// Exam Domain Weights (XK0-006)

1. System Management
23%
2. Services and User Management
20%
3. Security
18%
4. Automation, Orchestration & Scripting
17%
5. Troubleshooting
22%
LESSON 01

Linux Concepts & Distributions

Domain 1 · Obj 1.1
What is Linux?
Linux KernelCore component of the OS. Written primarily in C. Manages file system access, memory, processes, devices, and resource allocation. All Linux distributions share the same kernel — distributions differ in the software layered on top. FOSSFree and Open-Source Software. Anyone can view, modify, and redistribute the source code. No licensing fees. Large community reviews for vulnerabilities. Foundation of Linux. Open-Source LicensesGPL (GNU General Public License) — copyleft, derivative works must also be open source. Apache License 2.0 — permissive, can use in proprietary products. Mozilla Public License — file-level copyleft. CopyleftOpen-source license requirement that derivative works must be distributed under the same license. "Share alike." GPL is the primary copyleft license. Permissive licenses (MIT, Apache) allow use in closed-source products. Kernel VersionsFormat: Major.Minor-Revision. Example: 5.16.3. Production kernel = stable and tested. Developmental kernel = not fully tested, implied instability. Even minor numbers = historically stable (older convention).
Linux Distributions
All distributions use the same Linux kernel — they differ in package manager, default software, release cycle, and target audience.
Distribution FamilyPackage ManagerPackage FormatCommon Distros
Red Hat (RPM-based)RPM / YUM / DNF.rpmRHEL, Fedora, CentOS, Rocky Linux, AlmaLinux
Debian-baseddpkg / APT.debDebian, Ubuntu, Linux Mint, Kali Linux
SUSE-basedZypper / RPM.rpmopenSUSE, SUSE Linux Enterprise
Fedora → Red Hat Enterprise Linux → CentOS/Rocky (downstream). Ubuntu → Debian (upstream). Knowing the family tells you the package manager. 99% of distros trace back to Debian or Red Hat.
Server Architectures
x8632-bit Intel/AMD. Legacy. CISC instruction set. Limited to 4GB RAM. Rarely deployed in new hardware. x86_64 / AMD6464-bit Intel/AMD. Current standard for servers and desktops. CISC. Massive RAM support. Most Linux server deployments run this architecture. AArch64 (ARM64)64-bit ARM. RISC instruction set. Low power, high efficiency. Used in cloud servers (AWS Graviton), Raspberry Pi 4+, Apple M-series, embedded systems. RISC-VOpen-source RISC instruction set architecture. No licensing fees. Growing in embedded and IoT. Linux fully supports it. Not yet mainstream for servers.
Filesystem Hierarchy Standard (FHS)

The FHS defines where different types of files live on every Linux system. Know all of these — they appear in exam questions constantly.

/Root directory. Top of the filesystem hierarchy. Everything lives here.
/binEssential user binaries available to all users. ls, cp, mv, cat, echo. Must be available before /usr is mounted.
/sbinSystem binaries. Admin commands: fdisk, fsck, ifconfig. Typically requires root.
/bootBoot loader files. grub.cfg, vmlinuz (kernel), initrd/initramfs images. Do not modify directly.
/devDevice files. /dev/sda (first HDD), /dev/null, /dev/zero, /dev/urandom. Everything is a file in Linux.
/etcSystem configuration files (99%). passwd, shadow, fstab, hosts, resolv.conf, sshd_config. Text files — edit to change settings.
/homeUser home directories. /home/username. Private space for each user's files and configurations.
/libShared libraries for /bin and /sbin. Kernel modules in /lib/modules.
/procVirtual filesystem. Runtime system information. /proc/cpuinfo, /proc/meminfo, /proc/mounts. Created at boot, not on disk.
/tmpTemporary files. World-writable. Cleared on reboot on most systems. Do not store persistent data here.
/usrUser system resources. Non-essential binaries, libraries, documentation. /usr/bin, /usr/lib, /usr/share.
/varVariable data that changes during operation. /var/log (logs), /var/spool (print queues), /var/www (web files).
The exam frequently asks: "Which directory contains system configuration files?" → /etc. "Where are system logs stored?" → /var/log. "Where are user home directories?" → /home. Know all 12 FHS directories and their purpose.
GUI Components
X Server (X11)Traditional display server. Manages graphical output to displays and input from keyboard/mouse. Being replaced by Wayland. WaylandModern display protocol. Replacement for X11. More secure — each app isolated from others. Default on Fedora, Ubuntu 21.04+, RHEL 8+. Display ManagerGraphical login screen. Manages user sessions. Examples: GDM (GNOME), SDDM (KDE), LightDM (Ubuntu). Window ManagerControls how windows are arranged, sized, and decorated. Can run independently of a full desktop environment. Desktop EnvironmentsGNOME (default RHEL/Ubuntu), KDE Plasma (feature-rich), Cinnamon (Linux Mint), MATE (lightweight GNOME 2 fork).
Common Shells & CLI
BashBourne Again Shell. Default shell on most Linux distributions. Most common for scripting. Extension: .sh. Shebang: #!/bin/bash. ZshZ Shell. Default on macOS (Catalina+). Advanced tab completion, plugins, themes. Compatible with Bash. KshKorn Shell. Older shell, common in older UNIX environments and some enterprise Linux deployments. Tab CompletionPress Tab to auto-complete commands, files, and directories. Press Tab twice to see all possible completions. Reduces errors and speeds up work. Command HistoryUp/Down arrows cycle through history. history command shows recent commands. Saved in ~/.bash_history after session ends.

Bash Command Structure

command -option argumentExample: ls -l /etc — list command, long format option, /etc argument. command subcommand argumentExample: ip addr show eth0 — ip command, addr subcommand, show sub-subcommand. Case sensitiveLinux is case-sensitive. File.txt and file.txt are different files. Space sensitiveSpaces separate command arguments. Use quotes for filenames with spaces: cat "my file.txt".
Getting Help
man commandManual pages. Primary documentation. Navigate: Page Up/Down. Search: /keyword then n/p. Quit: q. Man page sections: NAME, SYNOPSIS, DESCRIPTION, OPTIONS, SEE ALSO. command --helpQuick usage summary. Faster than man pages for syntax reminders. whatis commandOne-line description of a command. Uses the man page NAME section. man -k topicSearch man pages by keyword. Equivalent to apropos topic. Finds relevant commands when you don't know the exact name. /usr/share/docExtended documentation for installed packages. README files, changelogs, examples.
LESSON 02

Boot Process & Installation

Domain 1 · Obj 1.1, 1.2
Linux Boot Process — Sequential Steps
BIOS/UEFI — Firmware initializes hardware (POST). Locates bootable media based on boot order. UEFI reads GPT, BIOS reads MBR.
Boot Loader (GRUB2) — Loaded from MBR/GPT. Displays boot menu. Loads the kernel and initial RAM disk into memory.
Kernel + initrd/initramfs — Kernel decompresses and loads into memory. initrd (initial RAM disk) or initramfs provides a temporary root filesystem with enough drivers to mount the real root partition.
systemd (PID 1) — First process started by the kernel. Replaces old init system. Reads unit files and starts all services and targets.
default.target — systemd boots to the configured default target (multi-user.target for CLI, graphical.target for GUI).
Display Manager / Shell — GUI: display manager presents login screen. CLI: login prompt displayed. User authenticates → shell starts.

Key /boot Directory Files

vmlinuzCompressed Linux kernel binary. The actual kernel loaded at boot. initrd / initramfsInitial RAM disk image. Temporary filesystem providing drivers needed to mount the real root partition. grub.cfgGRUB2 boot menu configuration. Auto-generated — do NOT edit directly. Edit source files then run grub2-mkconfig.

initrd Management

dracutModern tool for generating initramfs images. Default on RHEL/Fedora. dracut --force regenerates the initramfs for the current kernel. Required after adding storage drivers or making hardware changes that affect early boot. mkinitrdLegacy tool for generating initrd images. Still referenced in some environments and the XK0-006 objectives. On modern systems, dracut has replaced it.
GRUB2 Configuration
grub2-installInstalls GRUB2 boot loader onto a device. Syntax: grub2-install [options] /dev/sda grub2-mkconfigBuilds grub.cfg from source files. Always run after modifying /etc/default/grub. grub2-mkconfig -o /boot/grub/grub.cfg. Some distros use update-grub as a shortcut. /etc/default/grubAdmin-editable GRUB2 settings file. Modify here, then run grub2-mkconfig. Controls timeout, default OS, kernel parameters. Boot Targetssystemctl get-default — view current default target. systemctl set-default graphical.target — set GUI boot. systemctl set-default multi-user.target — set CLI boot.
Never edit /boot/grub/grub.cfg directly — it is auto-generated and changes will be overwritten. Edit /etc/default/grub then run grub2-mkconfig. A typo in grub.cfg can prevent the system from booting.
PXE Boot
PXEPre-boot Execution Environment. Boots a system over the network without local media. Process: DHCP assigns IP → TFTP server downloads the Network Bootstrap Program (NBP) → OS install begins. Boot SourcesInternal disk, USB storage, ISO image, Virtual machine file, PXE (over HTTP, FTP, NFS, or TFTP).
Installation Types & Partitioning
GUI (Attended)Simple graphical installation wizard. Administrator-intensive — requires a person at the console for each install. Standard for single-system deployments. Server Core (CLI)Smaller disk footprint, reduced attack surface, CLI only. Preferred for production servers — fewer unnecessary packages and services. Bare MetalOS installed on empty hardware with no existing OS. Boot from DVD/ISO/USB, create partition, format, install. Unattended / KickstartScripted installation via answer file (unattend.xml or kickstart file). No human interaction. Used for mass deployments. Combined with PXE for fully automated provisioning. Live MediaBoots fully functional Linux from DVD/USB into RAM. Used to test hardware compatibility before installing. Cloning / ImagingDeploy identical pre-configured disk images to many machines. Faster than individual installation for large deployments.

Partition Table Types

MBR (Master Boot Record)Legacy. Maximum 4 primary partitions. Maximum disk size 2TB. Boot data stored in one sector — single point of failure. GPT (GUID Partition Table)Modern standard. Virtually unlimited partitions and disk size. Boot data stored in multiple locations. Required for UEFI and disks over 2TB.

