditions.

  11. Question 11

    Which command checks the syntax of a playbook without running any tasks?

    1. Aansible-playbook --run-all-tasks -v site.yml
    2. Bansible all -m ping --one-line -i hosts.ini
    3. Cansible-vault view --ask-vault-pass site.yml
    4. Dansible-playbook --syntax-check site.yml
    Show answer and explanation
    Correct answer: D

    The --syntax-check option validates the playbook structure without executing tasks. The other commands run tasks, perform connectivity checks or view vault files.

  12. Question 12

    An administrator wants to test whether all managed hosts are reachable over SSH and can run Python, without changing anything. Which ad hoc command does this?

    1. Aansible all -m ansible.builtin.copy -a src=file
    2. Bansible all -m ansible.builtin.reboot
    3. Cansible all -m ansible.builtin.dnf -a name=httpd
    4. Dansible all -m ansible.builtin.ping
    Show answer and explanation
    Correct answer: D

    The ping module checks connectivity and the ability to run Python on managed hosts without making changes. The other modules modify packages, files or system state.

  13. Question 13

    Which two statements about Ansible handlers are accurate? (Choose two.)

    1. AHandlers run after every task in the play
    2. BHandlers cannot be defined inside roles
    3. CHandlers run before any tasks
    4. DHandlers run only when notified by a task that changed
    5. EHandlers run at the end of the play by default
    Show answer and explanation
    Correct answer: D, E

    Handlers are triggered by notification from changed tasks and run at the end of the play by default. They do not run after every task, roles can define them, and they do not run before tasks.

  14. Question 14

    Which two statements about the copy module are accurate? (Choose two.)

    1. AIt can write content directly from a variable with the content parameter
    2. BIt is required to install packages
    3. CIt runs shell commands on the destination
    4. DIt can copy only directories
    5. EIt can set owner, group, and mode on the destination file
    Show answer and explanation
    Correct answer: A, E

    copy can set ownership and mode and can write variable content. Package installation, shell execution and directory-only copying are not its functions.

  15. Question 15

    A playbook must loop over a dictionary of users and their groups, using both the key and the value. Which Ansible construct handles this?

    1. Acsv output of the dictionary
    2. Ba shell pipe with cut
    3. Cdict2items filter with loop
    4. Da static list typed in each task
    Show answer and explanation
    Correct answer: C

    The dict2items filter converts a dictionary into a list of key and value items that loop can iterate. Shell pipes and static lists do not use Ansible iteration over dictionaries.

Linux System Administration (15 questions)

  1. Question 16

    A system must have a static IP address that persists across reboots on Red Hat Enterprise Linux 9. Which tool should be used?

    1. AEditing the desktop wallpaper and screensaver preferences in Settings
    2. BChanging the hostname in /etc/hosts and leaving the IP address unchanged
    3. CNetworkManager with nmcli to configure the connection profile
    4. DRunning ifconfig eth0 192.168.1.50 netmask 255.255.255.0 until the next reboot
    Show answer and explanation
    Correct answer: C

    NetworkManager and nmcli store connection profiles that persist across reboots. Temporary commands without saving, wallpaper settings and hostname changes do not configure the IP address persistently.

  2. Question 17

    Which command sets the system hostname persistently on Red Hat Enterprise Linux?

    1. Aecho server1.example.com > /tmp/hostnames/current.conf
    2. Bnmcli hostname set server1 --temporary --apply-now
    3. Chostnamectl set-hostname server1.example.com
    4. Dping -c 3 -W 2 -I eth0 -q -n -O server1.example.com
    Show answer and explanation
    Correct answer: C

    hostnamectl writes the persistent hostname. Writing to a temporary file, nmcli syntax and ping options do not set the hostname properly.

  3. Question 18

    A firewall on RHEL must allow inbound HTTP traffic permanently. Which command achieves this?

    1. Afirewall-cmd --permanent --add-service=http followed by firewall-cmd --reload
    2. Bsystemctl stop firewalld and systemctl disable firewalld to remove filtering rules at boot
    3. Ciptables -F INPUT and iptables -P INPUT ACCEPT to flush the chains and reset the counters
    4. Dchmod -R 777 /etc/firewalld/zones and chown nobody /etc/firewalld and then reboot the host
    Show answer and explanation
    Correct answer: A

    Adding the http service with --permanent and then reloading makes the rule persistent and active. Flushing iptables, stopping firewalld and changing permissions do not provide a controlled permanent rule.

  4. Question 19

    SELinux is in enforcing mode, and a web server cannot read content from a custom directory. Which command fixes the file context without disabling SELinux?

    1. Asemanage fcontext -a -t httpd_sys_content_t '/custom(/.*)?' followed by restorecon -Rv /custom
    2. BRemoving the SELinux packages with yum remove, then rebooting the web server host
    3. CSet SELINUX=permissive in /etc/selinux/config and reboot the server to apply it now
    4. Dchmod -R 777 /custom so that the web server can read and write the content, then restart httpd without delay
    Show answer and explanation
    Correct answer: A

    Setting the correct file context and restoring it keeps SELinux enforcing while allowing the web server access. Disabling SELinux, world-writable permissions and removing packages weaken the system.

  5. Question 20

    A web application must listen on a non-standard port 8443 under SELinux enforcing mode. Which command allows the port?

