EX362 Red Hat Certified Specialist in Identity Management PDF Dumps

1. Download Valid RedHat EX362 Exam Dumps for Best Preparation Exam : EX362 Title : Red Hat Certified Specialist in Identity Management exam https://www.passcert.com/EX362.html 1 / 9

2. Download Valid RedHat EX362 Exam Dumps for Best Preparation 1.You must deploy a brand-new IdM realm using scripts on RHEL 9. Use integrated DNS and set Google Public DNS as a forwarder. Primary server: ipa1.example.com (10.10.10.11). Realm: EXAMPLE.COM, domain: example.com. Ensure services start at boot and verify the install. A. See the Explanation. Answer: A Explanation: 1. Set hostname and basic resolution: hostnamectl set-hostname ipa1.example.com echo "10.10.10.11 ipa1.example.com ipa1" >> /etc/hosts 2. Open firewall and install packages: dnf -y install ipa-server ipa-server-dns firewall-cmd --add-service={freeipa-ldap,freeipa-ldaps,dns} --permanent firewall-cmd --reload 3. Run unattended install with integrated DNS: ipa-server-install -U \ --realm EXAMPLE.COM --domain example.com \ --hostname ipa1.example.com \ --setup-dns --forwarder=8.8.8.8 \ --admin-password 'RedHat123!' \ --ds-password 'RedHat123!' 4. Enable KRA (optional but commonly expected): ipa-kra-install -p 'RedHat123!' 5. Enable/verify services: systemctl enable --now ipa kinit admin ipa ping 6. Validate DNS SRV and A records resolve: dig +short _ldap._tcp.example.com SRV dig +short ipa1.example.com A 2.Install the same IdM primary using Ansible Automation Platform (AAP) and the freeipa.ansible_freeipa collection, with integrated DNS and a forwarder. A. See the Explanation. Answer: A Explanation: 1. On the control node, install the collection: ansible-galaxy collection install freeipa.ansible_freeipa 2. Create inventory inventory.ini: [ipaservers] ipa1.example.com [all:vars] ansible_user=root 3. Create install-ipa.yml: --- - hosts: ipaservers become: true collections: - freeipa.ansible_freeipa roles: - role: ipaserver state: present ipaserver_domain: example.com ipaserver_realm: EXAMPLE.COM ipaserver_setup_dns: true ipaserver_forwarders: - 8.8.8.8 ipaserver_admin_password: "RedHat123!" 2 / 9

3. Download Valid RedHat EX362 Exam Dumps for Best Preparation ipaserver_dirman_password: "RedHat123!" ipaserver_setup_kra: true 4. Run: ansible-playbook -i inventory.ini install-ipa.yml 5. Post-check: kinit admin ipa config-show ipa dnsconfig-show 3.Install an IdM server with external DNS (no integrated DNS). Configure global DNS forwarders afterwards from IdM. A. See the Explanation. Answer: A Explanation: 1. Install IdM server without DNS: dnf -y install ipa-server ipa-server-install -U \ --realm EXAMPLE.COM --domain example.com \ --hostname ipa1.example.com \ --no-dns --admin-password 'RedHat123!' --ds-password 'RedHat123!' 2. Ensure external DNS has A/PTR and SRV records for IdM. At minimum (add in your external DNS): ipa1.example.com. A 10.10.10.11 _kerberos._udp.example.com. SRV 0 100 88 ipa1.example.com. _kerberos._tcp.example.com. SRV 0 100 88 ipa1.example.com. _kpasswd._udp.example.com. SRV 0 100 464 ipa1.example.com. _ldap._tcp.example.com. SRV 0 100 389 ipa1.example.com. 3. From IdM, set resolvers and forwarders (affects client-side DNS info served by SSSD/DNS discovery only if DNS integrated; otherwise for Kerberos discovery rely on SRV you created): ipa config-mod --dns-forwarders=1.1.1.1 --dns-forwarders=8.8.8.8 4. Validate realm and KDC discovery: ipa ping 5. Confirm clients can discover via SRV (from a client host): dig +short _ldap._tcp.example.com SRV 4.Perform a CA-less IdM deployment using an external corporate CA. Complete the two-stage process. A. See the Explanation. Answer: A Explanation: 1. Stage 1: generate CSR: dnf -y install ipa-server ipa-server-install --realm EXAMPLE.COM --domain example.com \ --hostname ipa1.example.com \ --no-ntp --external-ca -U \ --admin-password 'RedHat123!' --ds-password 'RedHat123!' 2. Collect CSR files (commonly /root/ipa.csr); submit to your external CA to obtain the server cert and the CA chain (PEM). 3. Stage 2: complete the install by providing the certs: ipa-server-install --external-cert-file=/root/ipa_server_cert.pem \ --external-cert-file=/root/ca_chain.pem -U 4. Start/enable and verify: systemctl enable --now ipa kinit admin ipa cert-show 1 5.Enroll a RHEL client app1.example.com into the IdM realm, configure SSSD, and verify identity and 3 / 9