Common Filesystem Types

ext4Fourth extended filesystem. Default on Debian/Ubuntu. Journaling. Max file size 16TB. Max filesystem 1 exabyte. Max 64,000 subdirectories. XFSDefault on RHEL/CentOS/Rocky. High performance. Large partition and file sizes. Excellent for large files and high-throughput workloads. Cannot shrink — only grow. BtrfsB-tree filesystem. Built-in snapshots, RAID support, compression, and self-healing. Scalable and easy to manage. Growing adoption. tmpfsTemporary filesystem stored in RAM. Fast. Data lost on reboot. Used for /tmp and /run on many systems. VMFSVMware filesystem. 64TB max. Used by VMware ESXi for virtual machine storage. ReFSResilient File System. Microsoft. Built-in resiliency. Improvement over NTFS. Not native to Linux. ZFSZettabyte File System. 256 ZB volume size. Max 16 EB file size. Built-in RAID, snapshots, deduplication. Common on NAS systems (TrueNAS).
LESSON 03

Users & Groups

Domain 2 · Obj 2.1
User Configuration Files
/etc/passwdContains basic user account info. Seven colon-separated fields: username:x:UID:GID:comment:home:shell. The "x" means password is stored in /etc/shadow. Root UID = 0. System accounts typically UID 1–999. Regular users start at 1000. /etc/shadowStores hashed passwords and aging info. Readable by root only. Fields: username:hash:lastchange:min:max:warn:inactive:expire. Min = min days before password change. Max = max days before required change. Warn = days of warning before expiration. /etc/groupLists all groups and their members. Fields: groupname:x:GID:members. GID = Group ID. Primary group = group owner for all files created by user. Supplementary groups = additional access. /etc/gshadowSecure group information. Encrypted group passwords and group administrators. /etc/skelSkeleton directory. Files here are automatically copied into a new user's home directory when the account is created. Used to provide default shell configs, welcome messages, or standard directory structure to all new users. /etc/profileSystem-wide login shell configuration. Runs for all users at login. Sets default environment variables and runs scripts in /etc/profile.d/. User-specific settings go in ~/.bash_profile or ~/.profile.
User Account Types & UID Ranges
Root AccountUID 0. Superuser — unrestricted access to everything. Should never be used for daily tasks. Login as root directly should be disabled via SSH. System AccountsUID 1–999 (varies by distro). Created by the OS or applications for running services (www-data, sshd, nobody). No login shell typically set. Not for human users. Service AccountsCreated for specific services or applications. May have a home directory and shell depending on the service's needs. Managed like system accounts but often created by admins manually. Regular User AccountsUID 1000+ (Debian/Ubuntu) or 500+ (older RHEL). Human users for interactive login. Subject to password policies and resource limits. EUID (Effective User ID)The UID actually used for permission checks during execution. May differ from the real UID when SUID programs are running. Determines what access the process actually has. EGID (Effective Group ID)The GID actually used for permission checks. May differ from real GID when SGID programs run. wheel groupOn RHEL/Fedora: members of the wheel group are allowed to use sudo. Adding a user to wheel: usermod -aG wheel username. On Debian/Ubuntu the equivalent group is called sudo. sudo groupOn Debian/Ubuntu: members of the sudo group are allowed to use sudo. Equivalent to wheel on RHEL. usermod -aG sudo username.
User Management Commands
useradd usernameLow-level command to create a new user. Options: -c comment, -e expiry, -s shell, -m create home dir, -G supplementary groups. adduser usernameHigher-level interactive user creation command (Debian/Ubuntu). More user-friendly than useradd — prompts for password and info. Creates home directory by default. usermod options userModify existing user. -L lock, -U unlock, -aG group add to group (append), -s /bin/bash change shell. userdel usernameDelete user account. -r also removes home directory and mail spool. deluser usernameHigher-level user deletion (Debian/Ubuntu). Equivalent to userdel. deluser --remove-home username also removes home directory. passwd usernameSet or change a user's password. -l lock. -u unlock. -d delete password (passwordless). chage options userModify password aging. -l list, -M 90 max 90 days, -m 7 min 7 days, -W 14 warn 14 days, -E 2025-12-31 expiry. chsh -s /bin/zshChange user's login shell. getent passwd usernameQuery the Name Service Switch databases — works for local accounts AND LDAP/AD-joined systems. More reliable than reading /etc/passwd directly in enterprise environments. id usernameDisplay UID, GID, and all group memberships. Also shows EUID and EGID. groups usernameList all groups a user belongs to. whoamiDisplay current username. whoDisplay currently logged-in users with terminal, login time, and source IP. lastlogMost recent login for all users. lastLogin history from /var/log/wtmp. wCurrently logged-in users and their activity including idle time and current process.
Group Management Commands
groupadd groupnameCreate a new group in /etc/group. groupmod options groupModify a group. -n newname rename. -g GID change GID. groupdel groupnameDelete a group. Cannot delete a group that is a user's primary group. usermod -aG sales userAdd user to supplementary group. The -a flag is critical — without it, the user is removed from all other supplementary groups.
Privilege Escalation
sudoSuperuser Do. Executes ONE command as root (or another user). Logs to /var/log/auth.log or /var/log/secure. Preferred over su — least privilege and full audit trail. Configured in /etc/sudoers (edit with visudo). su - rootSwitch User. Switches to root with root's full environment (- flag). Requires knowing root's password. Gives full root shell — riskier and less auditable than sudo. visudoSafe editor for /etc/sudoers. Validates syntax before saving — prevents lockout from syntax errors. Never edit /etc/sudoers directly. /etc/sudoersDefines who can use sudo and what commands. Format: username ALL=(ALL:ALL) ALL gives full sudo access. NOPASSWD: allows passwordless sudo for specific commands. PolicyKit / pkexecGraphical privilege delegation. More granular than sudo. Controls actions like device mounting, network configuration, shutdown. Policy files define which actions are permitted without root password.
sudo vs su: sudo = one command, logged, requires user's own password. su = full root shell, requires root's password. For the exam: sudo is more secure because it provides least privilege and audit trail. Use visudo — never edit /etc/sudoers directly.
LESSON 04

Implementing File Management

Domain 1 · Obj 1.5
Paths — Absolute vs Relative
Absolute PathFull path from root /. Always starts with /. Works regardless of your current directory. Example: /etc/ssh/sshd_config Relative PathPath relative to your current working directory. Does NOT start with /. Example: if pwd is /etc, then ssh/sshd_config is the relative path to the same file. . (single dot)Represents the current directory. ./script.sh = run script in current directory. .. (two dots)Represents the parent directory — one level up. cd .. moves up one level. ~ (tilde)Represents the current user's home directory. cd ~ = go home. ~/projects = projects folder in home dir. - (dash)Previous directory. cd - switches back to where you just were. Useful for toggling between two directories.
Essential File Commands
ls -laList all files (including hidden) in long format. -a shows hidden (dot) files. -d shows directories only. cd ~Change to home directory. cd / = root. cd .. = up one level. cd - = previous directory. pwdPrint Working Directory. Shows absolute path to your current location. treeDisplays the filesystem in a hierarchical tree-like format. tree /etc shows the /etc structure visually. touch fileCreate an empty file, or update the timestamp of an existing file without modifying its contents. mkdir -p a/b/cCreate directory. -p creates parent directories as needed. rmdir dirRemove an EMPTY directory. Fails if directory contains files. Use rm -rf dir/ for non-empty directories. cp -r src/ dst/Copy files or directories. -r = recursive (required for directories). mv src dstMove or rename files/directories. rm -rf dir/Delete files. -r = recursive. -f = force (no prompts). No Recycle Bin — permanent deletion. cat fileDisplay entire file contents. Concatenate files: cat file1 file2. Create files: cat > newfile. less fileDisplay file one page at a time. Scroll up AND down. Search: /keyword. Quit: q. Preferred over more. more fileDisplay file one page at a time. Older — forward scroll only. Space = next page. q = quit. head -n 20 fileDisplay first 20 lines. Default is 10. Good for viewing notes at top of config files. tail -f /var/log/syslogDisplay last lines. -f = follow (real-time monitoring). Best for watching live logs. grep -i "pattern" fileSearch for patterns. -r = recursive. -i = case-insensitive. -n = show line numbers. find /etc -name "*.conf"Search for files. -name by filename, -type f/d file/dir, -perm 755 by permissions. locate filenameFast file search via pre-built index (/var/lib/mlocate/mlocate.db). Much faster than find but may be stale. updatedbRebuild the locate index. Run as root to ensure locate results are current. which commandShows the full path of a command found in $PATH. Confirms which version will run. stat fileDetailed file metadata: size, inode number, permissions, ownership, access/modify/change timestamps, storage blocks. file filenameIdentify file type from content, not extension. Useful when extension is missing or misleading. wc -l fileCount lines (-l), words (-w), or bytes (-c). sort fileSort lines alphabetically. -n = numeric. -r = reverse. uniq fileRemove duplicate adjacent lines. Usually piped after sort. cut -d: -f1 /etc/passwdExtract fields. -d = delimiter, -f = field number. awk '{print $1}' filePattern scanning and processing. More powerful than cut. sed 's/old/new/g' fileStream editor. Search/replace, delete lines. -i = in-place edit. df -hShow disk free space in human-readable format. du -sh /var/logShow disk usage of a directory.
less vs more: less scrolls both directions, preferred for large files. more is forward-only, older. locate is faster than find but requires updatedb to be current. stat gives full metadata including inode. file identifies type from content not extension. rmdir only removes EMPTY directories — use rm -rf for non-empty.
Hard Links vs Symbolic Links
Hard LinkPoints directly to data. Multiple filenames share the same inode. Data persists until ALL hard links removed. Cannot span filesystems or link to directories. Create: ln file hardlink Symbolic Link (Symlink)Points to another filename, not data. Has its own unique inode. Can cross filesystem boundaries and link to directories. Becomes dangling (broken) if target is deleted. Create: ln -s target linkname
Hard link = same inode, points to data. Symlink = different inode, points to a filename. Verify with ls -li — hard links show identical inode numbers. Data deleted only when hard link count reaches zero. Symlinks break when target is removed.
Command Chaining Operators
cmd1 | cmd2Pipe. stdout of cmd1 becomes stdin of cmd2. cmd1 ; cmd2Semicolon. Run in sequence — both always run regardless of success or failure. cmd1 && cmd2Logical AND. cmd2 runs ONLY if cmd1 succeeded (exit code 0). cmd1 || cmd2Logical OR. cmd2 runs ONLY if cmd1 failed (non-zero exit code). ! cmdNegates exit code. !! repeats last command. !ssh repeats last ssh command.
I/O Redirection
command > fileRedirect stdout to file. Overwrites existing content. command >> fileAppend stdout to file. Preserves existing content. command < fileRedirect stdin from a file. command 2> fileRedirect stderr to file. command 2>/dev/nullDiscard error output entirely. command &> fileRedirect both stdout and stderr to file. tee fileWrite to both screen AND a file simultaneously. ls | tee output.txt xargsBuild command lines from stdin. find . -name "*.log" | xargs rm
Permissions & ACLs (Exam Context)
Permissions are part of the XK0-006 Domain 3 objectives and tied closely to file management. Full reference included here as a companion to the file management commands above.

Every file has a 10-character permission string: -rwxr-xr--

-
Type
rwx
User (Owner)
r-x
Group
r--
Others

Type: - = file · d = directory · l = symlink · b = block device · c = character device

PermissionSymbolOctalOn FilesOn Directories
Readr4View file contentsList directory contents (needs execute too)
Writew2Edit/modify fileCreate, rename, delete files (needs execute too)
Executex1Run as program/scriptEnter directory and access contents
None-0No permissionNo permission
Octal: 7=rwx, 6=rw-, 5=r-x, 4=r--, 0=---. Common: 755 (executables/dirs), 644 (files), 600 (private). Read=4, Write=2, Execute=1.

chmod / chown

chmod 755 fileAbsolute mode: Numbers based. Owner=rwx, Group=r-x, Others=r-x. chmod u+x fileSymbolic mode: Letters based. Add execute for owner. chmod -R 755 dir/Apply recursively. chown user:group fileChange owner and group. -R for recursive.

