RHCSA Exam Command Cheat Sheet: 100 Essential Commands by Objective

Objective

The RHCSA (EX200) is a hands-on, performance-based exam. You are given real systems and a list of tasks, and you have no time to read long manual pages for basic options. Speed, accurate syntax, and confidence come from having the common commands ready in memory.

This cheat sheet organizes 100 essential commands by exam objective area, with short notes on the mistakes that cost the most points. Use it to check your recall, to spot gaps, and as a map of what to practice.

How to Use This Cheat Sheet

• Treat it as a recall check, not a substitute for practice. Knowing a command exists is not the same as having typed it on a real system.
  • Cover the command, read the task, and see whether you can write it from memory
• Names in the examples are placeholders. Hosts like server1, users like student, and devices like /dev/sdb will differ on your system. Confirm devices with lsblk before running anything destructive.
• Always verify persistence. The exam checks that your work survives a reboot, so test with mount -a, systemctl is-enabled, and a real reboot where you can.
• Commands assume a recent RHEL release (9 or 10). Where RHEL 10 changes the preferred approach, this guide says so.

Where the Points Are

Objective Area	Commands	Typical Exam Risk
Essential tools	1 to 15	Quoting, redirection order, link types
Operating systems	16 to 30	Forgetting enable, wrong boot target, time settings
Scheduling and processes	31 to 40	Cron field order, atd not running
Storage and file systems	41 to 60	Not persisting in /etc/fstab, wrong resize tool
Users, groups, permissions	61 to 75	usermod -G instead of -aG, ACL details
SELinux and security	76 to 85	Missing restorecon, missing -P
Networking and firewalls	86 to 95	Not running con up or --reload
Containers and software	96 to 100	Missing :Z, no lingering, deprecated unit generation

Objective 1: Understand and Use Essential Tools (Commands 1 to 15)

These are the commands you will use constantly, in every task, whatever the objective. Fluency here saves minutes everywhere else.

# 1. Access a remote system over SSH
ssh user@server1.example.com

# 2. Copy your SSH public key for passwordless login
ssh-copy-id -i ~/.ssh/id_rsa.pub user@server1.example.com

# 3. Securely copy a file to another system
scp /etc/hosts user@server1:/tmp/

# 4. Synchronize directories remotely, preserving permissions
rsync -avz /var/www/html/ user@server1:/var/www/html/

# 5. Create a gzip-compressed tar archive
tar -czvf /root/archive.tar.gz /etc

# 6. Extract an archive into a specific directory
tar -xzvf /root/archive.tar.gz -C /tmp/restore/

# 7. Find files by name and run an action on each match
find /var/log -name "*.log" -exec cp {} /backup/ \;

# 8. Find files by owner and size
find /home -user student -size +10M

# 9. Find files with the SUID permission set
find / -perm -4000 2>/dev/null

# 10. Filter configuration lines with an extended pattern
grep -E "^(Listen|Port)" /etc/httpd/conf/httpd.conf

# 11. Show a configuration file without blank lines or comments
grep -v -E "^(#|$)" /etc/ssh/sshd_config

# 12. Create a hard link
ln /source/file.txt /target/hardlink.txt

# 13. Create a symbolic (soft) link
ln -s /source/file.txt /target/symlink.txt

# 14. Redirect both standard output and standard error
command > output.log 2>&1

# 15. Search manual pages by keyword
man -k "firewall"

Exam notes:

• Key setup order:
  • ssh-copy-id copies a key that must already exist. Run ssh-keygen first, and use the public key file you actually generated, since newer OpenSSH versions default to ed25519 rather than RSA.
• Redirection order matters:
  • > output.log 2>&1 works. Reversing the two parts sends standard error to the terminal instead of the file.
• If man -k returns nothing, the manual page index may need building with mandb.
• Hard links cannot cross file systems and cannot point to directories. Symbolic links can do both.

Objective 2: Manage Operating Systems (Commands 16 to 30)

Services, boot targets, logs, and time. Almost every exam task ends with a service that must be running now and after a reboot.

# 16. Start a service immediately
systemctl start httpd.service

# 17. Enable a service to start at boot
systemctl enable httpd.service

# 18. Enable and start a service in one command
systemctl enable --now chronyd.service

# 19. Check the status of a service
systemctl status sshd.service

# 20. Mask a service so nothing can start it
systemctl mask firewalld.service

# 21. Unmask a service
systemctl unmask firewalld.service

# 22. Show the current default boot target
systemctl get-default

# 23. Set the default boot target to text mode
systemctl set-default multi-user.target

# 24. Reboot or power off the system
systemctl reboot
systemctl poweroff

# 25. List units that failed
systemctl --failed

# 26. View journal entries for one unit
journalctl -u sshd.service --no-pager

# 27. View error-level journal entries from the current boot
journalctl -b -p err

# 28. Enable NTP time synchronization
timedatectl set-ntp true

# 29. Set the system timezone
timedatectl set-timezone Asia/Kolkata

# 30. List NTP sources and their status
chronyc sources -v

Exam notes:

• Start versus enable:
  • start runs the service now. enable makes it start at boot. Most exam tasks need both, which is exactly what enable --now does.
• Default target versus current target:
  • set-default changes the next boot. systemctl isolate changes the running system only.
• After configuring time, confirm with timedatectl (look for the synchronized line) and chronyc tracking (shows the current offset).

