(RedHAT Certified Engineer-7)RHCE Exam के Question and Answer

In this blog, We will discuss the questions and its Solutions related to the Redhat Certified Engineer-7 (RHCE) (RHEL7 Q & A) Examination. I’m writing this post, as I have already gone through this examination and based on that questions, I thought of writing a post on it. You can practice this on your Virtual machine and can appear for your examination. Few things need to be kept under considerations.

Let’s Start Now:-

“RHCE EXAM”

---

Physical Machine –                                                                                                                                        (Passing – 210/300 , Duration 3.5Hrs)

---

Domain:-  station0
System1:- IP ADDR: 172.25.0.11(server)                                            System2:- IP ADDR: 172.25.0.10(client)(desktop)
Hostname:-  server0.example.com                                                            Hostname:-  desktop0.example.com

---

Configure yum client-side repository using the following        ———–> Free Question

URL=http://content.example.com/rhel7.0/x86_64/dvd/

# cd /etc/yum.repos.d
# vim Technicalhariji.repo

[Technicalhariji]
baseurl=http://content.example.com/rhel7.0/x86_64/dvd/
gpgcheck=0
enabled=1

# yum clean all
# yum repolist

---

Qs. 1      Configure NFS on system1 as follow:-

• Export /public directory with read only acess to
  network0.example.com domain.
• Export /protected directory with read write acess to
  network0.example.com domain.
• Acess to /protected is authenticate by using Kerborse. You can
  use keytab file from http://classroom.example.com/pub/keytabs/
  serverX.keytab.
• Create a secure directory inside the /protected directory.
• User smith have read and write acess on secure directory.

On Server Side

# yum -y install nfs*
# mkdir /public
# mkdir /protected
# semanage fcontext -a -t public_content_t '/public(/.*)?'
# semanage fcontext -a -t public_content_t '/protected(/.*)?'
# restorecon -vvFR /protected
# vim /etc/sysconfig/nfs

RPCNFSDRAGS="-V 4.2"
 
# vim /etc/exports

/public        172.25.0.0/24(ro)
/protected     172.25.0.0/24(rw,sync,sec=krb5p)

# wget -O /etc/krb5.keytab  http://classroom.example.com/pub/keytabs/server0.keytab
# lab nfskrb5 setup ------------For Training
# systemctl restart nfs-server
# systemctl enable nfs-server
# firewall-cmd --permanent --add-service=nfs
# firewall-cmd --permanent --add-service=rpc-bind
# firewall-cmd --permanent --add-sevice=mountd
# firewall-cmd --complete-reload
# mkdir secure
# useradd smith
# chown nfsnobody /protected
# chown smith /protected/secure
# chmod 777 /protected/
# systemctl restart nfs-secure
# systemctl enable nfs-secure
# systemctl restart nfs-secure-server
# systemctl enable nfs-secure-server
# exportfs

=================================================================================

Qs. 2   Configure NFS client on system2 as follow

• /public share should be mount on /mnt/nfs directory with only
  read permission.
• /protected directory should be mount on /mnt/nfssecure with
  krb5p authentication and write permission to client.
• You can use keytab file from
  http://classroom.example.com/pub/keytabs/desktopx.keytab.

On Client Side

# yum -y install nfs*
# mkdir /mnt/nfs
# mkdir /mnt/nfssecure
# wget -O /etc/krb5.keytab http://classroom.example.com/pub/keytabs/desktop0.keytab
# vim /etc/fstab

server0:/public         /mnt/nfs           nfs     defaults                  0   0
server0:/protected      /mnt/nfssecure     nfs     defaults,sec=krb5p,v4.2   0   0

# lab nfskrb5 setup   ----------- For Training
# systemctl restart nfs-secure
# systemctl enable nfs-secure
# mount -a
# df -h

=================================================================================

Qs. 3    Configure smb service on system1 as follows

• Your smb server must be a member of the STAFF workgroup.
• The service must share the /common directory. the share name must be
  common
• The common share must be available to groupx.example.com domain client
  only
• The common must be browseable.
• The user floyd must have read access the share,authenticating with the
  password indionce if necessary.