Special Permissions

SUID (chmod u+s / 4755)Execute file with owner's permissions. Example: /usr/bin/passwd — lets users change their own password even though /etc/shadow is root-only. Shows as "s" in user execute bit. SGID (chmod g+s / 2755)Files: run with group's permissions. Directories: new files inherit directory's group — used for shared project dirs. Shows as "s" in group execute bit. Sticky Bit (chmod +t / 1777)Directories only. Only file owner, dir owner, or root can delete files. Prevents users deleting each other's files. Used on /tmp. Shows as "t" in others execute bit.

chattr / lsattr / ACLs

chattr +i fileSet immutable flag — cannot modify, delete, or rename even as root. lsattr fileList file attributes. Shows immutable and other flags. getfacl fileDisplay all ACL entries. ACLs allow multiple users/groups with different access levels. setfacl -m u:userA:rwx fileGrant userA rwx access via ACL. setfacl -b fileRemove ALL ACL entries. Reverts to standard permissions.
LESSON 05

Authoring Text Files

Domain 1 · Obj 1.5, 1.6
Text Editors

Vim — Three Modes

Command ModeDefault on open. Press ESC to return here from any other mode. Keyboard issues navigation commands. Insert ModePress i. Edits file content. a = after cursor, o = new line below, I = start of line, A = end of line. Execute ModePress :. File commands: :w save, :q quit, :wq save and quit, :q! quit without saving, :w newname save as.

Vim Command Mode Keys

gg / GTop / bottom of file 42GJump to line 42 ddDelete current line dDelete word at cursor /patternSearch. n = next, p = previous. Ctrl+w s/vSplit screen horizontal / vertical

nano — No Modes

Ctrl+OWrite Out (save as) Ctrl+SSave file Ctrl+XExit nano Ctrl+A / Ctrl+EStart / end of line Alt+\ / Alt+/Top / bottom of file Ctrl+N / Ctrl+PMove down / up one line

Gedit

GUI-based text editor. Pull-down menus. Requires graphical environment. Not available on headless servers.

Vim three modes: Command (default, ESC to return), Insert (i to enter, edits text), Execute (: to enter, file commands). :wq saves and quits. :q! quits without saving. nano has no modes — type directly, Ctrl shortcuts shown at the bottom. Both are tested on the exam.
Archiving & Compression
tarTape Archive. Bundles files into a tarball. Does NOT compress on its own. Options: -c create, -x extract, -t list, -v verbose, -f filename, -r append. tar -czvf archive.tar.gz dir/Create gzip-compressed archive. -z = gzip. Most common for backups. tar -xzvf archive.tar.gzExtract gzip-compressed archive. tar -cjvf archive.tar.bz2 dir/Create bzip2-compressed archive. -j = bzip2. Better compression, slower. gzip / gunzipCompress/decompress .gz files. Fast, good compression ratio. bzip2 / bunzip2Compress/decompress .bz2 files. Better compression than gzip, slower. xz / unxzCompress/decompress .xz files. Best compression, slowest. Used for large source packages. zip / unzipWindows-compatible archive format. Cross-platform transfers. cpioCopy In/Out. Directory tree backup. -o = backup, -i = restore, -v = verbose. ddLow-level data copy. Disk images, drive cloning, secure wiping, bootable USB. dd if=/dev/sda of=disk.img. if= input, of= output. No confirmation — use with care. rsyncRemote sync. Only transfers changed data (delta). rsync -avz src/ user@host:/dst/. SSH-encrypted. Best tool for ongoing incremental backups.
tar bundles but does NOT compress — add -z (gzip), -j (bzip2), or -J (xz) to compress in one step. Options: -c Create, -x eXtract, -t lisT, -v Verbose, -f File, -z gZip. dd is powerful but unforgiving — double-check if= and of= before running.
File Integrity Checking
md5sum fileGenerate MD5 hash (128-bit). Fast but cryptographically weak. Use for basic transfer integrity only. sha256sum fileGenerate SHA-256 hash. Current standard for integrity verification and security checks. sha512sum fileGenerate SHA-512 hash. Strongest standard. Preferred for security-sensitive files.
To verify a download: run the appropriate sum command on the file and compare to the hash the vendor published. Different hash = file was modified or corrupted. Hashing is one-way — you cannot reverse a hash. md5sum is not secure (collisions possible) — use sha256sum or sha512sum for security purposes.
LESSON 06

Package Management

Domain 1 · Obj 1.1
Red Hat Package Managers (RPM-based)
ToolEraKey CommandsNotes
rpmLegacyrpm -ivh pkg.rpm install · rpm -e pkg remove · rpm -qa list all · rpm -qi pkg infoLow-level. No dependency resolution. Manual dependency management.
yumOlderyum install pkg · yum remove pkg · yum update · yum list installedWraps rpm. Handles dependencies automatically. Being replaced by dnf.
dnfCurrentdnf install pkg · dnf remove pkg · dnf upgrade · dnf info pkgDefault for Fedora, RHEL 8+. Faster than yum. Better dependency handling.

RPM Repository Configuration

/etc/yum.repos.d/Directory containing .repo files. Each file defines a repository (URL, enabled status, GPG key). Both YUM and DNF read from this location. /etc/dnf/dnf.confGlobal DNF configuration file. yum repolistList all configured and enabled repositories.
Debian Package Managers (dpkg-based)
ToolKey CommandsNotes
dpkgdpkg -i pkg.deb install · dpkg -r pkg remove · dpkg -l list · dpkg -s pkg statusLow-level. No dependency resolution.
aptapt update refresh lists · apt upgrade update packages · apt install pkg · apt remove pkg · apt show pkgTwo-step update: apt update first (refreshes index), then apt upgrade (installs updates).

APT Repository Configuration

/etc/apt/sources.listMain repository list for Debian-based systems. Lists sources by URL, distribution, and component. /etc/apt/sources.list.d/Additional repository files. Third-party repos added here.
apt update does NOT install anything — it refreshes the local package index from repositories. apt upgrade installs the newer versions. Always run apt update before apt upgrade. This two-step process is a common exam question.
SUSE Package Manager
ZypperSUSE Linux package manager. zypper install pkg, zypper remove pkg, zypper update. Uses RPM packages. Know this exists for the exam — SUSE is a distinct family.
Language-Specific Package Managers
pip (Python)Installs Python packages. pip install package. Uses virtual environments to isolate dependencies (python3 -m venv env). cargo (Rust)Rust package manager. Handles builds and dependencies. cargo install package. npm (Node.js)Node Package Manager for JavaScript. npm install package. -g flag for global installation.
Compiling from Source
Download and unpack: tar -xf sourcecode.tar.gz
Change to directory: cd sourcecode/
Run configure: ./configure — checks dependencies and creates Makefile
Compile: make — executes instructions in Makefile, compiles code
Install: make install — copies binaries to system directories
GCC (GNU Compiler Collection) is the common Linux compiler. Compiling from source allows enabling/disabling specific features and transparency into what the code does. Package managers are preferred for standard software — compile from source only when packages aren't available or customization is needed.
Downloading Tools & Sandboxed Packages
wgetDownloads files from HTTP, HTTPS, and FTP. Can download recursively (mirror websites). CLI only. wget https://example.com/file.tar.gz. curlTransfers data using many protocols (HTTP, HTTPS, FTP, SFTP, SCP, LDAP, and more). Supports upload and sending. Used heavily in scripting and API testing. curl -O https://example.com/file. SnapsCanonical's containerized package format. Self-contained — includes all dependencies. Auto-update. Runs in a sandbox. Cross-distribution. FlatpakUniversal packaging system. Cross-distribution. Sandboxed. Pulls from "remotes" (repositories). Per-system or per-user installation. More isolation than traditional packages. AppImagePortable — runs without installation. Mounted as a drive. No root required. Limited sandboxing compared to Snaps and Flatpak.
wget vs curl: wget is better for recursive downloads. curl supports more protocols and upload capability. curl is preferred for scripting and API calls. wget is simpler for downloading files from the web.
LESSON 07

Storage Administration

Domain 1 · Obj 1.3
Partitioning Tools
fdisk /dev/sdbInteractive CLI partitioning for MBR disks. Menu-driven. p print, n new, d delete, w write (save). Use gdisk for GPT disks. gdisk /dev/sdbGPT-aware version of fdisk. Use for disks over 2TB or when GPT is required. parted /dev/sdbMore powerful partition manager. Supports both MBR and GPT. Can resize partitions. partprobeInform the OS kernel of partition table changes without rebooting. Run after modifying partition tables with fdisk/parted. lsblkList block devices in tree format. Shows device name, size, type, and mount point. Most useful first step for storage troubleshooting. blkidDisplay block device attributes including UUID, filesystem type, and label. UUIDs used in /etc/fstab for reliable mounting. growpart /dev/sda 1Grow a partition to fill available space after resizing a virtual disk.
Filesystem Tools
mkfs.ext4 /dev/sdb1Format partition with ext4. mkfs.xfs, mkfs.btrfs for other formats. fsck /dev/sda1Check and repair filesystem. Only run on unmounted filesystems. Can repair ext4 superblock corruption. Use xfs_repair for XFS. e2label /dev/sdb1 dataAssign a label to ext4 filesystem. resize2fs /dev/sdb1Resize ext4 filesystem after growing the partition. Grow: resize2fs /dev/sdb1. Shrink: resize2fs /dev/sdb1 10G. tune2fs /dev/sdb1Adjust ext4 filesystem parameters — reserved blocks, mount count, check interval. dumpe2fs /dev/sdb1Display ext4 superblock and block group information. xfs_repair /dev/sdb1Repair corrupt XFS filesystem. Must be unmounted. xfs_growfs /mountpointExpand XFS filesystem to fill available space. XFS can grow but NOT shrink — plan carefully.
Mounting & /etc/fstab
mount /dev/sdb1 /dataManually mount a partition to a directory (mount point). Temporary — does not survive reboot. umount /dataDetach a mounted filesystem. Note spelling: umount not "unmount." Cannot unmount if files are open. /etc/fstabFilesystem table. Defines filesystems to mount automatically at boot. Six fields: device (UUID preferred), mount point, filesystem type, options, dump, pass. /etc/mtabCurrently mounted filesystems. Updated dynamically by the kernel. /proc/mountsKernel's view of current mounts. More reliable than /etc/mtab. autofsAuto-mount daemon. Mounts filesystems on demand when accessed and unmounts after idle period. Efficient for NFS and network shares.

Common Mount Options (in /etc/fstab)

ro / rwRead-only / read-write. Default is rw. noexecPrevent execution of binaries on this filesystem. Security hardening for /tmp and data partitions. nosuidIgnore SUID/SGID bits. Prevents privilege escalation via SUID binaries on this partition. nodevDo not interpret character or block devices. Security hardening. noatimeDo not update access time on files when read. Significant performance improvement on SSDs and busy filesystems. nofailBoot continues even if this filesystem cannot be mounted. Important for non-critical mounts.

Network Mounts

NFS (Network File System)Share directories over the network. Linux-native. Configured in /etc/exports on the server. Port 2049 (TCP/UDP) and 111 (portmapper). Mount: mount server:/share /mnt. SMB / Samba (CIFS)Windows-compatible file sharing. Samba implements SMB on Linux. Mount: mount -t cifs //server/share /mnt. Used in mixed Windows/Linux environments.
Logical Volume Manager (LVM)

LVM is a flexible storage management layer that combines multiple physical disks into logical volumes that can span multiple disks and be resized without downtime.

