Skip to content
Stéphane Robert
Français
Account: not signed in, sync available My learning
Select theme
Français
Lire en français

Prepare for the RHCSA certification

By updated

Improve this page

What would you like to report?

The issue opens pre-filled with this page title and URL.

The RHCSA validates your ability to administer a Red Hat Enterprise Linux server in real conditions. It covers user, storage, network, service, package and SELinux security management, all in 3 hours, with no multiple-choice questions, on a real RHEL 10 system. Persistence after reboot is the common thread of the exam: if it does not survive a restart, it does not count.

This page is the RHCSA preparation hub. It reflects the official categories of the EX200 blueprint, identifies what is common to Linux and what is specific to Red Hat, and points you to the site's guides and the labs of the companion repository.

What you will learn

  • What the RHCSA validates and how it differs from the LFCS
  • The format of the EX200 exam on RHEL 10 and the concrete conditions
  • The official blueprint categories and what they cover
  • The often overlooked objectives: Flatpak, boot targets, NFS/autofs, IPv6, SELinux port labels
  • What you must be able to do without hesitation on the day, tool by tool
  • The split between common Linux and RHEL-specific so you do not mix the two up
  • A preparation plan by category with the matching guides and labs

What the RHCSA validates

The RHCSA certifies that you are able to administer a RHEL server in production:

  • Use the essential tools: command line, files, permissions, redirections, grep
  • Create simple shell scripts to automate administration tasks
  • Operate running systems: boot targets, logs, scheduling, tuning
  • Configure local storage: GPT partitions, LVM, file systems, NFS, autofs
  • Manage users, groups and privileged access
  • Configure the network with nmcli (IPv4 and IPv6) and firewalld
  • Manage software with dnf, RPM repositories and Flatpak repositories
  • Secure the system: SELinux (modes, contexts, ports), SSH keys, firewall, default permissions

This guide is aligned with RHEL 10, the version Red Hat states the EX200 exam is based on (exam page checked on 2026-10-01). Tools, paths and behaviours may differ from RHEL 8 or 9. Check the current blueprint before registering: red.ht/rhcsa.

Exam format

AspectValue
ExamEX200
Duration3 hours (single session)
TypeProctored hands-on exam (performance-based)
Minimum score210 / 300 (70%)
Retake1 free second attempt per paid first attempt
Price$500 (Red Hat list price, varies by region)
Validity3 years from the date earned
ModeOnline or in an approved centre, proctored
Documentation availableDocumentation built into the product: man, info, files under /usr/share/doc, no Internet access or external documentation
RHEL versionRHEL 10

The official categories of the EX200 blueprint

The EX200 blueprint is organised into ten categories of objectives published by Red Hat. The table below follows this official structure, in the order of the exam page, without weighting their relative importance, which is not published.

Official categoryWhat it covers
Essential toolsCommand line, files, ugo/rwx permissions, hard and symbolic links, archives, redirections, grep, regular expressions, SSH, documentation
Software managementRPM repositories, RPM packages, Flatpak repositories, installing and removing Flatpak software
Simple shell scriptsConditionals (if, test, []), for loops, script arguments ($1, $2…), using command output
Running systemsBoot and shutdown, boot targets, interrupting the boot, resource-hungry processes, scheduling (nice/renice), tuning profiles (tuned), persistent journals, network services, secure file transfer
Local storageGPT partitions, LVM (PV/VG/LV), mounting by UUID or label, adding partitions, volumes and swap non-destructively
File systemsVFAT, ext4, XFS, NFS mounts, autofs, extending a logical volume, permission problems
Deploy, configure, maintainat, cron, systemd timers, services at boot, default target, time client, package updates, boot loader
Basic networkingIPv4 and IPv6 addresses, hostname resolution, network services at boot, filtering with firewalld
Users and groupsAccounts, passwords and aging, groups, privileged access (sudo)
Securityfirewalld, default permissions, SSH keys, SELinux (modes, contexts, restore, port labels, booleans)

Two subjects often associated with the RHCSA do not appear in this detailed list: POSIX ACLs, useful to diagnose a permission problem but never named, and containers, covered in the next callout.