# yum -y install samba*
# mkdir /common
# semanage fcontext -a -t samba_share_t '/common(/.*)?'
# restorecon -vvFR /common
# vim /etc/samba/smb.conf

Workgroup=STAFF
[common]
path=/common
valid users=floyd
browseable=yes
writeable=yes
hosts allow=172.25.0.0/24

# useradd floyd
# smbpasswd -a floyd
# smbpasswd -e floyd
# setsebool -P samba_enable_dirs on
# setsebool -P samba_export_all_rw on
# systemctl restart smb nmb
# systemctl enable smb nmb
# firewall-cmd --permanent --add-service=samba
# firewall-cmd --complete-reload

On Client Side

# yum -y install nfs*
# smbclient //server0/common -U floyd
smn:>

=================================================================================

Qs. 4  On system1 share the /devops directory via SMB as follows:

• The share should be named devops.
• The devops share must only be available to clients in the groupx.example.com
  domain.
• The devops share must be browseable.
• Kenji must have read access to share,authenticating with password indionce.
• Chihiro must have read and write access to the share, authenticating with the
  password indionce.

On Server Side

# mkdir /devops
# semanage fcontext -a -t samba_share_t '/devops(/.*)?'
# restorecon -vvFR /devops
# vim /etc/samba/smb.conf

[devops]
path=/devops
valid users=kenji chihiro
write list=chihiro
browseable=yes
hosts allow=172.25.0.0/24

# useradd kenji
# useradd chihiro
# smbpasswd -a kenji
# smbpasswd -a chihiro
# smbpasswd -e kenji
# smbpasswd -e chihiro
# setfacl -m u:chihiro:rwx /devops
# setsebool -P samba_enable_home_dirs on
# setsebool -P samba_export_all_rw on
# systemctl restart smb nmb
# systemctl enable smb nmb

=================================================================================

Qs. 5    The smb share is permanently mounted on system2 at /mnt/dev using the
credentials of kenji. the share must allow anyone who can.

On Client Side

# mkdir /mnt/dev
# vim /root/file.txt

username=kenji
password=indionce

# vim /etc/fstab

//server0/devops    /mnt/dev    cifs     defaults,multiuser,sec=ntlmssp,username=kenji,password=indionce     0     0

# systemctl restart smb nmb
# systemctl enable smb nmb
# mount -a
# df -h

=================================================================================

Qs. 6       Configure system1 to provide an iscsi disk device name iqn.2015-
09.com.example:systemX.iscsi.

• The iscsi service uses port 3260
• This target usasge 3G backing logical volume name myvg/mylv
• The target is only available to system2.groupx.example.com only

On Server Side

# yum -y install target*
# systemctl restart target
# systemctl enable target
# firewall-cmd --permanent --add-port=3260/tcp
# firewall-cmd --complete-reload
# fdisk /dev/vdb

n-new
p-primary
Last Sector=+4G
t-type
8e-lvm hex code
w-write or save

# partprobe /dev/vdb
# pvcreate /dev/vdb1
# vgcreate myvol /dev/vdb1
# lvcreate -L 3G -n mylv myvol
# targetcli
# /backstores/block/ ØcreateØ server0.Iscsi /dev/myvol/mylv
# /iscsi ØcreateØ iqn.2015-09.com.example:server0.Iscsi
# /iscsi/iqn.2015-09.com.example:server0.Iscsi/tpg1/aclsØ create
iqn.2015-09.com.example:desktop0.Iscsi
# /iscsi/iqn.2015-09.com.example:server0.Iscsi/tpg1/luns Øcreate
/backstores/block/server0.Iscsi
# /iscsi/iqn.2015-09.com.example:server0.Iscsi/tpg1/portalsØ
createØ 172.25.0.11
# ls
# saveconfig
# exit
# systemctl restart target
# systemctl enable target

=================================================================================

Qs. 7    ISCSI INITIATOR

• Configure system2 so that it connects to the iqn.2015-
  09.com.example:systemX.iscsi as follows
• The iscsi device should automaticaly be available on system boot
• The iscsi block device contains a 2100MB partition that is formated as
  xfs.
• The partition is mounted to /mnt/data and is automatically mounted to
  this directory.