LVM Layers (bottom to top)

Physical Volumes (PV) — Actual physical disks or partitions designated for LVM. Create: pvcreate /dev/sdb
Volume Group (VG) — Pool of storage aggregated from one or more PVs. Create: vgcreate vg_data /dev/sdb /dev/sdc
Logical Volumes (LV) — Flexible partitions carved from VG. Can span multiple disks. Create: lvcreate --name lv_data --size 500G vg_data
Filesystem — Format the LV and mount it like any regular partition: mkfs.ext4 /dev/vg_data/lv_data

LVM Commands Reference

Physical Volumes

pvcreateCreate PV pvdisplayShow PV details pvsSummary listing pvscanScan for PVs pvremoveRemove PV pvmoveMove data off PV pvresizeResize PV

Volume Groups

vgcreateCreate VG vgdisplayShow VG details vgsSummary listing vgextendAdd PV to VG vgremoveRemove VG vgscanScan for VGs vgexport/importMove VG between systems

Logical Volumes

lvcreateCreate LV lvdisplayShow LV details lvsSummary listing lvextend/resizeGrow LV lvremoveRemove LV lvchangeChange LV attributes
RAID & LUKS Encryption
mdadmSoftware RAID management tool on Linux. Create, manage, and monitor MD (multiple device) arrays. cat /proc/mdstat shows current RAID status. /proc/mdstatKernel's view of current software RAID status. Check here first when troubleshooting RAID issues. LUKSLinux Unified Key Setup. Standard for full-disk encryption on Linux. Managed with the cryptsetup command. Encrypts data at rest. Transparent to applications once unlocked. cryptsetupTool for managing LUKS-encrypted volumes. cryptsetup luksFormat /dev/sdb1 to encrypt. cryptsetup open /dev/sdb1 name to unlock.
Disk Quotas & Performance
Disk QuotasLimit storage use per user or group. Enable in /etc/fstab with usrquota and grpquota mount options. Soft limit = warning threshold. Hard limit = absolute maximum. Grace period between soft and hard limits. iostatReports CPU and I/O statistics. Transfers per second, blocks read/written. Use to identify storage bottlenecks. iopingReports I/O latency for storage devices. Measures IOPS performance. fioFlexible I/O tester. Benchmarks storage performance under various workload patterns.
LESSON 08

Devices, Processes & Kernel

Domain 1 · Obj 1.1, 1.2
Device Files (/dev)
Block DevicesProcess I/O in blocks. Can be mounted. Storage devices: /dev/sda (first HDD/SSD), /dev/sdb (second), /dev/sda1 (first partition of first disk), /dev/nvme0n1 (NVMe drive). Character DevicesProcess I/O one character at a time. Keyboard, mouse, serial ports, pseudo-terminals. /dev/nullBit bucket. Discard output by redirecting to /dev/null. command 2>/dev/null suppresses error output. /dev/zeroSource of null bytes. Used to create files filled with zeros. dd if=/dev/zero of=file bs=1M count=100 creates a 100MB file of zeros. /dev/urandomCryptographically secure pseudo-random number generator. Source of random data for key generation, secure wiping. Non-blocking. udevDevice manager for the Linux kernel. Automatically creates device files in /dev when hardware is detected. Manages device naming and permissions.
Hardware Information Tools
lscpuDisplay CPU info: cores, sockets, architecture, cache, virtualization support. lsmemDisplay memory configuration: size, state, block information. lspciList PCI devices: NICs, GPUs, storage controllers. -v for verbose detail. lsusbList USB devices and attributes. lshwComprehensive hardware lister. More detail than lspci/lsusb. Covers all hardware classes. -short for summary. hwinfoDetailed hardware info. Flags: --cpu, --storage, --usb, --netcard. dmidecodeReads DMI/SMBIOS data from firmware. System model, serial number, BIOS version, memory details. dmesgKernel ring buffer messages from boot. Hardware detection, driver errors, disk errors. dmesg | grep error to filter. ipmitoolIntelligent Platform Management Interface tool. Manages server hardware out-of-band. Monitor sensors, power cycle remotely, read system event logs, manage fans and power without OS. Used with IPMI/BMC on servers. lm_sensors / sensorsLinux monitoring sensors. Reads hardware temperature, voltage, fan speed from motherboard sensors. Run sensors-detect first to configure, then sensors to view readings. Essential for thermal monitoring. nvtopGPU process monitor. Like top but for GPUs. Shows GPU utilization, memory usage, temperature, and running processes. Used for GPU workload monitoring (AI/ML, rendering). cat /proc/cpuinfoCPU info dynamically from kernel. Cores, stepping, cache, flags. cat /proc/meminfoMemory info: total, free, available, cached, swap. cat /proc/<PID>/Per-process virtual filesystem. /proc/PID/status (process info), /proc/PID/fd (open file descriptors), /proc/PID/maps (memory mappings). Useful for deep process inspection.
Process Management
PID / PPIDPID = Process ID. Unique identifier for each running process. PID 1 = systemd. PPID = Parent Process ID. Every process has a parent — killed parent = orphaned children (usually adopted by init). Process StatesRunning (R): actively executing. Sleeping (S): waiting for resources. Blocked (D): waiting for I/O — cannot be interrupted. Stopped (T): paused. Zombie (Z): finished but parent hasn't released PID — shows as defunct.
ps auxShow all processes with user, CPU%, mem%, PID, command. -e all, -f full format, -p PID specific process. topDynamic real-time process monitor. Upper: system summary. Lower: process list sorted by CPU. Interactive: k kill, r renice, q quit. htopEnhanced top. Color-coded, scrollable, tree view. F6 sort, F9 kill. atopAdvanced system and process monitor. Records all activity at configurable intervals for historical analysis. Shows CPU, memory, disk, and network per process. Useful for post-incident analysis of what was happening at a specific time. mpstatMulti-processor statistics. Shows CPU utilization per core. mpstat -P ALL shows all CPUs. Useful for identifying CPU imbalance across cores. pidstatPer-process statistics including CPU, memory, I/O, and context switching. pidstat -u CPU, -r memory, -d disk I/O. More detailed than ps for resource tracking. straceTraces system calls and signals for a process. Tells you exactly what a program is asking the kernel to do. Powerful debugging tool: strace -p PID attaches to running process. strace command traces from start. High overhead — use carefully in production. pgrep sshFind PID of processes by name. pidof sshdFind PID of a running program. kill -9 PIDSend signal. -9 SIGKILL (force, no cleanup). -15 SIGTERM (graceful, default). -1 SIGHUP (reload config). -2 SIGINT (same as Ctrl+C). killall sshdKill all processes matching the name. pkill -u usernameKill processes by name pattern or user. pkill -u username kills all processes owned by that user. More flexible than killall. nohup command &Run a command that continues after logout. "No Hang Up" — immune to SIGHUP signal. Output redirected to nohup.out by default. Use when you need a long-running job to survive a disconnected SSH session. pstreeDisplay processes in tree showing parent/child relationships. lsofList Open Files. Shows which files/sockets each process has open. lsof -u username, lsof /dev/sda1. sarSystem Activity Reporter. Collects CPU, memory, I/O, network statistics for performance analysis. uptimeUptime, logged-in users, and load averages for 1, 5, and 15 minutes.
Job Control & Process Priority
command &Start process in background. Frees the terminal prompt. Ctrl+ZPause (suspend) a foreground job. Moves to background in stopped state. Ctrl+CTerminate the foreground process (sends SIGINT). Ctrl+DSend end-of-file. Logs out of current shell session. jobsList current user's background and stopped jobs with job numbers. fg %1Bring job number 1 to foreground. bg %1Resume stopped job number 1 in background. nice -n 10 commandLaunch process with specified priority. Range: -20 (highest) to 19 (lowest). Default = 0. Only root can set negative (high priority) values. renice 10 -p PIDChange priority of a running process.
Memory & Swap
free -hDisplay available physical RAM and swap space. -h = human-readable. High available memory = healthy. Low available = potential performance issues. vmstatVirtual memory statistics. Shows swapping activity, I/O, CPU. High swap usage = system needs more RAM. mkswap /dev/sdb2Initialize a partition as swap space. swapon /dev/sdb2Activate swap space. Add to /etc/fstab for persistence. swapoff /dev/sdb2Deactivate swap space.
OOM (Out of Memory) Killer: when the system runs out of both RAM and swap, the kernel's OOM killer terminates processes to reclaim memory. Processes are scored by memory usage and importance — highest score gets killed first.
Kernel Modules
lsmodList currently loaded kernel modules, their sizes, and what's using them. modinfo moduleDisplay detailed information about a specific module: filename, description, author, version, parameters, dependencies. insmod module.koInsert a module into the running kernel. Does NOT handle dependencies automatically. rmmod moduleRemove a module from the running kernel. Fails if module is in use. modprobe moduleLoad module AND its dependencies automatically. Preferred over insmod. -r to unload. depmodRebuild module dependency database. Run after adding new modules. sysctl -aDisplay all kernel parameters. sysctl -w parameter=value to change. sysctl -p to load from /etc/sysctl.conf. uname -rDisplay kernel version (release). uname -a shows all information including architecture and hostname.
lsmod = shows what's loaded NOW. modinfo = details about ONE module file. insmod = loads module, no dependency handling. modprobe = loads module WITH dependencies (preferred). rmmod = removes one module. depmod = rebuilds dependency database.
LESSON 09

Services & Daemons

Domain 2 · Obj 2.2
systemd vs SysVinit
FeaturesystemdSysVinit
Init systemCurrent standard (PID 1)Legacy, largely replaced
Boot speedParallel service startupSequential — slower
ConfigurationUnit files (.service, .target)Init scripts in /etc/init.d/
RunlevelsTargets (graphical.target, multi-user.target)Runlevels 0–6
Main toolsystemctlservice, chkconfig
Loggingjournald (binary)rsyslog (text)

SysVinit Runlevels (legacy reference)

Runlevel 0Halt / shut down Runlevel 1Single user mode — root only, minimal services. Recovery mode. Runlevel 3Multi-user CLI (no GUI). Most common for servers. Runlevel 5Multi-user GUI. Desktop systems. Runlevel 6Reboot
systemctl Commands
systemctl status sshdCheck status of a service. Shows active/inactive, PID, recent logs. systemctl start sshdStart a service immediately (runtime only). systemctl stop sshdStop a service immediately. systemctl restart sshdStop then start. Interrupts connections. Use reload for zero-downtime config reload if supported. systemctl reload sshdReload configuration without restarting. Connections maintained. systemctl enable sshdEnable service to start at boot. Creates symlink in target directory. systemctl disable sshdPrevent service from starting at boot. systemctl mask sshdCompletely prevent service from starting (even manually). Stronger than disable. systemctl get-defaultShow the default boot target. systemctl set-defaultChange default boot target. systemctl set-default multi-user.target = boot to CLI. systemctl list-unitsList all active units and their status.

Additional systemd Utilities

systemd-analyzeAnalyze boot time. systemd-analyze blame shows time each service took to start — same as systemd-blame. systemd-analyze critical-chain shows the slowest chain of services. systemd-blameSame as systemd-analyze blame — lists all services sorted by startup time. Used to identify slow-starting services that delay boot. timedatectlDisplay and set system time, date, timezone, and NTP sync status. timedatectl set-timezone America/New_York. timedatectl set-ntp true enables automatic NTP sync. resolvectlQuery systemd-resolved for DNS information. resolvectl query example.com resolves a hostname. resolvectl status shows current DNS configuration per interface. hostnamectlDisplay and set system hostname. hostnamectl set-hostname server01. Persists after reboot. daemon-reloadsystemctl daemon-reload — reload systemd manager configuration. Required after creating or modifying unit files. Does NOT restart services — just makes systemd aware of the changed configuration. systemctl edit serviceOpen a drop-in override file for a service unit. Edit without modifying the original package-provided unit file. Changes survive package updates. systemctl unmask serviceRemove a mask (the strongest disable) from a service, allowing it to be started again.
Log Management — logrotate
logrotateAutomatically rotates, compresses, and removes old log files. Prevents /var/log from filling up disk. Configured in /etc/logrotate.conf and /etc/logrotate.d/ (per-application configs). Runs daily via cron or systemd timer. Rotation Optionsdaily/weekly/monthly — rotation frequency. rotate N — keep N old log files. compress — gzip old logs. missingok — no error if log file missing. notifempty — skip rotation if file is empty. postrotate — run a command after rotation (e.g., reload the service).
systemd Unit File Types
.serviceDefines a background service/daemon. Contains [Unit], [Service], and [Install] sections. Configuration: dependencies, ExecStart command, restart behavior. .targetGroups of units representing system states. multi-user.target (CLI), graphical.target (GUI), network-online.target, rescue.target. .timerSchedules actions time-based. Modern replacement for cron. OnCalendar=daily for daily execution. Paired with a matching .service unit. .mountManages mount points. Automatically mounts filesystems. Generated from /etc/fstab entries. .socketSocket-based activation. Service only starts when a connection comes in on the defined socket. Efficient for infrequently used services.
Logging — rsyslog & journald
rsyslogTraditional syslog daemon. Logs to text files in /var/log/. Can forward logs to remote servers (port 514/UDP). Critical for SLA compliance, security auditing, and troubleshooting. journaldsystemd's journal service. Stores logs in binary format. Query with journalctl. Faster searching than text files. journalctl -u sshdView logs for a specific service. -f = follow. -n 50 = last 50 lines. --since "1 hour ago" = time-filtered.