Objective 3: Schedule Tasks and Manage Processes (Commands 31 to 40)

Cron, at, and process control. These are quick wins if the syntax is automatic.

# 31. Edit a user crontab
crontab -e -u student

# 32. List a user's cron jobs
crontab -l -u student

# 33. List all systemd timers
systemctl list-timers --all

# 34. Schedule a one-off task with at
echo "tar -czvf /tmp/bk.tar.gz /etc" | at 23:00

# 35. List the top memory-consuming processes
ps aux --sort=-%mem | head -10

# 36. Show the process tree with PIDs
pstree -p

# 37. Terminate a process by name (graceful)
pkill -15 httpd

# 38. Force-kill a process by PID
kill -9 1420

# 39. Start a process with a changed niceness
nice -n 10 /usr/local/bin/backup.sh

# 40. Change the priority of a running process
renice -n 5 -p 1845

Exam notes:

• Cron time fields, in order:
  • minute, hour, day of month, month, day of week, then the command. Example: 30 2 * * 1-5 /usr/local/bin/backup.sh runs at 02:30 on weekdays.
• at only works if the atd service is running. Check with systemctl status atd.
• Try kill -15 (the default) before kill -9. Signal 9 gives the process no chance to clean up.
• Niceness runs from -20 (highest priority) to 19 (lowest). Only root can lower a process's niceness value.

Objective 4: Configure Local Storage and File Systems (Commands 41 to 60)

This is the largest block and the one where small mistakes cost the most. Partitioning, file systems, LVM, swap, and Stratis all live here.

# 41. Show block devices, file systems, and UUIDs
lsblk -f

# 42. Partition a disk with parted
parted /dev/sdb mklabel gpt mkpart primary xfs 1MiB 2048MiB

# 43. Create an XFS file system
mkfs.xfs /dev/sdb1

# 44. Create an Ext4 file system
mkfs.ext4 /dev/sdb2

# 45. Mount a file system manually
mount /dev/sdb1 /mnt/data

# 46. Unmount a file system cleanly
umount /mnt/data

# 47. Validate /etc/fstab without rebooting
mount -a

# 48. Initialize a physical volume for LVM
pvcreate /dev/sdb1

# 49. Show a physical volume summary
pvs

# 50. Create a volume group with a 16 MB extent size
vgcreate -s 16M vg_storage /dev/sdb1

# 51. Extend a volume group with another physical volume
vgextend vg_storage /dev/sdc1

# 52. Create a logical volume by size
lvcreate -n lv_web -L 5G vg_storage

# 53. Create a logical volume by physical extents
lvcreate -n lv_database -l 128 vg_storage

# 54. Extend a logical volume and resize its file system together
lvextend -r -L +2G /dev/vg_storage/lv_web

# 55. Grow an XFS file system on its own
xfs_growfs /var/www

# 56. Resize an Ext4 file system after extending the LV
resize2fs /dev/vg_storage/lv_data

# 57. Create swap space on a partition
mkswap /dev/sdb3

# 58. Activate all swap spaces listed in /etc/fstab
swapon -a

# 59. Show active swap
swapon --show

# 60. Create a Stratis pool
stratis pool create mypool /dev/sdd

Exam notes:

• Persistence is the point:
  • A manual mount disappears at reboot. Add the mount to /etc/fstab using the UUID from blkid or lsblk -f, then prove it with mount -a.
• Swap needs two steps:
  • mkswap prepares the space, but it only survives a reboot if there is a matching line in /etc/fstab. swapon -a then activates it.
• Resizing rules:
  • XFS can grow but cannot shrink. Use xfs_growfs with the mount point.
  • Ext4 resizing uses resize2fs with the device path.
  • With lvextend -r you do not need either command separately.
• After partitioning, if the new device node is missing, run partprobe or udevadm settle before formatting.
• Stratis needs its service running (systemctl enable --now stratisd) and the stratis-cli package installed.

Practice These Topics on Real RHEL Systems

A cheat sheet tells you which command to use. A lab makes you use it, get it wrong, and fix it, which is what the exam actually rewards. LinuxCert.Guru has hands-on labs for several of the topics in this guide, each with auto-graded tasks on real RHEL hosts.