On Client Side

# yum -y install iscsi-initiator-utils
# vim /etc/iscsi/initiatorname.iscsi

Initiatorname=iqn.2015-09.com.example:desktop0.iscsi

# systemctl restart iscsid
# systemctl enable iscsid
# iscsiadm -m discovery -t st -p 172.25.0.11:3260
# iscsiadm -m discovery -t st -p 172.25.0.11:3260 -l
# fdisk /dev/vdb

n-new
p-primary
Last Sector=+2100M
w-save and exit

# partprobe /dev/vdb
# mkfs.xfs /dev/vdb1
# blkid
                  copy the UUID of newly create partition 
# mkdir /mnt/data
# vim /etc/fstab

UUID="ajjbf5sadb5d878ds78dsd9d9s54"    /mnt/data    xfs    _netdev    0     0

# systemctl restart iscsid
# systemctl enable iscsid 
# mount -a
# df -h
# iscsi -m session -u
           (If message of logging out will appear then your work is completed)

=================================================================================

Qs. 8  CONFIGURE IPV6

• configure the eth0 on your exam system with the following ipv6 addresses
• system1 should have the address 200a:ac18::a05/64
• system2 should have the address 200a:ac18::a0a/64

On Server Side

# vim /etc/sysconfig/network-script/ifcfg-eth0

IPV6INIT=yes

# systemctl restart NetworkManager
# nmcli con modify "System eth0" ipv6.addresses 200a:ac18::a05/64
# nmcli con modify "System eth0" ipv6.method static
# nmcli con up "System eth0"
# ifconfig

On Client Side

# vim /etc/sysconfig/network-script/ifcfg-eth0

IPV6INIT=yes

# systemctl restart NetworkManager
# nmlci con modify "System eth0" ipv6.addresses 200a:ac18::a0a/64
# nmcli con modify "System eth0" ipv6.method static
# nmcli con up "System eth0"
# ifconfig
# ping6 200a:ac18::a05

=================================================================================

Qs. 9   configure SSH access as follows:

• Users have remote SSH access to your virtual systems from within
  group10.example.com
• Client within my133t.org should not have access to ssh on your systems.

On Server Side

# yum -y install openssh*
# vim /etc/hosts.deny

sshd : my133t.org
sshd : 172.25.0.10

# systemctl restart sshd
# systemctl enable sshd
# firewall-cmd --permanent --add-service=ssh
# firewall-cmd --complete-reload

On Client Side

# ssh root@my133t.org
# ssh 172.25.0.11  ------This CMD only for use LAB

=================================================================================

Qs. 10   MAIL SERVICE

• configure maild on both system1 and system2
• the system donot accpet incoming email from external resources
  any mail send locally on these system is automatically routed to
  server1.groupx.example.com
• mail sent from these systems show up as coming from groupx.example.com
• you may test your configuration by sending eamil to the localuser a1. the system
  server1.groupx.example.com has been configured drop email for this user into
  http://server1.groupx.example.com/recieved_mail/1/1

On Server Side

# yum -y install postfix*
# systemctl restart postfix
# systemctl enable postfix
# vim /etc/postfix/main.cf

myorigin = server0.example.com
inet_interfaces = all
mydestinatio = localhost , server0.example.com
mynetworks = 127.0.0.0/8 , 172.25.0.0/24
relayhost = [smtp0.example.com]

# systemctl restart postfix
# firewall-cmd --permanent --add-service=smtp
# firewall-cmd --complete-reload

On Client Side

# yum -y install postfix*
# systemctl restart postfix
# systemctl enable postfix
# vim /etc/postfix/main.cf

myorigin = desktop0.example.com
inet_interfaces = all
mydestination = localhost , desktop0.example.com
mynetworks = 127.0.0.0/8 , 172.25.0.0/24
relayhost = [smtp0.example.com]

# systemctl restart postfix
# systemctl enable postfix
# firewall-cmd --permanent --add-service=smtp
# firewall-cmd --complete-reload
# mail root@server0.example.com

=================================================================================

Qs. 11   SELinux

• SELinux must be running in the Enforcing Mode.

On Server Side

# getenforce
# vim /etc/sysconfig/selinux

SELINUX=Enforcing

# setenforce 1
# getenforce

=================================================================================

Qs. 12   USER ENVIRONMENT

• Create a custom command called qstat on both system1 and system2 that runs the
  command: /bin/ps -Ao pid,tt,user,fname,rsz.
• This command should be available to all usres on the system.