4. Download Valid RedHat EX362 Exam Dumps for Best Preparation sudo data retrieval. A. See the Explanation. Answer: A Explanation: 1. Client prep: hostnamectl set-hostname app1.example.com echo "10.10.10.11 ipa1.example.com ipa1" >> /etc/hosts dnf -y install ipa-client sssd oddjob-mkhomedir 2. Run client install (use your server FQDN): ipa-client-install -U --domain example.com --server ipa1.example.com \ --realm EXAMPLE.COM --mkhomedir --principal admin --password 'RedHat123!' 3. Validate identity lookup: getent passwd admin id admin 4. Validate Kerberos and sudo: kinit admin sudo -l 5. Ensure SSSD enabled: systemctl enable --now sssd 6.Create a replica named ipa2.example.com (10.10.10.12) with CA and DNS using scripts. Ensure it forms a ring topology with the primary. A. See the Explanation. Answer: A Explanation: 1. On replica host: hostnamectl set-hostname ipa2.example.com echo "10.10.10.12 ipa2.example.com ipa2" >> /etc/hosts dnf -y install ipa-server ipa-server-dns firewall-cmd --add-service={freeipa-ldap,freeipa-ldaps,dns} --permanent firewall-cmd --reload 2. (Modern method) From replica, bootstrap using admin creds: ipa-replica-install -U --setup-ca --setup-dns --forwarder=8.8.8.8 \ --principal=admin --admin-password='RedHat123!' \ --mkhomedir 3. Verify server list and topology: kinit admin ipa server-find ipa topologysegment-find --suffix=domain 4. If not in a ring, add a segment: ipa topologysegment-add --suffix=domain \ --left ipa1.example.com --right ipa2.example.com ipa topologysegment-find --suffix=domain 7.Install the same replica using Ansible with ipareplica role, also enabling KRA (for key escrow). A. See the Explanation. Answer: A Explanation: 1. Inventory addition: [ipareplica] ipa2.example.com [all:vars] ansible_user=root 2. Playbook install-replica.yml: 4 / 9

5. Download Valid RedHat EX362 Exam Dumps for Best Preparation --- - hosts: ipareplica become: true collections: - freeipa.ansible_freeipa roles: - role: ipareplica state: present ipareplica_setup_ca: true ipareplica_setup_dns: true ipareplica_forwarders: - 8.8.8.8 ipareplica_setup_kra: true # Admin creds for bootstrap: ipaadmin_password: "RedHat123!" iparealm: EXAMPLE.COM ipadomain: example.com ipamaster: ipa1.example.com 3. Run: ansible-playbook -i inventory.ini install-replica.yml 4. Check replication: kinit admin ipa healthcheck --source=ipahealthcheck.ipa ipa server-role-find ipa2.example.com 8.Configure a conditional DNS forward zone in IdM DNS so that queries for corp.local go to 10.20.20.53. A. See the Explanation. Answer: A Explanation: 1. Ensure integrated DNS is enabled on at least one IdM server. 2. Add forward zone: kinit admin ipa dnsforwardzone-add corp.local --forwarder=10.20.20.53 --forward-policy=only 3. Validate: dig @ipa1.example.com host.corp.local A ipa dnsforwardzone-show corp.local 4. Replication check (from replica): dig @ipa2.example.com host.corp.local A 9.Create three users (alice, bob, carol) and a POSIX group webadmins with GID 30010. Add all three to the group. A. See the Explanation. Answer: A Explanation: 1. Users: ipa user-add alice --first=Alice --last=Admin --email=alice@example.com ipa user-add bob --first=Bob --last=Builder --email=bob@example.com ipa user-add carol --first=Carol --last=Ops --email=carol@example.com 2. Set initial passwords (you’ll be prompted) or: echo 'P@ssw0rd1' | ipa passwd alice echo 'P@ssw0rd1' | ipa passwd bob echo 'P@ssw0rd1' | ipa passwd carol 5 / 9