    1. AOpening port 8443 with chmod 0644
    2. Bsemanage port -a -t http_port_t -p tcp 8443
    3. Csetenforce 0 for the httpd service on port 8443
    4. Dchmod 0640 /etc/httpd/conf/httpd.conf so it binds
    Show answer and explanation
    Correct answer: B

    semanage port adds the port to the http port type so SELinux allows binding. Disabling enforcement and chmod do not apply to port labels.

  6. Question 21

    A logical volume must be extended by 2 GB and the file system grown in the same step. Which command does this for an XFS file system?

    1. Alvreduce -L -2G /dev/vg0/lv0
    2. Bfdisk /dev/sda to format the disk
    3. Cmkfs.xfs /dev/vg0/lv0 again
    4. Dlvextend -r -L +2G /dev/vg0/lv0
    Show answer and explanation
    Correct answer: D

    lvextend with -r grows the logical volume and resizes the file system. Reducing the volume shrinks it, formatting destroys data, and fdisk is unrelated to growing the volume.

  7. Question 22

    A user must be created with a home directory, a specific UID, and membership in the wheel group. Which command accomplishes this?

    1. Aadduser --no-create-home --system alice
    2. Bpasswd --set-groups wheel --lock alice
    3. Cuseradd -m -u 2001 -G wheel alice
    4. Dgroupadd -g 2001 --system --force alice
    Show answer and explanation
    Correct answer: C

    useradd with -m creates the home, -u sets the UID and -G adds the supplementary group. The other commands do not create the user with all required attributes.

  8. Question 23

    A cron-like recurring task must run as a service account every day at 02:00 on RHEL using systemd. Which mechanism is preferred?

    1. AA systemd timer unit with OnCalendar set to 02:00 daily
    2. BAdding a comment to root's .bashrc file describing the daily job
    3. CEditing the BIOS clock to match a daily 02:00 job in the firmware
    4. DRunning the backup script once a year by hand from a root shell
    Show answer and explanation
    Correct answer: A

    systemd timers with OnCalendar schedule services reliably and are the modern approach on RHEL. BIOS clocks, yearly manual runs and profile comments do not schedule tasks.

  9. Question 24

    A server needs to keep its time synchronized with an internal NTP server automatically. Which service should be configured?

    1. ADisabling time synchronization and masking chronyd
    2. BUsing a random public time server from the internet on startup
    3. Cchronyd with the internal server listed in its configuration
    4. DSetting the clock by hand with date -s once a month
    Show answer and explanation
    Correct answer: C

    chronyd keeps time synchronized with configured servers, which is the RHEL default time service. Disabling sync, manual monthly changes and random servers do not maintain accurate time.

  10. Question 25

    Which two commands show the current firewall configuration on RHEL? (Choose two.)

    1. Afirewall-cmd --list-all
    2. Bfirewall-cmd --get-active-zones
    3. Chostnamectl status
    4. Dchmod -R 777 /etc
    5. Ecrontab -l as root
    Show answer and explanation
    Correct answer: A, B

    firewall-cmd --list-all and --get-active-zones report active rules and zones. The other commands do not show firewall state.

  11. Question 26

    Which two commands show logical volumes and their sizes? (Choose two.)

    1. Ahostnamectl
    2. Bls /dev/null
    3. Clvs
    4. Dvgs
    5. Ednf list installed
    Show answer and explanation
    Correct answer: C, D

    lvs lists logical volumes and vgs lists volume groups with sizes. The package list, hostname and device listing do not show LVM information.

  12. Question 27

    A new Linux account must be prevented from logging in interactively but must still own files and run a service. Which shell should be assigned?

    1. A/usr/bin/nvim
    2. B/sbin/nologin
    3. C/usr/bin/ksh93
    4. D/usr/bin/fish
    Show answer and explanation
    Correct answer: B

    A nologin shell prevents interactive login while allowing the account to own files and run services. Interactive shells allow logins, and vim is not a shell.

  13. Question 28

    A directory must be shared by members of the developers group, and new files created inside should inherit the group. Which configuration achieves this?

    1. ASetting the group on the directory and enabling the setgid bit
    2. BMaking the directory world-writable with chmod 777 to allow new files
    3. CChanging the owner to root for each file using chown root:root recursively
    4. DUsing a separate private group for each new file created by the user
    Show answer and explanation
    Correct answer: A

    The setgid bit on a directory causes new files to inherit the directory's group. World-writable permissions are unsafe, root ownership of each file does not solve sharing, and per-file groups are impractical.

  14. Question 29

    An administrator needs to grant a user the right to run only one specific administrative command with sudo, without a password. Which configuration does this securely?

    1. AAdding the user to the root group so that the account inherits root-level file access across the system
    2. BEditing /etc/shadow with vipw to remove the password field for the user account entirely
    3. CA sudoers drop-in file under /etc/sudoers.d that permits only that command with NOPASSWD
    4. DGiving the user the root password for shared console and SSH access on each host
    Show answer and explanation
    Correct answer: C

    A drop-in sudoers rule can allow a single command, optionally without a password, and is validated with visudo. Root group membership, shadow edits and sharing the root password grant far more access.

  15. Question 30

    A server must show current memory and swap usage in a human-readable format. Which command provides this?

    1. Auptime -p only
    2. Bfree -h
    3. Cls -lh /proc
    4. Dcat /etc/hosts
    Show answer and explanation
    Correct answer: B

    free -h prints memory and swap usage in human-readable units. The other commands do not report memory usage in this way.