Persistence is the real difficulty. On the RHCSA, knowing the command is not enough. You must know how to make sure the result survives a reboot: a service enabled with --now, a mount in /etc/fstab, a correct SELinux context, a permanent firewall rule (--permanent + --reload). A candidate who gets the right result without persistence does not score the points.

Common Linux vs RHEL-specific

Part of the RHCSA covers general Linux skills. Another part requires specific Red Hat tools.

SkillNatureRHEL tool(s)
Navigation, files, permissionsCommon Linuxnone
Shell scripts, pipes, redirectionsCommon Linuxnone
Users and groupsCommon Linuxuseradd, groupadd, passwd
systemd services, boot targetsCommon Linuxsystemctl
RPM package managementRHEL-specificdnf, /etc/yum.repos.d/ repositories
Flatpak softwareRHEL-specificflatpak, Flatpak repositories
Network configurationRHEL-specificnmcli, nmtui
FirewallRHEL-specificfirewalld, firewall-cmd
System tuningRHEL-specifictuned, tuned-adm
MAC securityRHEL-specificSELinux, semanage, restorecon
Containers (ambiguous signal on the current EX200)RHEL-specificrootless podman

What you must be able to do without hesitation

Essential tools and shell

This category is not revised, it is practised until it becomes invisible. It does not score points directly, but any slowness here is paid for on the following tasks: looking up the syntax of find or tar during the exam is that much less time for storage and SELinux, which are the costly blocks.

  • Navigate the file system, handle files and directories
  • Manage permissions (chmod, chown) and create hard links and symbolic links
  • Use I/O redirection (>, >>, 2>, |) and pipes
  • Find files with find and filter content with grep and regular expressions
  • Archive and compress with tar, gzip, bzip2

Simple shell scripts

The important word in the title is simple. The exam never asks for an elegant script, it asks for a script that produces the expected result and can be run again without breaking what already exists. The third point brings you back to the RHCSA's common thread: a scheduled task only counts if its schedule survives the reboot.

  • Write a Bash script with variables, conditionals (if/elif/else) and loops (for, while)
  • Check return codes ($?) and stop cleanly on error
  • Schedule a task with cron or a systemd timer

Software management: dnf and Flatpak

Look above all at the last line. Flatpak is the point most often ignored by candidates coming from a server environment, because it is associated with the desktop, whereas it appears explicitly in the objectives.

  • Install, remove and update a package with dnf
  • Configure a local or third-party RPM repository in /etc/yum.repos.d/
  • Check which package provides a command (dnf provides)
  • Add a Flatpak repository and install / remove a Flatpak application

AppStream modules are no longer an objective

Until 2026-09-15 this page asked you to know how to "enable and disable an AppStream module". It is an instruction that is out of date twice over. It does not appear in the EX200 objectives published for RHEL 10, and above all the mechanism no longer has any purpose on the exam's distribution. Measured on AlmaLinux 10.2:

Terminal window
dnf module list
Output
WARNING: modularity is deprecated, and functionality will be removed in a future release of DNF5.
Last metadata expiration check: 0:09:31 ago on Tue 15 Sep 2026 11:19:16 AM UTC.

The command still exists, exits with 0, and lists no module. Trying to enable one confirms it:

Output
Error: Problems in request:
missing groups or modules: nodejs

The mechanism is still explained in the dnf guide, because a RHEL 8 or 9 fleet still relies on it. What is withdrawn here is the certification promise, not the knowledge.

Running systems: boot, scheduling, tuning

This list mixes harmless actions and a dreaded exercise. Interrupting the boot at GRUB2 level to regain control of a system whose root password is lost is the only RHCSA task you cannot improvise: the sequence has several steps, including a touch /.autorelabel that is easy to forget, and a mistake leaves you with a system that no longer boots.