Syslog Severity Levels (0–7, 0 = most critical)

LevelNameMeaning
0emergSystem is unusable. Broadcast to all users.
1alertImmediate action required.
2critCritical conditions. Hardware failures.
3errError conditions.
4warningWarning — may indicate future error.
5noticeNormal but significant condition.
6infoInformational messages.
7debugDebug-level messages. Very verbose.
Mnemonic for syslog severities (0→7): Every Awesome Cat Eventually Wins Nice Indoor Dinners (Emergency, Alert, Critical, Error, Warning, Notice, Info, Debug). Or: Evil Aliens Crash Earth While Nerds Investigate Damage.

Key Log File Locations

/var/log/syslogGeneral system logs — Debian/Ubuntu /var/log/messagesGeneral system logs — RHEL/Fedora /var/log/auth.logAuthentication logs — Debian/Ubuntu /var/log/secureAuthentication logs — RHEL/Fedora /var/log/yum.logYUM package management activity /var/log/httpd/Apache web server access and error logs
Task Scheduling
cronSchedule recurring tasks. Edit with crontab -e. Five-field format: minute hour day month weekday command. * = any. Example: 0 2 * * * /scripts/backup.sh runs at 2am daily. Requires system to be running at the scheduled time. crontab -lList current user's cron jobs. anacronRuns jobs that were missed if the system was powered off or asleep. Unlike cron, it does not require the system to be running at a specific time — it runs jobs after the system comes back up if the job was missed. Configured in /etc/anacrontab. Used for daily/weekly/monthly maintenance tasks on systems that aren't always on. atSchedule one-time tasks. Interactive: at 4pm then enter commands, Ctrl+D to finish. Non-interactive: echo "command" | at 4pm.

Crontab Field Format

minute
0–59
hour
0–23
day
1–31
month
1–12
weekday
0–7 (0,7=Sun)
Key Service Configuration Files & Ports
ServiceConfig FilePortNotes
SSH (sshd)/etc/ssh/sshd_config22/TCPDisable root login, use key-based auth. Restart required after config changes.
NTP (ntpd/chrony)/etc/ntp.conf or /etc/chrony.conf123/UDPTime synchronization. chrony better for intermittently connected systems.
NFS/etc/exports2049/TCP+UDP + 111showmount -e [IP] to list exports. Clients mount with standard mount command.
Apache (httpd)/etc/httpd/conf/httpd.conf80/TCP (443 HTTPS)DocumentRoot = /var/www/html. systemctl start httpd.
CUPS (printing)/etc/cups/cupsd.conf631/TCPWeb-based admin at http://localhost:631. lpr = print. lpq = queue.
rsyslog/etc/rsyslog.conf514/UDPLog forwarding. Remote logging for centralized SIEM.
LESSON 10

Network Configuration

Domain 1 · Obj 1.4
Network Configuration Tools
ip (modern)Primary network configuration tool. Replaces ifconfig. Subcommands: ip addr (show IPs), ip link (show interfaces), ip route (show routing table). Changes are temporary unless added to config files. ifconfig (legacy)Older network configuration. Still found on many systems. Being replaced by ip. ifconfig eth0 shows interface details. NetworkManagerNetwork management service. Three interfaces: nmcli (CLI), nmtui (text UI — blue screen), nmgui (graphical). Default on most modern distributions. nmcli commandsnmcli general status — overview. nmcli connection show — list connections. nmcli con up eth0 — activate. nmcli con down eth0 — deactivate. nmcli device status — device state. nmtuiText-based NetworkManager UI. Blue screen interface. Edit connections, activate/deactivate, set hostname. No graphical environment required. NetplanUbuntu's declarative network configuration tool. YAML-based. Files in /etc/netplan/. Apply changes: netplan apply. Test changes: netplan try (auto-reverts). Check status: netplan status. ethtoolManage NIC driver settings. Check and configure speed, duplex, Wake-on-LAN, link status.
Network Configuration Files
/etc/hostsLocal hostname-to-IP mapping. Checked before DNS (usually). Format: 192.168.2.42 server01 server01.example.com /etc/resolv.confDNS server configuration. nameserver 192.168.2.10 — specifies DNS server IP addresses. /etc/nsswitch.confName Service Switch. Controls lookup order for hostname resolution, user info, groups. Example: hosts: files dns = check /etc/hosts first, then DNS. /etc/sysconfig/network-scripts/Per-NIC configuration files on RHEL/CentOS/Fedora. ifcfg-eth0, etc. hostnamectlDisplay and set system hostname. hostnamectl set-hostname server01. Persists after reboot.
SSH Key-Based Authentication
Generate key pair: ssh-keygen — creates private key (~/.ssh/id_rsa) and public key (~/.ssh/id_rsa.pub).
Copy public key to server: ssh-copy-id user@192.168.2.200 — appends public key to server's ~/.ssh/authorized_keys.
Test: ssh user@192.168.2.200 — should authenticate without password using private key.

SSH config file: /etc/ssh/sshd_config. Key options: Port (default 22), PermitRootLogin no, PasswordAuthentication no (force key-based only). Restart sshd after any config change.

Network Diagnostic Tools
ping / ping6Test ICMP connectivity. Linux pings continuously — Ctrl+C to stop. ping -c 4 for exactly 4 packets. tracerouteTrace packet path to destination showing each hop and RTT. Uses UDP by default on Linux (-I for ICMP). tracepathSimilar to traceroute but doesn't require root privileges. mtrMy Trace Route. Combines ping + traceroute in real-time. Shows packet loss and latency per hop. Best tool for diagnosing path-specific issues. nslookup domainQuery DNS records. Basic tool for name resolution testing. dig @server domainDNS query with more detail than nslookup. Can specify a specific DNS server. dig example.com MX for mail records. host domainSimple DNS lookup. Quick and clean output. whois domainDomain registration and ownership information. resolvectl queryQuery name resolution via systemd-resolved. resolvectl query example.com arp -aDisplay ARP cache — IP to MAC address mappings known to the local system. netstat / ssShow active connections and listening ports. ss -tuln = TCP/UDP listening ports numeric. ss is the modern replacement for netstat. nmapNetwork scanner. Discover hosts, open ports, OS, services. nmap -sn 192.168.2.0/24 host discovery only. iftopReal-time bandwidth utilization per connection. Visual display of network traffic. iperf3Test maximum network throughput between two hosts. Requires iperf running on both ends. nc (netcat)Networking Swiss army knife. Test connectivity, transfer data, create listeners. nc -zv host port to test if port is open. scp user@host:/src /dstSecure copy over SSH. Encrypted file transfer. sftp user@hostInteractive secure FTP session over SSH. rsync -avz src/ user@host:/dst/Efficient sync/backup — only transfers changed data.
LESSON 11

Network Security & Firewalls

Domain 3 · Obj 3.3
Linux Firewall Technologies
ToolTypeDistributionNotes
iptablesLegacy firewall coreAllTables → Chains → Rules. Still widely used. Being replaced by nftables.
nftablesModern firewall coreAllReplaces iptables. Unified IPv4/IPv6. Simplified syntax. Better performance.
firewalldManagement interfaceRHEL/FedoraManages nftables/iptables with zones. firewall-cmd tool.
UFWManagement interfaceUbuntu/DebianUncomplicated Firewall. Simplified interface for nftables/iptables.
iptables and nftables are the underlying kernel firewall engines. firewalld (RHEL) and UFW (Ubuntu) are management interfaces that sit on top of the engine. For the exam: firewalld uses zones, UFW uses simple allow/deny rules — both ultimately configure nftables.
firewalld (RHEL/Fedora)
firewall-cmd --get-zonesList all available zones (drop, block, public, external, dmz, work, home, internal, trusted). firewall-cmd --zone=public --list-allShow all rules in the public zone. firewall-cmd --zone=public --add-service=httpAllow HTTP (port 80) in public zone. Add --permanent to persist after reboot. firewall-cmd --zone=public --remove-port=21/tcpBlock FTP port in public zone. firewall-cmd --reloadApply permanent changes. Required after adding --permanent rules.

Zones define trust levels. Public zone = least trusted (internet-facing). Trusted zone = most trusted (fully trusted network). Assign NICs to appropriate zones.

Network Monitoring Tools
tcpdumpCLI packet capture. Captures and displays raw network traffic. tcpdump -i eth0 port 53 captures DNS on eth0. -w file.pcap saves to file for Wireshark analysis. Most common installed on Linux servers. WiresharkGUI packet analyzer. Decodes protocols, filters by many criteria. Opens .pcap files from tcpdump. Gold standard for deep packet analysis. Nmap / ZenmapNetwork scanner. Host discovery, port scanning, OS fingerprinting, service version detection. Zenmap = GUI for nmap. netstat / ssShow listening ports and active connections. ss -tuln = TCP/UDP listening ports. lsof -i also shows active network sockets. mtrReal-time path analysis combining ping and traceroute. Shows per-hop packet loss and latency over time.
LESSON 12

