EX358 sample questions

Question 1

You are configuring a new static network profile for a server named 'prod-db-01' using NetworkManager. The server requires a manual IPv6 address of 2001:db8:1::10/64 and must not attempt to use SLAAC (Stateless Address Autoconfiguration) or DHCPv6. Which nmcli command sequence correctly configures these requirements?

Accepted Answer

nmcli con mod 'prod-db-01' ipv6.addresses '2001:db8:1::10/64' ipv6.method manual

Answer

nmcli con mod 'prod-db-01' ipv6.addr '2001:db8:1::10/64' ipv6.autoconf no

Answer

nmcli con add type ethernet ifname eth0 ipv6.address '2001:db8:1::10/64' ipv6.dhcp-client disabled

Answer

nmcli device ipv6 set '2001:db8:1::10/64' dev eth0 mode static

Question 2

You have modified the configuration file `/etc/NetworkManager/system-connections/ens192.nmconnection` directly using a text editor to change the IP address. However, `ip addr show` still displays the old IP address. What is the most efficient command to apply these changes without disrupting other network connections?

Accepted Answer

nmcli connection reload; nmcli connection up ens192

Answer

systemctl restart NetworkManager

Answer

nmcli device reapply ens192

Answer

ip addr flush dev ens192; systemctl restart network

Question 3

A security audit requires that you permanently block all traffic from the specific subnet 192.168.100.0/24 on your web server, regardless of the service being accessed. The server uses `firewalld`. Which command achieves this using a rich rule?

Accepted Answer

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.100.0/24" drop'

Answer

firewall-cmd --permanent --zone=drop --add-source=192.168.100.0/24

Answer

firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -s 192.168.100.0/24 -j DROP

Answer

firewall-cmd --permanent --block-source=192.168.100.0/24

Question 4

You need to configure the default firewall zone on a server such that it rejects all incoming connections with an ICMP 'host-prohibited' message, unless explicitly allowed. Which target should be set for the zone?

Accepted Answer

%%REJECT%%

Answer

DROP

Answer

REJECT

Answer

default

Question 5

A system administrator has configured a MariaDB server to listen on non-standard port 3307. The service fails to start, and audit logs indicate an SELinux denial. Which command sequence permanently resolves this issue?

Accepted Answer

semanage port -a -t mysqld_port_t -p tcp 3307

Answer

setsebool -P mysql_connect_any 1

Answer

chcon -t mysqld_port_t /etc/my.cnf

Answer

firewall-cmd --add-port=3307/tcp --permanent

Question 6

You are configuring a web server to allow scripts to connect to a remote database. You run `setsebool httpd_can_network_connect 1`. After a system reboot, the application fails to connect. What was the mistake?

Accepted Answer

You did not use the -P flag to make the boolean change persistent.

Answer

You did not restart the httpd service.

Answer

The boolean should have been httpd_use_nfs.

Answer

You need to run restorecon on the document root.

Top vendors

Top exams

Free EX358 sample questions

A security audit requires that you permanently block all traffic from the specific subnet 192.168.100.0/24 on your web server, regardless of the service being accessed. The server uses `firewalld`. Which command achieves this using a rich rule?

You need to configure the default firewall zone on a server such that it rejects all incoming connections with an ICMP 'host-prohibited' message, unless explicitly allowed. Which target should be set for the zone?

A system administrator has configured a MariaDB server to listen on non-standard port 3307. The service fails to start, and audit logs indicate an SELinux denial. Which command sequence permanently resolves this issue?

You are configuring a web server to allow scripts to connect to a remote database. You run `setsebool httpd_can_network_connect 1`. After a system reboot, the application fails to connect. What was the mistake?

6 more free samples are waiting