  • Identify the boot target with systemctl get-default
  • Change the default target (systemctl set-default multi-user.target or graphical.target)
  • Interrupt the boot at GRUB2 level to recover root access (rd.break or init=/bin/bash parameter)
  • Manage process priority with nice and renice
  • List and activate a performance profile with tuned-adm list and tuned-adm profile
  • Configure journal persistence for systemd in /etc/systemd/journald.conf (Storage=persistent)
  • Transfer files securely with scp or rsync

Storage and file systems

It is the longest block and the one that produces the most failures, almost always for the same reason: a mount that does not survive the reboot. Remember the line about mounting by UUID or label. An /etc/fstab that references /dev/sdb1 works the day you write it and breaks at the next reboot if the disk detection order changes, which is enough to invalidate the task.

  • Identify disks and partitions with lsblk, blkid, fdisk -l
  • Create partitions on a GPT disk with gdisk or parted
  • Format as xfs, ext4 or vfat depending on the objective
  • Mount by UUID or label in /etc/fstab (do not use the /dev/sdX device name)
  • Create an LVM Physical Volume, Volume Group and Logical Volume
  • Extend a Logical Volume and its file system online
  • Mount an NFS export and make it persistent in /etc/fstab
  • Configure autofs for on-demand automatic mounting

Networking with NetworkManager

On RHEL, editing a network configuration file by hand is not enough: NetworkManager holds the state, and nmcli is the only reliable path. Two points are regularly underestimated, the static IPv6 address, often forgotten although it is in the syllabus, and the --permanent then --reload pair of firewalld, without which the rule disappears at reboot.

  • Show the connections with nmcli con show
  • Configure persistent static IPv4 and static IPv6 addresses
  • Configure the hostname with hostnamectl set-hostname
  • Check DNS resolution and edit /etc/hosts
  • Apply a firewalld rule permanently (--permanent + firewall-cmd --reload) and check it

Users, groups and sudo

Creating an account is trivial; it is the side constraints of the task that make the difference. Imposed UID, precise shell, secondary group, expiry date: each one is scored separately. Watch the last point too: SSH key authentication fails silently if the permissions of ~/.ssh and authorized_keys are too open, and the client-side error message does not say so.

  • Create a user with a specific UID, shell and primary group
  • Modify an existing account without recreating the home directory (usermod)
  • Configure sudo so that a group can run targeted commands (file in /etc/sudoers.d/)
  • Manage expired passwords and account locks (chage, passwd -l)
  • Configure SSH key authentication for a user (authorized_keys, correct permissions)

SELinux

SELinux is the block candidates coming from Debian or Ubuntu prepare least, and it is also the one that silently breaks the other tasks: a correctly configured service will refuse to start if the context of its file or port is wrong. The last two points are the most rewarding, the persistent boolean with setsebool -P and above all the port label with semanage port, essential as soon as a service listens on a non-standard port.

  • Identify the current mode (getenforce, sestatus)
  • Change the mode permanently in /etc/selinux/config
  • Identify file and process contexts (ls -Z, ps -Z)
  • Fix an incorrect context with restorecon -Rv
  • Identify and fix an SELinux error with ausearch -m avc or sealert
  • Enable or disable an SELinux boolean persistently (setsebool -P)
  • Manage SELinux port labels with semanage port -a / semanage port -l / semanage port -d

Minimum foundation before you start

  1. Master the Linux terminal

    Navigation, file handling, permissions, pipes and redirections. This foundation is common to all Linux certifications.

  2. Have used systemctl and know the targets

    You must be comfortable with start, stop, enable, disable, status, reading logs with journalctl and changing the default target. It is systematic in the RHCSA.

  3. Understand SELinux at an operational level

    SELinux is present on RHEL and often under-prepared. You must be able to read getenforce, fix a context with restorecon, diagnose in the audit logs and manage a port label with semanage port.

  4. Have practised recovering access at boot

    One of the official EX200 objectives is to interrupt the boot to recover root access to a system. Practise with GRUB2 (rd.break) before the day.

  5. Have practised on RHEL 10, AlmaLinux 10 or Rocky Linux 10

    The exam is on RHEL. Any preparation on Ubuntu or Debian leaves gaps on dnf, nmcli, firewalld and SELinux. Use a RHEL 10 VM (or a free clone) with dsoxlab.

Preparation plan

DNF, RPM repositories and Flatpak

Objective: Manage all the software of a RHEL 10 server, RPM packages and Flatpak applications.