On Server Side

# vim /etc/bashrc

alias qstat="ps -Ao pid,tty,user,fname,rsz"

# source /etc/bashrc
# qstat

On Client Side

# vim /etc/bashrc

alias qstat="ps -Ao pid,tty,user,fname,rsz"

# source /etc/bashrc
# qstat

=================================================================================

Qs. 13   LINK AGGRIGATION

• CONFIGURE A LINK AGGRIGATION ON BOTH SYSTEM
• Both Systems has a Network interfaces “eno1” & “eno2”
• These Two interfaces should be slaved for new teaming device called
  “team0” (Make sure “team0” should remain active even if one of the
  interfaces goes down )
• Assign the given IP Address for “team0” on 1st System — 172.25.X.50
• Assign the given IP Address for “team0” on 2nd System — 172.25.X.60

On Server Side

# lab teambridge setup       ------------For Training Only
# nmcli con add type team con-name team0 ifname team0 config '{"runner":{"name":"activebackup"}}'
# nmcli con mod team0 ipv4.addresses 172.25.0.50
# nmcli con mod team0 ipv4.method static
# nmcli con add type team-slave con-name team0_port1 ifname en01 master team0
# nmcli con add type team-slave con-name team0_port2 ifname en02 master team0
# teamdctl team0 state
# nmcli con down team0
# nmcli con up team0
# nmcli con up team0_port1
# nmcli con up team0_port2
# nmcli con show

On Client Side

# lab teambridge setup    ------------For Training Only
# nmcli con add type team con-name team0 ifname team0 config '{"runner":{"name":"activebackup"}}' 
# nmcli con mod team0 ipv4.addresses 172.25.0.60
# nmcli con mod team0 ipv4.method static
# nmcli con add type team-slave con-name team0_port1 ifname en01 master team0
# nmcli con add type team-slave con-name team0_port2 ifname en02 master team0
# teamdctl team0 state
# nmcli con down team0
# nmcli con up team0_port1
# nmcli con up team0_port2

To Check Connection
ping -i team0 172.25.0.50
ping -i team0 172.25.0.60

=================================================================================

Qs. 14   Configure Port Forwarding on your System1.

• The Traffic coming from system2 on port 5423/tcp should be forwarded to port 80/
  tcp on your system1.

On Server Side

# yum -y install http*
# systemctl restart httpd
# systemctl enable httpd
# firewall-cmd --permanent --add-service=http --add-service=https
# firewall-cmd --permanent --add-rich-rule 'rule family=ipv4 source address=172.25.0.10 forward-port port=5423 protocol=tcp to-port=80'
# firewall-cmd --complete-reload
# semanage port -a -t  http_port_t -p tcp 5423
# vim /etc/httpd/conf/httpd.conf

Listen 80
Listen 5423

# systemctl restart httpd

“OR”

• Configure Port Forwarding in your system2
  The traffic coming from system2 on port 443/tcp should be forwarded to port
  22/tcp on your system1

On Client Side

# yum -y install http* openssh*
# systemctl restart httpd
# systemctl restart sshd
# systemctl enable httpd
# systemctl enable sshd
# firewall-cmd --permanent --add-service=ssh
# firewall-cmd --permanent --add-rich-rule 'rule family=ipv4 source address=172.25.0.10 forward-port port=443 protocol=tcp to-port=22'
# firewall-cmd --complete-reload
# ssh -P 443 system0.network0.example.co

=================================================================================

Qs. 15    Mariadb Database

• create a “contacts” database and accept connections only from
  local clients.
• root password should be “postroll”
• For creating complete backup download backup file from
  http://classroom.example.com/pub/mydb.dump.Also create user john for
  accept connection from localhost with all privileges and another user
  steve for accept connection from any host for insert,update,delete and
  select privileges.