Cryptography & Identity Management

Domain 3 · Obj 3.1, 3.2
Encryption Concepts
Symmetric EncryptionOne key encrypts and decrypts. Fast. Key distribution is the challenge. Examples: AES, 3DES. Used for bulk data encryption. Asymmetric EncryptionPublic/private key pair. Public key encrypts (or verifies), private key decrypts (or signs). Solves key distribution problem. Slower. Examples: RSA, ECC. Used for SSH, TLS, digital signatures. Public Key EncryptionEncrypted with public key → decrypted with private key. Goal: confidentiality. Anyone can encrypt, only private key holder can decrypt. Use case: secure messaging, e-commerce (TLS). Private Key SigningSigned with private key → verified with public key. Goal: authentication and non-repudiation. Only private key holder could have signed. Use case: digital signatures, code signing, certificate validation. HashingOne-way function. Fixed-length digest from any input. Cannot be reversed. Same input always produces same output. Used for integrity verification and password storage.
PKI & Certificates
PKIPublic Key Infrastructure. System of CAs, software, and services that manages digital certificate lifecycle: Enrollment → Issue → Use → Expiration/Revocation. Certificate Authority (CA)Trusted entity that issues and signs digital certificates. Validates identity before issuing. Third-party CAs (DigiCert, Let's Encrypt) trusted publicly. Self-signed CAs for internal use. TLS (Transport Layer Security)Relies on digital certificates to provide confidentiality, integrity, and authenticity for network connections. HTTPS = HTTP over TLS. SSL is the older, deprecated version. md5sum / sha#sumGenerate hash values for integrity checking. Compare before and after transfer to detect changes. md5sum weak — use sha256sum or sha512sum for security.
Identity & Access Management
SSSDSystem Security Services Daemon. Connects local Linux system to remote authentication services (LDAP, Active Directory, Kerberos). Enables domain authentication on Linux. LDAPLightweight Directory Access Protocol. Common centralized authentication service. Port 389 (plain), 636 (TLS). Used to authenticate users against Active Directory from Linux. PAM (Pluggable Authentication Module)Flexible authentication framework. Applications don't hard-code auth methods — they use PAM, which is configured separately. Config files: /etc/pam.d/ (one per service: sshd, login, sudo). Supports: local passwords, LDAP, Kerberos, smart cards, OTP, password complexity rules, login restrictions, lockout policies. MFA (Multi-Factor Authentication)Requires two or more different factor types. Implemented via PAM modules (pam_google_authenticator for TOTP, pam_u2f for hardware keys).
Server Hardening
  • Remove unneeded software and services — every installed package and running service is an attack surface.
  • Update the OS and applications — patch promptly. Unpatched systems are the most common attack vector.
  • Apply principle of least privilege — users and processes get only what they need.
  • Disable root SSH login — set PermitRootLogin no in /etc/ssh/sshd_config.
  • Use key-based SSH authentication — disable password auth when possible (PasswordAuthentication no).
  • Configure host-based firewall — firewalld or UFW to restrict inbound access to only required ports.
  • Enable SELinux or AppArmor — mandatory access control provides additional protection beyond standard permissions.
  • Audit logging — ensure all authentication events and privilege escalations are logged.
SELinux — Security-Enhanced Linux

SELinux implements Mandatory Access Control (MAC) at the kernel level. Even root cannot override SELinux policy. Default on RHEL/CentOS/Fedora/Rocky.

SELinux States

EnforcingActive and enforcing policy. Denies and logs policy violations. Production setting. PermissiveActive but NOT enforcing. Logs violations but does not block. Used for troubleshooting and policy development. DisabledSELinux completely off. Not recommended — requires reboot to re-enable with full relabeling.

SELinux Commands

getenforceDisplay current SELinux mode (Enforcing/Permissive/Disabled). setenforce 0/1Temporarily switch to Permissive (0) or Enforcing (1). Does NOT survive reboot — change /etc/selinux/config for persistent change. ls -ZDisplay SELinux security context labels on files. Format: user:role:type:level. chcon -t type fileChange SELinux file context temporarily. Does not survive relabeling. Use semanage for permanent changes. restorecon -Rv /pathRestore file contexts to their default policy values. Use after moving files or after chcon. -R recursive. semanage fcontextPermanently manage file context mappings. semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?" then run restorecon. getsebool -aList all SELinux booleans and their current state. setsebool -P bool on/offSet SELinux boolean. -P makes it persistent across reboots. audit2allowAnalyze audit log denials and generate a custom SELinux policy module to allow the denied action. Used for policy development when SELinux is blocking a legitimate operation. sealertAnalyzes SELinux audit messages and provides human-readable explanations with suggested fixes. Most useful troubleshooting tool for SELinux denials.
SELinux troubleshooting workflow: sealert -a /var/log/audit/audit.log → read the suggested fix → apply it (setsebool, semanage, restorecon). Never just set SELinux to Permissive/Disabled as a permanent fix — that defeats the whole point. Permissive is for diagnostics only.
Additional Security Controls
umaskDefault file-creation permission mask. Applied every time a new file or directory is created. Common values: 022 (files=644, dirs=755), 027 (files=640, dirs=750). Calculate: maximum permissions minus umask. Set in /etc/profile or ~/.bashrc for persistence. chrootChanges the apparent root directory for a process and its children. Creates an isolated environment — the process cannot see files outside the chroot jail. Used to isolate services (FTP, DNS), test software, and limit damage from compromised services. fail2banMonitors log files for failed authentication attempts and automatically bans offending IPs using firewall rules. Default: 5 failures in 10 minutes = 10-minute ban on SSH. Configured in /etc/fail2ban/jail.conf or jail.local. Effective against brute-force attacks. GPG / GPG2GNU Privacy Guard. Implements OpenPGP encryption and signing standard. Used to verify package signatures from repositories. gpg --verify file.sig file verifies a signature. Package managers automatically verify GPG signatures on packages before installing. Secure Boot (UEFI)UEFI firmware feature that verifies each bootloader and kernel module is digitally signed by a trusted key before loading. Prevents bootkits and unauthorized OS loading. Supported by all major Linux distributions via shim bootloader signed by Microsoft. SSH TunnelingSSH can forward network connections securely. Local forwarding (ssh -L local_port:remote_host:remote_port) tunnels a local port through SSH to a remote destination. Remote forwarding (ssh -R) exposes a local port on the remote server. AllowUsers / AllowGroupsSSH daemon config options restricting which users/groups can log in via SSH. Set in /etc/ssh/sshd_config. Whitelist approach — only listed users/groups can connect. More restrictive than DenyUsers/DenyGroups. Disable X ForwardingX11Forwarding no in sshd_config prevents forwarding of graphical applications over SSH. Reduces attack surface on servers that don't need GUI forwarding. Remove unnecessary SUIDFind all SUID binaries: find / -perm -4000 -type f. Review each — remove SUID from any that don't require it. SUID binaries are a common privilege escalation target. Disable unused filesystemsPrevent loading of rarely-used or unnecessary filesystem modules (cramfs, freevxfs, jffs2, hfs, etc.) via /etc/modprobe.d/. Reduces attack surface.
System Auditing
auditdLinux audit daemon. Records security-relevant system calls and file access to /var/log/audit/audit.log. Required for many compliance frameworks (PCI DSS, HIPAA). Runs as a service: systemctl enable auditd. audit.rulesConfiguration file for auditd rules (/etc/audit/audit.rules or /etc/audit/rules.d/). Define what to audit: file access, system calls, user actions. Example: -w /etc/passwd -p wa -k user-modify watches /etc/passwd for writes. auditctlReal-time management of audit rules. auditctl -l list rules. auditctl -w /etc/sudoers -p wa add watch. ausearchSearch the audit log. ausearch -k user-modify finds events with that key. ausearch -ui UID by user ID. Winbind / SambaWinbind allows Linux systems to authenticate against Windows Active Directory domains. Part of the Samba suite. Enables Linux systems to join AD domains and use AD user/group accounts. Alternative to SSSD for AD integration.
LESSON 13

Shell Scripting

Domain 4 · Obj 4.1
Script Basics
Shebang (#!)First line of every script. Specifies the interpreter. #!/bin/bash for Bash. #!/usr/bin/python3 for Python. NOT a comment despite starting with #. Comments# character marks a comment. Ignored by the interpreter. Document purpose, parameters, and examples. Execute PermissionScripts need execute permission: chmod +x script.sh. Run from current directory: ./script.sh. If in $PATH, run by name: script.sh. Exit Codes0 = success. Any non-zero = failure. Check with echo $? immediately after command. exit 1 to terminate with failure code.
Variables & Environment
VAR="value"Define a variable. No spaces around =. Access with $VAR or ${VAR}. echo $VARPrint variable value to screen. export VARMake variable available to child processes (environment variable). read VARNAMERead user input into a variable. Interactive scripts use this for prompts.

Common Environment Variables

$PATHDirectories searched for executable files. Colon-separated. echo $PATH to view. $HOMECurrent user's home directory path. $USERCurrent logged-in username. $SHELLPath to current shell binary (/bin/bash). $HOSTNAMESystem hostname. $PS1Shell prompt format string. Customize the command prompt appearance. $DISPLAYX display identifier. Used by GUI applications to know which display to use.

Shell Config Files (loaded at login/startup)

~/.bashrcRun for each new interactive non-login shell. Aliases, functions, prompt customization. ~/.bash_profileRun once at login. Sets environment variables. Usually sources .bashrc. ~/.profilePOSIX-compatible login shell config. Used when .bash_profile doesn't exist.
Input/Output Redirection
command > fileRedirect stdout to file. Overwrites existing file. command >> fileAppend stdout to file. Preserves existing content. command < fileRedirect stdin from file (feed file as input to command). command 2> fileRedirect stderr (file descriptor 2) to file. command 2>/dev/nullDiscard error output entirely. command &> fileRedirect both stdout and stderr to file. cmd1 | cmd2Pipe. Send stdout of cmd1 as stdin to cmd2. Chains commands together. tee fileRead from stdin, write to both stdout (screen) AND a file simultaneously. ls | tee output.txt xargsBuild and execute command lines from stdin. find . -name "*.log" | xargs rm deletes all found log files. Here Doc (<<)Feed multi-line input to a command. cat << EOF ... EOF. The delimiter (EOF) marks the end of the input block.
Conditionals & Loops

if / if-else / case

if [ condition ]; then
  # code if true
else
  # code if false
fi

case $VAR in
  "value1") echo "one" ;;
  "value2") echo "two" ;;
  *) echo "default" ;;
esac

Loops

# while: runs while true
while [ condition ]; do
  # code
done

# until: runs until true
until [ condition ]; do
  # code
done

# for: fixed iterations
for i in 1 2 3; do
  echo $i
done

Comparison Operators

-eq / -neEqual / Not equal (numeric) -lt / -gtLess than / Greater than (numeric) == / !=Equal / Not equal (string) -z / -nString is empty / String is not empty -f / -dFile exists / Directory exists && / ||Logical AND / Logical OR
Useful Script Commands
echo "text"Print text to screen. Used for output and debugging. printf "fmt" argsFormatted output. More control than echo. printf "%-10s %5d\n" "item" 42 — supports field widths and types. Does NOT add newline automatically. tr 'a-z' 'A-Z'Translate or delete characters. echo "hello" | tr 'a-z' 'A-Z' converts to uppercase. tr -d '\r' removes carriage returns (Windows to Unix conversion). bcBasic calculator. Handles floating-point math in scripts (Bash cannot natively). echo "scale=2; 10/3" | bc outputs 3.33. read VARRead user input into variable. exec commandReplace current shell with the specified command. The current process is replaced. source fileExecute file in current shell (variables and functions remain). Also written as . file. alias ll='ls -la'Create command shortcut. Define in ~/.bashrc for persistence. test / [ ]Evaluate conditions. Exit code 0 = true, 1 = false. test -f file or [ -f file ]. echo $?Display exit code of the most recently executed command. sed 's/old/new/g'Stream editor. Search and replace. -i = in-place edit. Powerful for bulk text manipulation in scripts. awk '{print $2}'Pattern scanning. Extract specific fields, perform calculations, conditional processing on text.
LESSON 14