Topic	Related Commands	Hands-On Lab
Boot targets	22, 23	Manage System Boot Targets
Time synchronization	28 to 30	Time Synchronization with Chrony
NFS and AutoFS mounts	45, 47	AutoFS and NFS Client Mounts
Bootloader and kernel parameters	Not in the 100	GRUB2 Bootloader
Containers as services	96 to 100	Manage Containers with Quadlets
Root password recovery	Not in the 100	RHEL Password Reset

Browse all RHCSA labs at LinuxCert.Guru → https://linuxcert.guru

Objective 5: Manage Users, Groups, and Permissions (Commands 61 to 75)

User accounts, ownership, special permission bits, ACLs, and sudo. Expect several tasks that combine these.

# 61. Create a user with a UID, comment, and secondary groups
useradd -u 2050 -c "Web Admin" -G wheel,sysadmin operator1

# 62. Add a secondary group without overwriting existing ones
usermod -aG developers developer1

# 63. Set a password non-interactively
echo "RedHat2026!" | passwd --stdin developer1

# 64. Set password aging and warning periods
chage -M 90 -W 7 developer1

# 65. Create a group with a specific GID
groupadd -g 3000 sysdevs

# 66. Change owner and group recursively
chown -R root:sysdevs /shared/projects

# 67. Set numeric permissions
chmod 755 /var/www/html

# 68. Set the SGID bit on a collaborative directory
chmod 2775 /shared/projects

# 69. Set the sticky bit on a shared writable directory
chmod 1777 /shared/uploads

# 70. Add a user-specific ACL entry
setfacl -m u:consultant:rx /shared/budget.xlsx

# 71. Set a default ACL so new files inherit access
setfacl -d -m g:sysdevs:rwx /shared/projects

# 72. Display ACL entries
getfacl /shared/budget.xlsx

# 73. Remove all extended ACL entries
setfacl -b /shared/budget.xlsx

# 74. Check sudoers syntax safely
visudo -c

# 75. Unlock an account locked by failed logins
faillock --user developer1 --reset

Exam notes:

• The most common user mistake:
  • usermod -G replaces all supplementary groups. usermod -aG appends. Always use -aG unless told to replace.
• Any group named in useradd -G must already exist, or the command fails.
• A default ACL (-d) only affects files created later. It does not change files already in the directory.
• Edit sudo rules with visudo or a file in /etc/sudoers.d/, and validate with visudo -c before logging out.

Objective 6: SELinux and Security Controls (Commands 76 to 85)

SELinux tasks follow a pattern: check the mode, check the context, fix the context persistently, then handle booleans and ports.

# 76. Show the current SELinux mode
getenforce

# 77. Switch to permissive mode (runtime only)
setenforce 0

# 78. Show the SELinux context of a directory
ls -Zd /var/www/html/

# 79. Show the SELinux context of processes
ps -eZ | grep httpd

# 80. Add a persistent file context rule
semanage fcontext -a -t httpd_sys_content_t "/custom_web(/.*)?"

# 81. Apply the policy labels recursively
restorecon -Rv /custom_web

# 82. Set an SELinux boolean permanently
setsebool -P httpd_can_network_connect_db on

# 83. List booleans matching a keyword
getsebool -a | grep httpd

# 84. Allow a non-standard port for a service type
semanage port -a -t ssh_port_t -p tcp 2222

# 85. Explain recent AVC denials
ausearch -m avc -ts recent | audit2why

Exam notes:

• The two-step file context rule:
  • semanage fcontext only records the rule. restorecon actually applies it. Skipping the second step is the classic mistake.
• setenforce 0 lasts until the next reboot. A permanent mode change goes in /etc/selinux/config, and in general you should leave SELinux enforcing unless a task says otherwise.
• Without -P, setsebool changes only the running system and reverts at reboot.
• If semanage is missing, install policycoreutils-python-utils.
• Opening a custom port needs both the SELinux port label (semanage port) and a firewall rule.

Objective 7: Networking and Firewalls (Commands 86 to 95)

NetworkManager profiles and firewalld. Changes to a profile do not take effect until the connection is brought up again.

