LFCS Certification Cheat Sheet 2026

The 30 highest-yield LFCS Certification facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. In the context of `cron`, what does the special string `@reboot` mean in a crontab entry? → The command runs once at system startup
2. Which command shows which installed RPM packages have files that have been modified since installation? → rpm -Va
3. When using `zypper` on SUSE/openSUSE, which command searches for packages by name? → zypper search
4. A logical volume was accidentally removed. Its VG metadata backup exists. Which command attempts recovery? → vgcfgrestore -f /etc/lvm/backup/vg0 vg0
5. Which input must be given to ifconfig in order to turn on a network interface that was previously inactive? → up
6. A user's account is locked using 'passwd -l username'. Which character appears at the start of the password hash in /etc/shadow to indicate this? → !
7. Which command creates a thin pool named tp0 of 20G within vg0? → lvcreate -L 20G -T vg0/tp0
8. What does the 'Listen' directive in /etc/apache2/ports.conf or httpd.conf control? → Which IP addresses and ports Apache binds to
9. Which command shows the overall boot time broken down into firmware, loader, kernel, and userspace phases? → systemd-analyze time
10. In which file do you persistently add custom kernel parameters on systemd-based systems using GRUB 2? → /etc/default/grub
11. In nftables, what command adds a new table named 'mytable' with the inet family? → nft add table inet mytable
12. What does `dnf module enable :` do? → Activates a specific module stream so its packages become available for installation
13. In a bash script, how do you correctly access the third positional argument passed to the script? → $3
14. Which cron time field position controls the day of the week? → The 5th field (0=Sunday through 6=Saturday)
15. What happens to background jobs when you close a terminal without using `nohup` or `disown`? → They receive SIGHUP and typically terminate
16. A timer unit `backup.timer` is set to activate `backup.service`. Where must the timer unit be enabled for it to fire at boot? → The timer unit itself must be enabled and started with systemctl enable --now backup.timer
17. A user reports they cannot run sudo. After verifying their account exists, what should you check first? → Whether they are a member of the sudo or wheel group
18. Which xinetd/inetd replacement is commonly used in modern Linux to manage on-demand TCP services? → systemd socket activation
19. A Samba share should be writable by members of the 'staff' group. Which smb.conf directive sets this group? → write list = @staff
20. Which of the following is a key advantage of using a high-level package manager like `dnf` or `apt` compared to a low-level tool like `rpm` or `dpkg`? → They automatically resolve and install required software dependencies from repositories.
21. How do you stream new journal entries in real time, similar to `tail -f`? → journalctl -f
22. A process runs as UID 1001. A file has owner UID 1001 and permissions '---rwxrwx'. Can the owner read the file? → No — the kernel checks only the owner bits, which are '---'
23. What does the parameter expansion `${#myvar}` return in bash? → The length in characters of the string stored in myvar
24. After chrooting into /sysroot to reset the root password on an SELinux system, which command ensures file contexts are relabeled on next boot? → touch /.autorelabel
25. Which dpkg command extracts the contents of a .deb file without installing it? → dpkg-deb -x package.deb /target
26. Where should application-specific logrotate configuration files be placed? → /etc/logrotate.d/
27. A user 'alice' has UID 1005. After deleting her account with userdel, a new user 'bob' is created and happens to receive UID 1005. What risk does this create? → Bob will own files previously owned by Alice that were not reassigned
28. A user's umask is 027. What permissions will a newly created regular file have? → 640
29. Which rsyslog rule forwards all facility/severity combinations to a remote UDP syslog server at 192.168.1.1? → *.* @192.168.1.1
30. What does `systemctl isolate rescue.target` do? → Immediately switches to rescue.target, stopping all units not required by it