LPIC-1 101-500 Cheat Sheet

System Architecture (101)

13.3% of exam
Hardware Discovery Boot Sequence Runlevels & Targets dmesg vs journalctl -b

Installation & Packages (102)

20% of exam
Disk Layout & Boot Shared Libraries Debian Packages RPM Packages Virtualization Guest

GNU & Unix Commands (103)

43.3% of exam
Shell Basics Text Filters File Management Streams & Redirects Process Control Regex & grep vi Editor

Devices & Filesystems (104)

23.3% of exam
Partitioning Filesystem Integrity Mounting Permissions & Links FHS Layout

Quick Facts

Exam 101-500
Credential LPIC-1 (Part 1 of 2)
Time 90 min
Pass 500 of 800
Level Junior admin
Format MC + fill-in-blank
Blueprint v5.0 (Oct 2018)

Runlevel Map SY

0=off 1=rescue 2-4=multi 5=GUI 6=reboot
0: poweroff.target 1: rescue.target 2-4: multi-user.target 5: graphical.target 6: reboot.target

dmesg vs journalctl -b SY

dmesg

Kernel messages only
Lost at reboot

journalctl -b

Kernel plus service messages
Persistent if storage configured
Kernel buffer vs system journal

Boot & Target Picker SY

Switch target right now → systemctl isolate ( No reboot needed )
Change target for future boots → systemctl set-default ( Takes effect next boot )
Check the current default → systemctl get-default ( Read-only, no change )
Need single-user maintenance mode → rescue.target ( Runlevel 1 )
Need graphical login screen → graphical.target ( Runlevel 5 )
Need multi-user, no GUI → multi-user.target ( Runlevel 2, 3, or 4 )
See log for current boot → journalctl -b ( Current boot; -b -1 previous )
See kernel-only ring buffer → dmesg ( Lost at every reboot )

Hardware Discovery SY

lspci Lists PCI bus devices
lsusb Lists USB devices
lsmod Lists loaded kernel modules
modprobe Loads or removes a module
/proc Kernel and process info
/sys Kernel objects, tied to udev
udevadm Queries device manager events
lscpu Shows CPU architecture details

Boot Sequence SY

BIOS/UEFI Firmware initializes hardware first
Bootloader Loads kernel and initramfs
initramfs Temporary early-boot root filesystem
init/systemd First process, PID 1
journalctl -b Shows current boot's journal
journalctl -b -1 Shows previous boot (persistent only)
dmesg Kernel ring buffer only

Runlevels & Targets SY

Runlevel 0 poweroff.target
Runlevel 1 rescue.target, single-user mode
Runlevel 2-4 multi-user.target, no GUI
Runlevel 5 graphical.target
Runlevel 6 reboot.target
systemctl isolate Switch target now
systemctl set-default Change future boot target
systemctl get-default Show current default target
telinit Legacy SysVinit runlevel switch

RPM Query Flags IN

qa all, -qf owner, -qi info, -ql files
qa: every installed package -qf: file's owning package -qi: package info summary -ql: package's file list

dpkg vs apt IN

dpkg -i

Installs local .deb file
No dependency resolution

apt install

Resolves dependencies
Downloads from repositories
Low-level vs high-level tool

Package Manager Picker IN

Debian/Ubuntu install package → apt install ( Resolves deps )
Debian/Ubuntu find file owner → dpkg -S ( Maps file to package )
Have a local .deb file → dpkg -i ( No dependency resolution )
RHEL/Fedora install package → dnf install ( Resolves deps )
Older RHEL/CentOS system → yum install ( Resolves deps )
SUSE install package → zypper install ( Resolves deps )
Have a local .rpm file → rpm -Uvh ( No dependency resolution )
Find file's owning package → rpm -qf ( RPM systems only )

Disk Layout & Boot IN

/boot Holds kernel and initramfs
ESP UEFI boot partition, FAT
swap Extends RAM, stores hibernation image
LVM Logical volumes across disks
grub-install Writes boot code once
grub-mkconfig Regenerates grub.cfg boot menu
update-grub Debian wrapper for grub-mkconfig
/etc/default/grub Source file grub-mkconfig reads

grub-install vs grub-mkconfig IN

grub-install

Writes boot code
Run once per disk

grub-mkconfig

Regenerates grub.cfg
Run after config changes
Install vs configure

Shared Libraries IN

ldd Lists a binary's needed libraries
ldconfig Rebuilds the dynamic linker cache
/etc/ld.so.conf Library search path config
/etc/ld.so.cache Cached library path lookup
LD_LIBRARY_PATH Extra runtime library search path
ldconfig -p Lists the cached library map
/etc/ld.so.conf.d/ Drop-in library config directory