What you must do:

  • Install a package, remove one, apply security updates
  • Configure a local or third-party RPM repository in /etc/yum.repos.d/
  • Add a Flatpak repository (e.g. Flathub) and install / remove a Flatpak application: the Install applications with Flatpak guide covers remote-add, search, install, list and update
  • Check the state of installed packages after reboot

Companion repository labs: two labs cover RPM packages, and the drill-packages drill replays them under exam conditions. No lab covers Flatpak yet.

Terminal window
dsoxlab run l2-package-management    # install, remove, update
dsoxlab run l2-repo-configure        # declare an RPM repository

The rhcsa-mock-exam capstone (a full EX200 mock exam, 20 tasks on 2 VMs, about 180 minutes) tests you under exam conditions:

The 20 tasks were checked against the EX200 objectives published on 2026-09-15, one by one, then corrected where they diverged. Two tasks scored a skill absent from the reference, and an entire section was not tested.

What was testedWhy it was wrongWhat replaces it
Exporting an NFS shareThe objective says "Mount and unmount network file systems using NFS": it is the client side that is assessed, exporting belongs to the RHCEThe share is now provided by the lab, and only its persistent mount is scored
Configuring a time serverThe objective says "Configure time service clients"The server is provided, the client is scored
(nothing)The "Create simple shell scripts" section, that is four official objectives, was tested by no taskA script that processes $1, tests a condition, loops over the members of a group and uses the output of a command

The pass mark is set at 70/100, deliberately above the real threshold: a margin in training is better. Like the exam itself, this mock exam samples the reference. What it does not draw: automounting, the VFAT and ext4 file systems, tuning profiles, journal preservation, process scheduling and boot loader modification.

Site guides:

The dnf guide covers installation, RPM repositories and security updates. Two operations guides also serve this category, because installed software is checked in service: systemctl to start, stop and enable a unit, journalctl to filter logs by level or by unit and make them persistent. Finally, fix broken dependencies shows how to get out of an interrupted installation, with dnf distro-sync on the RHEL side.

Persistence checklist, to tick after each task

This table sums up the critical checks to run after each action in an RHCSA lab:

ActionCheck commandPost-reboot command
Install a packagerpm -q <package>rpm -q <package>
Enable a servicesystemctl is-enabled <service>systemctl status <service>
Mount a volumefindmnt <mountpoint>findmnt <mountpoint>
firewalld rulefirewall-cmd --list-allfirewall-cmd --list-all
User createdid <user>id <user>
SELinux contextls -Z <file>ls -Z <file>
SELinux booleangetsebool <boolean>getsebool <boolean>
SELinux portsemanage port -l | grep <port>semanage port -l | grep <port>
Default targetsystemctl get-defaultsystemctl get-default
NFS share mountedfindmnt <mountpoint>findmnt <mountpoint>
Active tuned profiletuned-adm activetuned-adm active
Persistent journalsls /var/log/journal/journalctl -b -1 (previous boot)

Key points

  • The RHCSA is an exam on RHEL 10: dnf, nmcli, firewalld and SELinux are the expected tools, not their Ubuntu equivalents.
  • Persistence after reboot is systematic: any configuration that does not survive a restart is an incomplete answer.
  • Flatpak is explicitly in the objectives: know how to add a Flatpak repository and install an application.
  • Boot targets count: know how to change the default target and interrupt the GRUB2 boot to recover root access.
  • SELinux port labels (semanage port) are often overlooked, prepare them.
  • IPv6 is in the networking blueprint: configure at least one static IPv6 address with nmcli.
  • firewall-cmd requires --permanent then --reload for rules to survive.
  • restorecon -Rv is the first-aid command for SELinux context problems.
  • systemctl enable --now is the atomic action to use: it starts and enables in a single command.
  • Time management: the exam lasts 3 hours in a single session. In training, aim for under 10 minutes per task; if you get stuck, move on to the next one and come back.

Is this project useful to you?

The guides, courses, quizzes and labs stay free. If you use them regularly, you can contribute to their upkeep and development.

Become a supporting member (new tab) One-time support (new tab) Learn more

Follow the project on LinkedIn