Infrastructure as Code & DevOps

Domain 4 · Obj 4.2, 4.3
Automation vs Orchestration
AutomationAccomplishes a single task without human intervention. Script or engine-driven. Example: a backup script scheduled to run nightly. OrchestrationAccomplishes a series of automated tasks without human intervention. Coordinates multiple automation steps into a complete workflow. Example: provisioning a new server — create VM, configure OS, deploy application, copy data, notify users. Configuration ManagementEnsures systems are configured consistently to match defined security and performance requirements. Different from provisioning (initial deployment) — ongoing enforcement of desired state.
Orchestration & IaC Tools
ToolAgentLanguageTypeNotes
AnsibleAgentlessYAMLConfig mgmt / OrchestrationUses SSH. Easiest to learn. Most widely adopted. Cross-platform. Playbooks = task lists.
PuppetAgentless (also agent)Puppet DSL (Ruby-like)Config mgmtEnterprise and open source. Uses modules. Declarative — defines desired state.
ChefAgent-basedRubyConfig mgmtWorkstation → Server → Nodes. Recipes and cookbooks. More complex setup.
SaltStackBothPython / YAMLConfig mgmtAgent (minion) or agentless. Fast — uses ZeroMQ message bus.
TerraformAgentlessHCL (Terraform)Infrastructure provisioningCloud-focused. Provisions VMs, networks, storage. Works with AWS, Azure, GCP, and more.
Ansible = agentless, YAML, SSH, easiest. Chef = agent-based, Ruby. Puppet = module-based. Terraform = infrastructure provisioning (not configuration management). All enforce desired state — run them again and they bring the system back to the defined configuration.
Git Version Control
GitFree, open-source distributed version control system. Tracks changes in files. Supports non-linear development (branching). Critical for IaC, scripts, and configuration file management. RepositoryDirectory tracked by Git. Contains all project files and their complete history. Local (on workstation) or remote (GitHub, GitLab, Gitea).
git clone URLCopy an existing repository to local workstation. git add fileStage files for the next commit (designate for tracking). git commit -m "message"Save staged changes to local repository with a descriptive message. git statusCheck status of files — staged, unstaged, untracked changes. git pushUpload local commits to remote repository. git pullDownload and merge remote changes to local repository. git logView commit history — author, date, message, hash. git branchList, create, or delete branches. Feature branches isolate work until ready to merge.
DevOps & CI/CD
DevOpsCultural and technical movement combining software development and IT operations. Goals: shorter development cycles, continuous delivery, cultural change toward shared ownership. CI/CDContinuous Integration (automated testing on every code commit) + Continuous Deployment/Delivery (automated deployment to production). Reduces manual errors and speeds delivery. IaC BenefitsConsistent configurations. Less configuration drift. Standardized security baselines. Rapid change implementation. Version control for infrastructure. Fewer human errors. Works for both on-premises and cloud. JSON vs YAMLJSON: uses brackets and braces, strict syntax. YAML: uses indentation (whitespace), more human-readable. Both used for config files. Ansible and Kubernetes use YAML. APIs commonly return JSON.
LESSON 15

Containers & Virtualization

Domain 1 · Obj 1.7
VMs vs Containers
FeatureVirtual MachinesContainers
IsolationFull OS isolationProcess-level isolation (shares host kernel)
OSFull guest OS per VMShares host OS kernel — no guest OS
SizeGBs (full OS image)MBs (app + dependencies only)
Startup timeMinutesSeconds
OverheadHigh (full OS per VM)Low
PortabilityModerateHigh — run anywhere Docker runs
SecurityStronger isolationWeaker — kernel compromise = all containers affected
PersistenceFull persistent stateStateless by default — data lost on stop
Container Runtimes
DockerMost widely known container platform. Uses containerd as runtime backend. Docker CLI → containerd → runC. Standard for development and CI/CD. PodmanDaemonless container engine. Drop-in replacement for Docker CLI — same commands. Does NOT require a background daemon. Rootless by default (can run containers as non-root). Preferred for RHEL/Fedora environments. podman run, podman ps work identically to docker equivalents. containerdIndustry-standard container runtime. Manages the complete container lifecycle — image pull/push, storage, networking, execution. Used by Kubernetes and Docker. OCI-compliant. runCLow-level OCI-compliant container runtime. The actual tool that creates and runs containers. Used by containerd and other higher-level runtimes. Implements the OCI runtime specification directly.
Runtime stack: Docker CLI / Podman → containerd → runC. Each layer abstracts the one below. Podman = daemonless, rootless, Docker-compatible. Key difference: Docker requires a root daemon, Podman does not.
Docker/Podman Commands
docker pull imageDownload an image from a registry (Docker Hub by default). docker imagesList locally available images. docker run imageCreate and start a container. -d detached. -p 8080:80 port mapping (host:container). -v /host:/container volume mount. -e VAR=value environment variable. --name myapp name the container. docker exec -it name bashExecute a command inside a running container. -it = interactive terminal. Useful for debugging inside containers. docker logs nameRead container stdout/stderr logs. -f follow in real-time. docker inspect nameDetailed JSON info about a container or image. Network settings, volumes, environment variables, configuration. docker ps -aList all containers including stopped. docker ps alone shows only running. docker stop / rm nameStop then remove a container. docker rm -f name force-removes a running container. docker build -t name .Build image from Dockerfile in current directory. docker system pruneRemove all stopped containers, unused networks, dangling images, and build cache. Frees disk space.
Dockerfile Directives
FROMBase image for the build. Every Dockerfile starts with FROM. Example: FROM ubuntu:22.04 RUNExecute a command during build. Used to install packages, create directories, etc. Each RUN creates a new image layer. COPY / ADDCopy files from host into the image. ADD also supports URLs and auto-extracts archives. Prefer COPY for clarity. CMDDefault command to run when container starts. Can be overridden at runtime. If ENTRYPOINT is set, CMD provides default arguments to it. ENTRYPOINTFixed command that always runs when the container starts. Cannot be easily overridden (unlike CMD). Use for containers designed to run a single application. USERSet the user for subsequent RUN, CMD, and ENTRYPOINT instructions. Best practice: create a non-root user and switch to it before CMD. EXPOSEDocuments which port the container listens on. Informational — does NOT actually publish the port (use -p at runtime for that). ENVSet environment variables in the image that persist into the running container. Image LayersEach Dockerfile instruction creates an immutable layer. Layers are cached — unchanged layers are reused on rebuild. Order matters: put frequently-changed instructions (COPY source code) last to maximize cache hits. Image TagsLabels for specific versions of an image. nginx:1.24 = specific version. nginx:latest = most recent. Always pin to specific tags in production — latest changes unpredictably.
Container Volumes & Networks
Bind MountMount a specific host directory path into the container. -v /host/path:/container/path. Direct host filesystem access. Named VolumeDocker-managed storage. docker volume create mydata then -v mydata:/container/path. Data persists independently of containers. Preferred for production. SELinux Volume ContextOn SELinux systems, add :z (shared) or :Z (private) to volume mounts: -v /host:/container:Z. Required for SELinux to allow container access to host directories. Overlay FilesystemDefault storage driver for containers. Layers read-only image layers under a writable container layer. Changes only written to the top writable layer — base image unchanged. Privileged vs UnprivilegedUnprivileged (default): container has limited capabilities. Cannot access host devices or most kernel features. Privileged (--privileged): container gets nearly all host capabilities. Security risk — use only when absolutely necessary (e.g., running Docker inside Docker).

Container Network Types

BridgeDefault. Isolated virtual network on the host. Containers communicate via the bridge. Host accesses via port mapping (-p). Most common for single-host deployments. HostContainer uses host's network stack directly — no isolation. Highest network performance. Container ports are directly on host ports. Security concern — no network namespace isolation. NoneNo network access at all. Completely isolated. Used for batch processing or security-sensitive containers that should never send network traffic. OverlayMulti-host networking. Enables containers on different Docker hosts to communicate directly. Used in Docker Swarm and Kubernetes clusters. macvlanAssigns a real MAC address to the container. Container appears as a physical device on the network. Useful for migrating VMs to containers where direct network presence is needed. ipvlanSimilar to macvlan but containers share the host MAC address — only IP differs. Better for environments where MAC proliferation is a concern.
Kubernetes
KubernetesContainer orchestration platform. Automates deployment, scaling, networking, and management of containerized applications across clusters of machines. PodSmallest deployable unit in Kubernetes. Contains one or more containers that share networking and storage. Containers in a pod communicate via localhost. SidecarSecondary container within a pod providing supporting functionality (logging, security proxy, data synchronization) to the main application container.
Linux Virtualization
KVMKernel-based Virtual Machine. Type 1 hypervisor built into the Linux kernel. Full hardware virtualization. High performance. Foundation of most Linux virtualization and cloud platforms (OpenStack, AWS). QEMUQuick Emulator. Hardware emulator often paired with KVM. QEMU provides device emulation; KVM provides near-native performance via hardware virtualization extensions (Intel VT-x, AMD-V). libvirtVirtualization management library and toolkit. Provides unified interface for managing KVM/QEMU, Xen, and other hypervisors. Used by virsh and virt-manager. virshCLI shell for managing VMs via libvirt. virsh list --all show all VMs. virsh start/shutdown/suspend/resume vmname. virsh snapshot-create-as create snapshot. virt-installCLI tool for creating new virtual machines. virt-managerGNOME-based GUI for managing KVM/QEMU VMs. Visual equivalent of VMware Workstation. VirtIOParavirtualized device framework. Instead of emulating real hardware, VirtIO provides an optimized virtual device interface the guest OS communicates with directly. Significantly faster than full emulation for storage (virtio-blk) and networking (virtio-net). Requires VirtIO drivers in the guest OS. Paravirtualized DriversGuest OS has knowledge that it is virtualized and uses optimized drivers (like VirtIO) instead of emulated hardware drivers. Better performance than full emulation. Requires driver support in the guest. Nested VirtualizationRunning a hypervisor inside a VM. Enables running VMs inside VMs. Used for testing hypervisors and running cloud development environments. Must be enabled at the host hypervisor level.

VM Network Types

BridgedVM appears as a physical device on the same network as the host. Gets its own IP from the network DHCP server. Other devices on the network can communicate directly with the VM. NATVM shares the host's IP address. Host performs NAT for VM traffic. VM can access internet but external devices cannot initiate connections to VM. Most common default for desktop VMs. Host-only / IsolatedVM communicates only with the host and other VMs on the same host-only network. No internet access. Used for isolated lab environments and testing. RoutedVM has its own IP subnet. Host routes traffic between VM network and external networks. VMs can be reached from outside but require routing configuration. OpenVM connects directly to a physical network interface on the host without isolation. Similar to bridged but no MAC filtering. Used in specific advanced networking scenarios.