6. Download Valid RedHat EX362 Exam Dumps for Best Preparation 3. Group with fixed GID: ipa group-add webadmins --desc="Web Admins" --gid=30010 ipa group-add-member webadmins --users=alice,bob,carol 4. Verify: ipa group-show webadmins ipa user-show alice 10.Bulk-create users from a CSV using Ansible and the ipa_user role. A. See the Explanation. Answer: A Explanation: 1. Prepare users.csv (simple list to loop over): uid,first,last,email u01,Ela,Ops,ela@example.com u02,Ray,Dev,ray@example.com u03,Ken,QA,ken@example.com 2. Create vars file users.yml: ipa_users: - uid: u01 givenname: Ela sn: Ops mail: ela@example.com userpassword: "P@ssw0rd1" - uid: u02 givenname: Ray sn: Dev mail: ray@example.com userpassword: "P@ssw0rd1" - uid: u03 givenname: Ken sn: QA mail: ken@example.com userpassword: "P@ssw0rd1" 3. Playbook bulk-users.yml: --- - hosts: ipa1.example.com become: true collections: [freeipa.ansible_freeipa] roles: - role: ipa_user state: present vars_files: - users.yml 4. Run and verify: ansible-playbook -i ipa1.example.com, bulk-users.yml kinit admin ipa user-find u0 11.Create an HBAC policy that allows only members of webadmins to SSH into hosts in hostgroup webservers. A. See the Explanation. 6 / 9

7. Download Valid RedHat EX362 Exam Dumps for Best Preparation Answer: A Explanation: 1. Create hostgroup and add hosts: ipa hostgroup-add webservers --desc="Web servers" ipa hostgroup-add-member webservers --hosts=app1.example.com 2. Ensure HBAC service exists: ipa hbacsvc-add sshd || true 3. Create rule and add subjects/targets: ipa hbacrule-add allow-ssh-webadmins --desc="SSH access for webadmins" ipa hbacrule-add-user allow-ssh-webadmins --groups=webadmins ipa hbacrule-add-host allow-ssh-webadmins --hostgroups=webservers ipa hbacrule-add-service allow-ssh-webadmins --hbacsvcs=sshd ipa hbacrule-enable allow-ssh-webadmins 4. On the client, ensure SSSD HBAC is active and test: sss_cache -E su - alice ssh alice@app1.example.com # should work ssh bob@some-other-host # should be denied if not in targets 12.Create a sudo rule permitting members of dbas group to run systemctl start postgresql and systemctl stop postgresql on hosts in dbservers. A. See the Explanation. Answer: A Explanation: 1. Prep groups/hosts: ipa group-add dbas ipa hostgroup-add dbservers ipa hostgroup-add-member dbservers --hosts=db1.example.com 2. Define sudo commands: ipa sudocmd-add "/usr/bin/systemctl start postgresql" ipa sudocmd-add "/usr/bin/systemctl stop postgresql" ipa sudocmdgroup-add scg_postgresql ipa sudocmdgroup-add-member scg_postgresql \ --sudocmds="/usr/bin/systemctl start postgresql","/usr/bin/systemctl stop postgresql" 3. Create rule: ipa sudorule-add allow-dbas-pg --cmdcat=none --runasusercat=all --hostcat=none --usercat=none ipa sudorule-add-user allow-dbas-pg --groups=dbas ipa sudorule-add-host allow-dbas-pg --hostgroups=dbservers ipa sudorule-add-allow-command allow-dbas-pg --sudocmdgroups=scg_postgresql ipa sudorule-enable allow-dbas-pg 4. On db1, test: sudo -l -U some_dba_user sudo systemctl start postgresql 13.Apply a password policy for group contractors: minimum length 12, lock the account after 5 failures within 5 minutes, and keep it locked for 15 minutes. A. See the Explanation. Answer: A Explanation: 7 / 9

