EX358 Sample Questions & Answers
Weighted toward Apache, Nginx and web caching configuration, the single biggest weight, plus MariaDB database administration, file sharing across SMB, NFS and iSCSI, DNS and DHCP servers, network clients and firewalls, SELinux, link aggregation, email and printers.
Launch the full EX358 simulator →Showing 6 of 12 free samples.
- Question 1Intermediate
Manage Firewall Services · Configure System Firewalls
You need to configure the default firewall zone on a server such that it rejects all incoming connections with an ICMP 'host-prohibited' message, unless explicitly allowed. Which target should be set for the zone?
Show answer & explanation
Correct answer: C
In firewalld, the special target
%%REJECT%%(often displayed as just REJECT in output but configured internally) ensures that blocked packets receive an ICMP host-prohibited response. TheDROPtarget silently discards packets. - Question 2Advanced
Manage SELinux · SELinux Booleans and Contexts
A system administrator has configured a MariaDB server to listen on non-standard port 3307. The service fails to start, and audit logs indicate an SELinux denial. Which command sequence permanently resolves this issue?
Show answer & explanation
Correct answer: A
SELinux enforces port binding restrictions. By default,
mysqld_tcan only bind to ports labeledmysqld_port_t. To allow binding to 3307, you must add that port to themysqld_port_tcontext usingsemanage port.flowchart TD Start[Service Start] --> Bind{Bind Port 3307?} Bind -->|Check SELinux| Context{Port Context?} Context -->|Unlabeled| Deny[AVC Denial] Context -->|mysqld_port_t| Allow[Service Starts] Deny --> Fix[semanage port -a -t mysqld_port_t -p tcp 3307] Fix --> Allow - Question 3Beginner
Manage SELinux · SELinux Booleans and Contexts
You are configuring a web server to allow scripts to connect to a remote database. You run
setsebool httpd_can_network_connect 1. After a system reboot, the application fails to connect. What was the mistake?Show answer & explanation
Correct answer: D
The
setseboolcommand modifies the runtime state of SELinux booleans. Without the-P(permanent) flag, changes are lost upon reboot. - Question 4Beginner
Manage System Processes · Systemd Service Management
You need to completely prevent the
bluetoothservice from starting, ensuring it cannot be started manually or by other services that depend on it. Which systemctl command is appropriate?Show answer & explanation
Correct answer: B
systemctl masklinks the service unit file to/dev/null, effectively preventing it from being started under any circumstances.disableonly prevents auto-start at boot. - Question 5Advanced
Manage System Processes · Systemd Service Management
You are creating a custom systemd service unit
myapp.service. This service must strictly start aftermariadb.serviceis fully active. If MariaDB fails to start,myappshould not attempt to start. Which directives should be present in the[Unit]section ofmyapp.service?Show answer & explanation
Correct answer: D
Requires=ensures a strong dependency (if MariaDB fails, MyApp fails).After=ensures the ordering (MariaDB starts before MyApp). Both are needed becauseRequiresalone allows parallel starting. - Question 6Intermediate
Manage Link Aggregation · Network Bond Interfaces
You need to configure a network bond
bond0using two interfaces,eth1andeth2. The requirement is to provide fault tolerance only (no load balancing), but the switch does not support LACP or any special link aggregation configuration. Which bonding mode must you select?Show answer & explanation
Correct answer: B
Active-Backup (mode 1) provides redundancy by keeping one interface active and the others in standby. It does not require special switch support.
Ready for the real thing?
The full EX358 simulator has every exam-style question, timed mode, and instant scoring.