On Server Side

# yum -y install groupinstall  mariadb*
# systemctl restart mariadb
# systemctl enable mariadb
# firewall-cmd --permanent --add-service=mysql
# firewall-cmd --complete-reload
# mysql_secure_installation   ------------> set password postroll
-------press Y on every question-------
# mysql -u root -p

> show databases ;
> create database contact ;
> flush privileges ;
> exit

# wget http://classroom.example.com/pub/mydb.dump
# mysql -u root -p contact < /root/mydb.dump

now check by connecting again to mariadb,

# mysql -u root -p 

> use contact ;
> show databases ;
> create user john@'localhost' identified by 'postroll' ;
> create user steve@'localhost' identified by 'postroll' ;
> grant update,insert,delete,select on contact. * to steve@'localhost' ;
> flush privilege ;
> exit

# vim /etc/my.cnf
in section [mysqld], add the below line
skip-networking=1
# systemctl restart mariadb
Now connect with user john and steve for verify privileges.

=================================================================================

Qs. 16   Implement a web server for the site http://serverX.example.com,
Then perform the following steps:

• Download http://classroom.example.com/pub/server.html
• Rename the downloaded file to index.html
• Copy this index.html to the DocumentRoot of your web server
• Do NOT make any modifications to the content of index.html (
  attend all http questions at a time).

On Server Side

# yum -y install http*
# systemctl restart httpd
# systemctl enable httpd
# cd /var/www/html
# wget http://classroom.example.com/pub/server.html    ---- For Exam
# vim server.html   ---------> For Training 

This is my Web page

# mv server.html index.html
# restorecon -vvFR /var/www/html/index.html
# cd /etc/httpd/conf.d
# vim webhost.conf

Listen 5423
<VirtualHost server0.example.com:80>
DocumentRoot "/var/www/html"
ServerName server0.example.com
</VirtualHost>
<Directory "/var/www/html">
order allow,deny
allow from 172.25.0.0/24
</directory>

# systemctl restart httpd
# systemctl enable httpd
# firewall-cmd --permanent --add-service=http
# firewall-cmd --complete-reload
# firefox http://server0.example.com ----------> TO check Server side
# firefox http://server0.example.com  ---------> To check Desktop side

=================================================================================

Qs. 17    Extend your web server to include a virtual host for the site
http://wwwX.example.com
then perform the following steps:

• where X would be replaced by domain number.
• Set the DocumentRoot to /var/www/virtual
• Download http://classroom.example.com/pub/www.html
• Rename the downloaded file to index.html
• Copy this index.html to the DocumentRoot of the virtual host
• Do NOT make any modifications to the content of index.html
• Ensure that harry is able to create content in
  /var/www/virtual.

On Server Side

# mkdir -p /var/www/virtual
# cd /var/www/virtual
# wget http://classroom.example.com/pub/www.html       ------For Exam
# vim www.html     -----------For Training

This is My Webpage

# mv www.html index.html
# restorecon -vvFR /var/www/virtual/index.html
# cd /etc/httpd/conf.d
# vim webhost.conf

<VirtualHost 172.25.0.11:80>
servername www0.example.com
documentroot /var/www/virtual
</virtualhost>
<directory /var/www/virtual>
require all granted
</directory>

# systemctl restart httpd
# firefox http://www0.example.com     ---------> To check server side
# firefox http://www0.example.com     ---------> To check desktop side

=================================================================================

Qs. 18          (a.) Secure web service.

• Configure TLS encryption for the web server “https://serverX.example.com”
• A signed certificate for web server is available at http://classroom.example.com/pub/tls/certs/serverX.crt
• Required key for this certificate file is available at http://classroom.example.com/pub/tls/private/serverX.key
• The certificate for signing authority is provided at http://classroom.example.com/pub/example-ca.crt

On Server Side

# mkdir -p /srv/www0/www
# restorecon -vvFR /srv/www0/www
# cd /srv/www0/www
# vim index.html

This is a from https_TLS

# cd /etc/httpd/conf.d
# vim tls.conf

<VirtualHost_default_:443>
ServerName www.example.com
SSLEngine on
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite High:Medium:!aNULL:!MD5
SSLHonorCipherOrder on
SSLCertificatefile /etc/pki/tls/certs/server0.crt
SSLCertificateKeyFile /etc/pki/tls/private/server0.key
SSLCertificateChainFile /etc/pki/tls/certs/example-ca.crt
DocumentRoot /srv/www0/www
</VirtualHost>
<Directory "/srv/www0/www">
Require all granted
</Directory>

# systemctl restart httpd

“OR”

(b.)         Configure your web server to display the dynamic web contents.