VM Disk Image Operations

qemu-img convertConvert between disk image formats. qemu-img convert -f vmdk -O qcow2 disk.vmdk disk.qcow2 converts VMware to QEMU format. qemu-img resizeResize a disk image. qemu-img resize disk.qcow2 +20G adds 20GB. Then grow partition and filesystem inside the VM. qemu-img infoDisplay image properties: format, virtual size, actual disk usage, snapshots.
LESSON 16

Troubleshooting

Domain 5 · 22%
Monitoring Concepts
SLA (Service Level Agreement)Contract defining expected service levels. Uptime guarantees, response time commitments, financial remedies for unmet targets. Between service provider and customer. SLI (Service Level Indicator)Actual measured metric. The real data. Examples: current uptime percentage, average response time, error rate. What you measure to determine if you're meeting your SLO. SLO (Service Level Objective)Target value for an SLI. Internal goal. Example: "99.9% uptime" or "response time under 200ms for 95% of requests." SLO is what you aim for; SLA is what you're contractually committed to. Thresholds & AlertsPredefined trigger points that generate alerts when SLIs breach acceptable ranges. Configure in monitoring tools. Log AggregationCollecting logs from multiple systems to a central platform. Enables correlation, searching, and analysis across the entire infrastructure. Tools: Elasticsearch/Logstash/Kibana (ELK), Grafana Loki, Splunk. WebhooksHTTP callbacks triggered by events. Monitoring systems use webhooks to notify external systems (Slack, PagerDuty, ticketing) when alerts fire. Health ChecksAutomated probes verifying service availability and functionality. HTTP health endpoints, TCP connection tests, custom scripts. Used by load balancers and orchestration platforms to route traffic away from unhealthy instances. SNMPSimple Network Management Protocol. Polls network devices and servers for metrics. SNMP traps = unsolicited alerts from devices. MIBs (Management Information Bases) define available metrics.
File Comparison Tools
diff file1 file2Compare two files line by line. Shows which lines differ. Output: < = only in file1, > = only in file2. -u unified format (used in patches). Essential for config management and troubleshooting configuration drift. sdiff file1 file2Side-by-side diff. Displays both files in columns with differences highlighted. Easier to read than standard diff for manual comparison. -s only shows differing lines.
CompTIA Troubleshooting Methodology
Identify the problem. Question users, check log files, review recent changes. Determine scope — one system or many? Recreate the problem if possible.
Establish a theory of probable cause. Start with the simplest explanation. Identify common elements if multiple systems affected.
Test the theory. Verify or disprove the theory. If confirmed → move to step 4. If not → establish new theory or escalate.
Establish a plan of action. Avoid service interruptions. Schedule maintenance window if needed. Notify affected users.
Implement the solution or escalate. Make ONE change at a time. Test after each change. Escalate if beyond your expertise.
Verify full system functionality. Confirm fix worked. Determine root cause. Implement preventive measures.
Document findings, actions, and outcomes. Throughout the process — not just at the end. Add to knowledge base.
Common Hardware & Storage Problems
SMART FailuresSelf-Monitoring Analysis and Reporting Technology predicts drive failures. Check with smartctl -a /dev/sda. Warning signs: reallocated sectors, pending sectors, uncorrectable errors. Backup immediately and replace drive. Memory ErrorsSystem crashes, kernel panics. Test RAM with memtest86+. Check: recent hardware changes, heat, seating. Run memory dump analysis. Zombie ProcessesProcess finished but parent hasn't released PID. Shows as Z in ps output. Kill the parent process to clean up. ps aux | grep Z High CPUTop 5 CPU processes: ps aux --sort=-%cpu | head -6. Kill runaway processes. Check: bugs, misconfigurations, untuned settings. Filesystem CorruptionCaused by improper shutdown or hardware failure. Repair: fsck /dev/sda1 (unmounted only). xfs_repair /dev/sdb1 for XFS. Kernel PanicLinux equivalent of BSOD. System cannot safely recover. Causes: corrupted kernel, missing root filesystem, hardware failure, incompatible modules. Check dmesg logs after recovery. Inode ExhaustionFilesystem runs out of inodes before running out of disk space. Caused by millions of tiny files (email queues, temp files, cache). Symptoms: "No space left on device" but df -h shows free space. Diagnose: df -i shows inode usage. Fix: delete many small files or reformat with more inodes. Filesystem Full (OS)/ or /var full causes widespread service failures (logs can't write, daemons can't create temp files). Check: df -h. Find large files: du -sh /* | sort -rh | head. Clean logs, old kernels, core dumps. Quota IssuesUser or group has exceeded disk quota. Symptoms: user cannot write files despite available disk space. Check: quota -u username or repquota /filesystem. Increase quota or ask user to delete files. Partition Not WritableMounted read-only. Common after filesystem error — kernel remounts read-only to prevent further damage. Check /proc/mounts. Fix: remount rw after fsck repairs the filesystem. GRUB MisconfigurationSystem fails to boot or boots wrong OS. Symptoms: GRUB prompt, "error: unknown filesystem", missing menu entries. Fix from live media: mount root filesystem, chroot, reinstall GRUB (grub2-install) and regenerate config (grub2-mkconfig). Missing/Disabled DriversHardware not detected or not functional. Check: dmesg | grep -i error, lspci -v for missing drivers. Load with modprobe or install driver package. Killed ProcessesProcess terminated unexpectedly. Check: OOM killer (dmesg | grep -i killed), audit log (ausearch), systemd journal. OOM kills = system needed memory. Fix: add RAM, tune OOM score, reduce memory usage. Segmentation FaultProcess accessed memory it shouldn't. Causes: bugs in code, corrupted binary, wrong library version, hardware memory errors. Check: dmesg, core dump, strace output.
OS & Software Troubleshooting
Cannot Log InCheck: account exists (/etc/passwd), password set (/etc/shadow), account not locked (passwd -S username), password not expired (chage -l user). Reset with passwd command as root. Cannot Access FilesCheck permissions (ls -la), group membership (id user), ACLs (getfacl file). SELinux may also be blocking — check sealert or audit.log. Service FailureCheck status: systemctl status servicename. View logs: journalctl -u servicename. Check service dependencies. Verify config syntax. Port conflicts: ss -tlnp. PATH MisconfigurationCommands not found or wrong version executing. Check: echo $PATH. Which binary: which command. Add to PATH: export PATH=$PATH:/new/dir. Make persistent in ~/.bashrc. Common issue after software installs in non-standard locations. Unresponsive ProcessProcess in D state (uninterruptible sleep) — usually waiting on I/O. Cannot be killed with SIGKILL. Usually resolves when I/O completes or fails. Check: ps aux | grep " D ". Causes: NFS hang, disk failure, kernel bug. Package Dependency IssuesPackage cannot install due to missing or conflicting dependencies. Fix: apt --fix-broken install (Debian) or dnf install --best (RHEL). For conflicts: remove conflicting package first. Systemd Unit FailuresService fails to start. Check: systemctl status unit for recent output. journalctl -xe -u unit for detailed logs. Common causes: missing binary, permission denied, port already in use, syntax error in unit file. File IntegrityRPM: rpm -V package verifies files against package database. Tripwire/AIDE: IDS tools that hash system files and alert on changes. Clock SkewKerberos fails if clock skew >5 minutes. Sync: timedatectl set-ntp true. Check: timedatectl status. Memory LeaksProcess continuously consuming more memory without releasing it. Symptoms: gradually increasing memory use in top/htop, growing RSS over time. Resolve by restarting the process. Report bug to developers. Use Valgrind for debugging.
Performance Troubleshooting — Common Symptoms
Swapping / ThrashingSystem using swap heavily — RAM exhausted. Symptoms: extremely slow performance, high disk I/O. Check: vmstat 1 (watch si/so columns), free -h. Fix: add RAM, kill memory hogs, tune application heap sizes. High Load AverageLoad average consistently above number of CPU cores = system is overloaded. Check: uptime or top header. May be CPU-bound or I/O-bound — distinguish with iostat and top. High Context SwitchingMany processes competing for CPU. Wastes CPU cycles on switching overhead. Check with vmstat 1 (cs column) or pidstat -w. High I/O WaitCPU idle while waiting for disk I/O. Shows as high %wa in top/iostat. Indicates storage bottleneck. Check: iostat -x for device utilization and await times. Solutions: faster storage, I/O scheduler tuning, caching. High Disk LatencyStorage operations taking longer than expected. Check with iostat -x (await column). Causes: failing drive (check SMART), RAID degradation, overloaded SAN, filesystem fragmentation (HDD only). CPU BottleneckCPU consistently at 100%. Identify: top → look for process consuming most CPU. Causes: inefficient code, insufficient CPUs, runaway process. Solutions: optimize code, add vCPUs, nice/renice processes. Blocked ProcessesProcesses in D state waiting for I/O that never completes. Usually storage-related. ps aux | awk '$8=="D"'. Often caused by NFS mount hangs or failing disks. Memory LeaksProcess continuously consuming more RAM without releasing it. RSS grows continuously in top. Restart the process as workaround. Report to developers. Slow Application ResponseStart with: CPU, memory, disk I/O, and network checks. Then move to application-level: database query performance, connection pool exhaustion, external dependency latency. Slow Remote StorageNFS or SMB mounts responding slowly. Check network path (mtr), NFS server load, mount options (noatime helps), network bandwidth (iperf3). Packet Drops / JitterNetwork performance degradation. Packet drops: ip -s link show eth0 (check RX errors/drops). Jitter: use mtr to see per-hop latency variance. Causes: buffer overflow, hardware issue, oversubscribed links.
Network Troubleshooting — Common Issues
Misconfigured FirewallService unreachable despite being running. Check: ss -tlnp (is service listening?). firewall-cmd --list-all or iptables -L (is port open?). Test locally first — if local works but remote doesn't = firewall issue. DHCP IssuesClient gets APIPA (169.254.x.x) or wrong IP. Check: DHCP server running? journalctl -u dhcpd. Scope exhausted? Client can reach DHCP server? Check DHCP relay if across subnets. DNS IssuesName resolution fails. Can ping IP but not hostname = DNS problem. Check /etc/resolv.conf (correct nameserver?). Test: dig @8.8.8.8 example.com (bypass local DNS). Check nsswitch.conf resolution order. MTU MismatchPackets fragmented or dropped. Common with VPNs and tunnels. Symptoms: small packets work, large packets fail. Check: ip link show (MTU field). Test: ping -M do -s 1400 host. Fix: set MTU lower on interface or VPN config. NIC Bonding IssuesBonded NIC not failover or load balancing correctly. Check bonding mode, member link states, LACP negotiation. cat /proc/net/bonding/bond0 shows status. MAC SpoofingUnauthorized device using a legitimate MAC address. Causes IP conflicts and authentication bypass. Detect with ARP monitoring, port security on switches. IP ConflictsTwo devices with the same IP. Symptoms: intermittent connectivity. Check: arp -n — same IP mapping to different MACs. Use arping to identify the conflicting device. Dual-Stack Issues (IPv4/IPv6)IPv4 works but IPv6 doesn't (or vice versa). Check both: ping vs ping6, ip -4 addr vs ip -6 addr. DNS may return AAAA records for IPv6-only or IPv4-only services causing failures. Link Downip link show shows DOWN state. Physical: check cable, SFP, switch port. Virtual: check NIC driver, VM network config. Bring up: ip link set eth0 up. Link Negotiation IssuesSpeed/duplex mismatch. Symptoms: slow speeds, high errors, runts. Check: ethtool eth0 (Speed and Duplex fields). Fix: force both ends to matching settings or enable auto-negotiation on both.
Check physical: link state with ip link show. Look for UP/DOWN status. Check cable and NIC.
Verify IP config: ip addr. Confirm correct IP, subnet mask, and gateway. Check for APIPA address (169.254.x.x = DHCP failure).
Test local gateway: ping [gateway IP]. If fails = local network issue. If succeeds = upstream problem.
Test remote IP: ping 8.8.8.8. If fails with gateway success = routing/ISP issue.
Test DNS: ping google.com. Failure with successful IP ping = DNS issue. Diagnose with dig or nslookup.
Trace path: traceroute / mtr to identify where packets are dropping.
Capture traffic: tcpdump or Wireshark for deep packet analysis if above steps are inconclusive.
Ping by IP succeeds but ping by hostname fails = DNS issue, not a network problem. The network works — the name resolution doesn't. Use dig, nslookup, or host to diagnose DNS. Check /etc/resolv.conf for correct DNS server entries.
Key Troubleshooting Commands — Quick Reference
journalctl -xeView systemd journal with explanations and most recent entries. Best first step for service failures. dmesg | tail -50View recent kernel messages. Hardware detection, driver errors, disk errors. systemctl --failedList all failed services at a glance. df -hCheck disk space. Full disk causes many service failures. free -hCheck memory. Low available memory degrades performance. top / htopReal-time CPU and memory per process. Identify resource hogs. ss -tulnShow listening TCP/UDP ports. Verify services are listening on expected ports. ip addrVerify IP address configuration. cat /proc/mdstatCheck software RAID status. Look for degraded arrays. rpm -V packageVerify package file integrity (RHEL/Fedora).