Debian Packages IN

dpkg -i Installs a local .deb file
dpkg -L Lists files owned by package
dpkg -S Finds package owning a file
dpkg -l Lists all installed packages
apt-get install Resolves and installs dependencies
apt-cache search Searches downloaded package metadata
apt-cache show Shows package details, no install
/etc/apt/sources.list Debian repository source list

RPM Packages IN

rpm -qa Lists every installed package
rpm -qf Finds package owning a file
rpm -qi Shows installed package info
rpm -Uvh Installs or upgrades local RPM
dnf install Resolves deps on Fedora/RHEL
yum install Resolves deps on older RHEL
zypper install Resolves deps on SUSE
/etc/yum.repos.d/ RPM repository config directory

Virtualization Guest IN

cloud-init Sets hostname, keys, users on boot
dmidecode Reads hypervisor SMBIOS/DMI data
VM guest Runs under a hypervisor
Container Shares the host kernel

Quoting Strength GN

Single blocks all, double still expands
Single quotes: fully literal Double quotes: expands $vars Backslash: escapes one character

cp -r vs cp -a GN

cp -r

Recursive copy
New ownership
Current timestamp
umask permissions

cp -a

Archive mode
Preserves ownership
Preserves timestamps
Preserves links/xattrs
Recursive vs archive copy

Shell Basics GN

Single quotes No expansion at all
Double quotes Expands $var and $(cmd)
export VAR=value Child processes inherit it
VAR=value Shell-only, not inherited
type Checks alias, builtin, function, file
which Searches $PATH executables only
history Lists past shell commands
alias Names a shortcut command

Grep Family GN

egrep is grep -E; fgrep is grep -F
E: extended regular expressions -F: fixed literal string match egrep = deprecated grep -E fgrep = deprecated grep -F

rm -r vs rm -rf GN

rm -r

Recursive delete
Prompts on protected files

rm -rf

Recursive delete
Never prompts, ignores errors
Interactive vs forced delete

Text Filters GN

cut -f Extracts delimited fields
cut -c Extracts character positions
sort -u Sorts and removes duplicates
uniq Removes adjacent duplicates only
sed (no g flag) Replaces first match per line
sed (g flag) Replaces every match per line
tr Translates or deletes characters
wc -l Counts lines in input

sort -u vs uniq GN

sort -u

Sorts input first
Removes all duplicates

uniq

Needs pre-sorted input
Removes adjacent duplicates only
Global vs adjacent dedupe

File Management GN

cp -r Recursive copy, new metadata
cp -a Archive copy, preserves all
rm -r Recursive delete, prompts sometimes
rm -rf Recursive delete, never prompts
find -name Quote the pattern always
tar -czf Creates a gzip archive
tar -xzf Extracts a gzip archive
dd Copies data block by block

Streams & Redirects GN

Overwrite (>) Truncates then writes output
Append (>>) Appends output, keeps existing
Redirect stderr (2>&1) Stderr follows stdout's target
Redirect both (&>) Sends stdout and stderr together
Pipe (|) Sends output to next command
tee Writes to file and stdout
xargs Builds arguments from stdin lines

Process Control GN

ps aux BSD style, shows %CPU/%MEM
ps -ef UNIX style, always shows PPID
kill Sends SIGTERM (15) by default
kill -9 Sends SIGKILL, cannot be caught
nice Sets niceness at launch, +10
renice Changes priority of a running PID
nohup Ignores SIGHUP, doesn't background it
jobs / fg / bg Lists, foregrounds, backgrounds jobs