• Dynamic content is provided by a virtual host named as
  http://dynamic.example.com
• This host should listen on port no 8877
• Download a copy of script from
  http://172.25.254.250/pub/webapp.wsgi and place it on appropriate
  location for virtual host so that it generates dynamic web contents.
• Do not make any changes in webapp.wsgi file
• Clients connecting to https://dynamic.example.com:8877 should get
  the output of dynamic web content
• This virtual host must be accessible to all the systems in
  example.com.
• A signed certificate for web server is available at
  http://classroom.example.com/pub/tls/certs/serverX.crt
• Required key for this certificate file is available at
  http://classroom.example.com/pub/tls/private/serverX.key
• The certificate for signing authority is provided at
  http://classroom.example.com/pub/example-ca.crt

On Server Side

# mkdir -p /srv/webapp0/www
# restorecon -vvFR /srv/webapp0/www
# cd /srv/webapp0/www
# wget http://172.25.254.250/pub/webapp.wsgi  ---------->For Exam
# vim webapp.wsgi
# cd /etc/httpd/conf.d
# vim wsgi.conf

<VirtualHost dynamic.example.com:8077>
ServerName dynamic.example.com
SSLEngine on
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite High:Medium:!aNULL:!MD5
SSLHonorCipherOrder on
SSLCertificateFile /etc/pki/tls/certs/server0.crt
SSLCertificateKeyFile /etc/pki/tls/private/server0.key
SSLCertificateChainFile /etc/pki/tls/certs/example-ca.crt
WSGIScriptAlias / /srv/webapp/www/webapp.wsgi
</VirtualHost>

<Directory "/srv/webapp0/www">
Require all granted
</Directory>

# systemctl restart httpd

=================================================================================

Qs. 19    Create a directory named as secret in default DocumentRoot of your
default web server.

• Download a file – http://classroom.example.com/pub/private.html
  to secret directory.
• Rename this file as index.html
• The secret directory should be only available to localhost.

On Server Side

# lab webapp setup    ----------For Training 
# cd /var/www/html
# mkdir secret
# restorecon -vvFR /var/www/html/secret
# cd secret
# wget http://classroom.example.com/pub/private.html  -----> for Exam
# vim private.html   ------------> For Training

This is my Webpage

# mv private.html index.html
# vim /etc/httpd/conf.d/webhost.conf

<directory "/var/www/html/secret">
order deny,allow
deny from all
allow from server0.example.com
</directory>

# systemctl restart httpd

=================================================================================

Qs. 20   Make a following Scripts

Script1

• Create a script myusers.sh for creating users from userlist file.
• file downloaded from http://classroom.example.com/pub/userlist path.
• when userlist as first argument provided it will be created all the users as per users name specify in userlist file and all users should be appear /bin/false login shell. If other argument provided it will
  display “Invalid file name” output.
• if not providing any argument it will display “Invalid Argument”

On Server Side

# vim /myusers.sh

#!/bin/bash
if [ $# == 0 ]; then
echo "Invalid Argument"
exit
elif [ $1 == userlist ]; then
for i in more `/root/userlist`
do
useradd -s /bin/false "$i"
done
else
echo "Invalid Output File"
fi

Script 2

• Create a script /root/script.sh with executable by all such a manner
• with input “print” output should be “python”
• with input “python” output should be “print”
• with input any value output should be “python|print”
• with no input, output should be “Invalid Argument”

# vim /root/script.sh

#!/bin/bash
if [ $# == 0]; then
echo "Invalid argument"
elif [ $1 == python ]; then
echo "print"
elif [ $1 == print ]; then
echo "python"
else
echo "python|print"
fi

=================================================================================

Qs. 21   Use above specified database and fire query for user mobius. Insert
query such that searching all details like username,password,email id
for user “mobius”.

On Server Side

# mysql -u root -p 
> use contact ;
> show tables ;
> select username,password,email id from <table name> where user = 'monius' ;

I hope apko ye Article pasand aya hoga aur helpful bhi hoga agr ye article vakai me helpful hai to aap hume comment kar bta sakte hai aur in Questions me se khi par koi bhi problem hai to app comment jrur kare aur in 21 questions me se 100% RHCE ka Exam Paper ata hai So aap Is post ko Read kar RHCE exam me 300/300 marks laa sakte hai.

Thank You