8. Download Valid RedHat EX362 Exam Dumps for Best Preparation 1. Create group and policy: ipa group-add contractors ipa pwpolicy-add --group=contractors --minlength=12 \ --maxfail=5 --failinterval=300 --lockouttime=900 --priority=1 2. Verify: ipa pwpolicy-show --group=contractors 3. Test with a contractor user (trigger failed logins and confirm lockout via /var/log/secure or journalctl on client). 14.Automatically place any user whose departmentNumber equals WebOps into webadmins using automember and rebuild existing entries. A. See the Explanation. Answer: A Explanation: 1. Create automember rule: ipa automember-add --type=group webadmins ipa automember-add-condition --type=group webadmins \ --key=departmentNumber --inclusive-regex='^WebOps$' 2. Rebuild now for existing users: ipa automember-rebuild --type=group 3. Verify by setting attr and re-checking: ipa user-mod alice --setattr=departmentNumber=WebOps getent group webadmins 15.Use staged users to onboard jsmith and then activate the account into the directory. A. See the Explanation. Answer: A Explanation: 1. Stage the user: ipa stageuser-add jsmith --first=John --last=Smith \ --email=jsmith@example.com --uid=jsmith 2. Review staged state: ipa stageuser-show jsmith 3. Activate: ipa stageuser-activate jsmith ipa user-show jsmith 4. Set an initial password and login to validate: echo 'P@ssw0rd1' | ipa passwd jsmith 16.Create an RBAC model so Helpdesk members can reset user passwords but cannot modify other attributes. A. See the Explanation. Answer: A Explanation: 1. Create a precise permission targeting only userPassword on user entries: ipa permission-add "perm: reset user passwords" \ --type=user --attrs=userPassword --right=write 2. Create a privilege and attach the permission: ipa privilege-add "priv: helpdesk password reset" ipa privilege-add-permission "priv: helpdesk password reset" \ 8 / 9

9. Download Valid RedHat EX362 Exam Dumps for Best Preparation --permissions="perm: reset user passwords" 3. Create a role and grant the privilege: ipa role-add helpdesk ipa role-add-privilege helpdesk --privileges="priv: helpdesk password reset" 4. Create group and assign to role: ipa group-add helpdesk ipa role-add-member helpdesk --groups=helpdesk 5. Test with a helpdesk user: kinit helpdeskuser then ipa passwd someuser should work; other edits should be denied. 17.Enable OTP (2FA) for user alice and globally for the domain. Create a TOTP token and test login with password+OTP. A. See the Explanation. Answer: A Explanation: 1. Globally allow OTP: ipa otpconfig-mod --enabled=TRUE 2. For alice, set allowed auth types: ipa user-mod alice --user-auth-type=otp,password 3. Create a token for alice: ipa otptoken-add --owner=alice --type=totp --algorithm=sha1 --digits=6 --interval=30 4. Display the secret/URI and enroll in an authenticator app: ipa otptoken-show <TOKEN-UUID> 5. Test login on a client: when prompted for password, enter password immediately followed by the 6-digit OTP. 18.Gracefully decommission a replica ipa2.example.com (keeping the domain healthy) and remove it from topology and DNS. A. See the Explanation. Answer: A Explanation: 1. Check topology to ensure other links exist: kinit admin ipa topologysegment-find --suffix=domain 2. Disable services on the replica (run on replica): ipactl stop 3. From primary, remove the replica: ipa server-del ipa2.example.com 4. Clean up DNS records (if needed): ipa dnsrecord-del example.com ipa2 --a-rec 10.10.10.12 5. Verify topology again: ipa server-find ipa topologysegment-find --suffix=domain 9 / 9