Regex & grep GN

Anchor (^) Matches start of line
Anchor ($) Matches end of line
grep -E Extended regex, same as egrep
grep -F Fixed string, same as fgrep
grep -i Case-insensitive pattern matching
grep -v Inverts the match, excludes lines
Class ([^abc]) Matches any char not listed
regex(7) Linux manual page for regex

vi Editor GN

Normal mode Default mode for navigation
Insert mode Enter with i, a, or o
Command-line mode Enter with : for ex commands
dd Deletes (cuts) the current line
yy Yanks (copies) the current line
p Pastes buffer after cursor line
:wq Saves changes, then quits
ZZ Saves if changed, then quits
:q! Quits, discarding unsaved changes

umask Bit Math DE

022 masks bits: files 644, dirs 755
File base is 666 Dir base is 777 022 gives 644 and 755

MBR vs GPT DE

MBR

4 primary partitions max
2 TiB address limit

GPT

128 partitions by default
UEFI-standard partition scheme
Legacy vs modern partition table

Filesystem/Mount Picker DE

Need UUID for fstab entry → blkid ( Prints type, UUID, label )
See device and partition tree → lsblk -f ( Adds type, label, UUID )
Filesystem stuck read-only → mount -o remount,rw ( No unmount required )
Check an ext4 filesystem → e2fsck ( Unmount first, or read-only )
Need to shrink a filesystem → ext4 + resize2fs ( XFS cannot shrink at all )
Need to grow XFS online → xfs_growfs ( Grow only, no shrink )
Copy directory, keep everything → cp -a ( Owner, time, links preserved )
Delete with zero prompts → rm -rf ( Silent on missing files )

Partitioning DE

MBR 4 primary partitions, 2TiB limit
GPT 128 partitions default, UEFI standard
fdisk Classic MBR/GPT partition tool
parted Script-friendly partitioning tool
mkfs.ext4 Formats an ext4 filesystem
mkfs.xfs Formats an XFS filesystem
mkswap Formats a swap partition

hard link vs symbolic link DE

Hard link (ln)

Shares the original inode
Cannot cross filesystems

Symlink (ln -s)

Separate inode holding a path
Can cross filesystems
Same inode vs path pointer

Filesystem Integrity DE

e2fsck Repairs ext filesystems, unmounted
du Sums allocated disk blocks
df Reads free space from superblock
tune2fs Tunes ext filesystem parameters
XFS resize Can only grow, never shrink
ext4 resize Can grow or shrink (resize2fs)

Mounting DE

/etc/fstab Device, mount point, type, options
mount -o remount,rw Switches to read-write, no unmount
blkid Shows type, UUID, and label
lsblk -f Shows device tree plus UUID
UUID Stable id, use it in fstab

Permissions & Links DE

umask 022 Files get 644, dirs 755
setuid Runs as the file owner
setgid New files inherit dir group
sticky bit File/dir owner or root deletes
ln Hard link, shares an inode
ln -s Symlink, can cross filesystems
chmod 4755 Sets setuid plus rwxr-xr-x

FHS Layout DE

/etc Static host configuration files
/var Variable runtime data, logs
/usr Installed programs, shared data
/opt Optional third-party applications
/tmp Temporary files, cleared often
find Searches the live filesystem
locate Queries a prebuilt index

Common Traps

Runlevel numbers

Runlevels 2, 3, 4 = multi-user ≠ Only 0, 1, 5, 6 differ

Copy recursive vs archive

cp -r resets ownership/time ≠ cp -a preserves everything

which vs type

which checks $PATH only ≠ type also finds builtins

kill default vs kill -9

Default sends SIGTERM (15) ≠ -9 sends SIGKILL, uncatchable

XFS vs ext4 shrink

XFS can only grow ≠ ext4 can grow or shrink

Single vs double quotes

Single blocks all expansion ≠ Double still expands $vars

MBR primary partition limit

4 primary partitions max ≠ 3 primary plus 1 extended

Last Minute

1. 60 questions in 90 minutes
2. Pass score is 500 of 800
3. 60 weight points, one per question
4. 103 GNU/Unix commands is largest
5. Runlevels 2, 3, 4 = multi-user
6. cp -a preserves owner, time, links
7. umask 022 gives files 644
8. umask 022 gives dirs 755
9. kill -9 cannot be caught
10. XFS filesystems can only grow
11. Run grub-mkconfig after editing GRUB
12. Fix broken deps: apt --fix-broken install
13. Retake wait: 7 then 14 days
14. 2-year lock after passing exam

LPIC-1 Linux Administrator — Exam 101 (101-500)

Practice Questions 141 questions Study Guide 47 topics Cheat Sheet 147 facts Flashcards 50 cards Free CE Podcast