# 86. List NetworkManager connection profiles
nmcli connection show

# 87. Configure a static IPv4 address, gateway, and method
nmcli con mod "eth0" ipv4.addresses "192.168.1.50/24" ipv4.gateway "192.168.1.1" ipv4.method manual

# 88. Set DNS servers on a profile
nmcli con mod "eth0" ipv4.dns "8.8.8.8 1.1.1.1"

# 89. Activate a connection
nmcli connection up "eth0"

# 90. Show IP addresses on all interfaces
ip -br addr show

# 91. Show the routing table
ip route show

# 92. Set the static hostname
hostnamectl set-hostname server1.example.com

# 93. Allow a service permanently in the default zone
firewall-cmd --permanent --add-service=http

# 94. Allow a custom TCP port permanently
firewall-cmd --permanent --add-port=8080/tcp

# 95. Reload firewalld to apply permanent rules
firewall-cmd --reload

Exam notes:

• Profile name versus device name:
  • "eth0" in the examples is the connection profile name. Your profile may be named differently, so check nmcli connection show first.
• Do not edit files under /etc/NetworkManager/system-connections/ by hand. Use nmcli.
• Firewall rules need a reload:
  • --permanent writes the rule but does not activate it. Run firewall-cmd --reload afterward, then verify with firewall-cmd --list-all.

Objective 8: Containers and Software Management (Commands 96 to 100)

Package installation and rootless Podman containers that survive a reboot.

# 96. Install software packages with dnf
dnf install -y httpd container-tools

# 97. Pull a container image with Podman
podman pull registry.access.redhat.com/ubi9/ubi-micro

# 98. Run a detached container with a port mapping and persistent storage
podman run -d --name web -p 8080:80 -v /opt/data:/usr/share/nginx/html:Z nginx

# 99. Generate a systemd unit for a container (older method, see note)
podman generate systemd --name web --files --new

# 100. Keep a user's services running after logout
loginctl enable-linger student

# 99 (RHEL 10 preferred). Define the container as a Quadlet instead
mkdir -p ~/.config/containers/systemd

cat > ~/.config/containers/systemd/web.container << 'EOF'
[Unit]
Description=Web container

[Container]
Image=docker.io/library/nginx
PublishPort=8080:80
Volume=/opt/data:/usr/share/nginx/html:Z

[Install]
WantedBy=default.target
EOF

systemctl --user daemon-reload
systemctl --user start web.service
systemctl --user status web.service

• Command 99 is the older method.
  • podman generate systemd is deprecated in favor of Quadlets, and Quadlets are the approach to learn for RHEL 10. The example below shows the same result with a Quadlet file.
• The :Z flag on a volume tells Podman to relabel the host directory with a private SELinux label for that container. Without it, SELinux typically blocks access.
• Rootless containers that must start at boot need lingering enabled (command 100) so the user's systemd instance runs without an active login.

About the Quadlet version:

• A Quadlet file is converted into a service unit when systemd reloads, and the [Install] section handles enabling it, so you do not run systemctl enable on the generated unit.
• Combined with lingering (command 100), the container starts at boot and keeps running after you log out.

Summary Table: Most-Tested Command Options

Command	Key Option	Why It Matters on the Exam
systemctl	enable --now	Starts the service and makes it persistent in one step
lvextend	-r -L	Resizes the logical volume and its file system together
semanage	fcontext -a -t	Registers a persistent file context rule
restorecon	-Rv	Applies policy labels recursively and shows changes
firewall-cmd	--permanent then --reload	Writes the rule, then activates it
nmcli	connection up	Applies profile changes to the live interface
setsebool	-P	Keeps boolean changes across reboots
usermod	-aG	Adds a group without removing existing ones
podman run	-v /path:/path:Z	Gives the volume the right SELinux label

Exam-Ready Habits

• Use tab completion for subcommands and options in nmcli, systemctl, and firewall-cmd. It is faster and prevents typos.
• Use lvextend -r so the file system grows with the volume in one operation.
• Let nmcli manage networking. Do not hand-edit connection files.
• Add :Z to container volume binds so SELinux allows access.
• Reload the firewall after every --permanent change.
• Reboot and re-check. If time allows, restart the system and confirm services, mounts, firewall rules, and SELinux settings all came back.
• Read each task twice. A requirement like "must persist" or "for all users" changes which command you need.

What This Cheat Sheet Does Not Cover

A list of 100 commands cannot cover the whole exam. Check the official Red Hat objectives for your exam version, and make sure you have also practiced:

• Writing simple shell scripts with conditionals, loops, and arguments
• Interrupting the boot process to reset a lost root password
• Configuring package repositories
• Tuning system performance with tuned profiles
• Configuring NFS and AutoFS mounts
• Managing kernel parameters and the bootloader

Conclusion

The RHCSA rewards candidates who can turn a requirement into the right command quickly and then prove it still works after a reboot. This cheat sheet gives you the map. The speed comes from repetition.

• Know the command, and also the extra step that makes it persistent: enable, fstab, restorecon, -P, --reload
• Use -aG, not -G, when adding users to groups
• Use lvextend -r and know which tool resizes XFS and which resizes Ext4
• Prefer Quadlets over the deprecated podman generate systemd on RHEL 10
• Practice on real systems, break things on purpose, and fix them

Master every objective with hands-on RHCSA labs at LinuxCert.Guru → https://linuxcert.guru