Your FREE CompTIA Linux+ Flashcards 2026 – 250+ Cards

Filesystem Hierarchy Standard — the standard layout of Linux directories under root (/).

The root of the entire Linux filesystem; everything mounts beneath it.

System-wide configuration files (text), e.g. /etc/passwd, /etc/fstab.

Variable data that changes at runtime — logs (/var/log), spools, caches, mail.

Regular users' home directories (e.g. /home/alice).

Installed programs, libraries, and documentation (largely read-only).

Essential user and system binaries (often symlinked into /usr).

Temporary files; world-writable with the sticky bit; often cleared on reboot.

Device files representing hardware and pseudo-devices (e.g. /dev/sda, /dev/null).

A virtual filesystem exposing live per-process and kernel data from memory.

A virtual filesystem exposing kernel device and subsystem information.

Holds the kernel, initramfs, and bootloader (GRUB) files needed to start the system.

Optional, self-contained third-party application packages.

The directory where system and service log files are written.

A directory where a filesystem is attached so its contents become accessible.

Firmware that starts the boot process; UEFI reads the EFI System Partition, legacy BIOS reads the MBR.

The GRand Unified Bootloader v2 — loads the Linux kernel and initramfs at boot.

A temporary in-memory root filesystem holding drivers needed to mount the real root.

The core of the OS that manages hardware, memory, processes, and system calls.

Firmware (UEFI/BIOS) → GRUB2 → kernel + initramfs → systemd (PID 1) → target → login.

The modern init system and service manager; runs as PID 1 and supervises units.

The first user-space process started by the kernel — systemd on most distributions.

A systemd-managed resource: a service, socket, mount, timer, or target.

A grouping of units defining a system state; replaces SysV runlevels.

The systemd target for multi-user, command-line (non-graphical) operation.

The systemd target that starts the GUI on top of multi-user.

The command to control systemd: start, stop, restart, enable, disable, status.

Configure a service to start automatically at boot (does not start it now).

Start a service immediately (does not survive a reboot unless also enabled).

Enable a service at boot AND start it right now in one command.

Show a service's current state, PID, and recent log lines.

Query the systemd journal (logs); filter by unit, boot, time, and priority.

Show the journal entries for one specific systemd unit/service.

Show journal entries from the current boot.

List block devices (disks and partitions) and their mount points.

Create and manage disk partitions (parted handles GPT and large disks).

Create an ext4 filesystem on a partition.

Create an XFS filesystem on a partition (default on RHEL).

A widely used, mature Linux journaling filesystem.

A high-performance journaling filesystem; the default on RHEL.

A modern copy-on-write Linux filesystem with snapshots and pooling.

Attach a filesystem to a mount point so its contents are accessible.

Detach a mounted filesystem from its mount point.

Lists filesystems to mount at boot, with mount points and options (use UUIDs).

Report filesystem disk space usage in human-readable form.

Show the total size of a directory (summary, human-readable).

Logical Volume Management — pool disks into resizable logical volumes.

Physical Volume (PV) → Volume Group (VG) → Logical Volume (LV).

Create the LVM physical volume, volume group, and logical volume.

Create and manage Linux software RAID arrays.

RAID 0 stripes for speed (no redundancy); RAID 1 mirrors for redundancy.

Show network interfaces and their IP addresses (modern replacement for ifconfig).

Show the routing table, including the default gateway.

Command-line tool to manage NetworkManager connections.

Configures the DNS resolvers (nameservers) the system uses.

Static hostname-to-IP mappings, checked before DNS.

List listening TCP/UDP sockets and the processes that own them.

View or set the system hostname (and related metadata).

Print the running kernel release/version.

List loaded kernel modules / load a kernel module.

Archive multiple files into one (.tar); add -z for gzip, -j for bzip2 compression.

Compression tools producing .gz, .bz2, and .xz files.

Create a symbolic (soft) link pointing to another file or directory.

A hard link is another name for the same inode; a soft link is a pointer to a path.

Search the filesystem for files by name, size, time, type, or permissions.

Quickly find files by name using a prebuilt index (updatedb).

Change the apparent root directory for a process and its children (a sandbox).

A tool that installs, updates, and removes software and resolves dependencies.

The high-level package manager for Debian/Ubuntu; installs .deb packages.

The low-level Debian package tool that operates on a single .deb file.

The high-level package manager for RHEL/Fedora/CentOS (successor to yum); installs .rpm.

The older RHEL-family package manager, now succeeded by dnf.

The low-level package format and tool for RHEL-family distributions.

The high-level package manager for openSUSE/SLES (.rpm).

Refresh the local package index from the configured repositories (Debian/Ubuntu).

Install a package and its dependencies on Debian/Ubuntu (apt install <pkg>).

Install a package and its dependencies on RHEL/Fedora (dnf install <pkg>).

Universal, sandboxed package formats that bundle dependencies and work across distros.

Build software with ./configure && make && make install.

A configured source of packages a package manager downloads from.

A running instance of a program, identified by a PID with a state and owner.

Process ID — the unique number identifying a running process.

List all running processes with their owner, PID, CPU, and memory usage.

Show live, interactive process and resource usage (htop is friendlier).

Send a signal to a process by PID (default TERM = graceful stop).

Send SIGKILL to forcibly terminate a process that won't stop gracefully.

TERM (15) asks a process to exit cleanly; KILL (9) forces it immediately.

Set or change a process's CPU scheduling priority (-20 highest, 19 lowest).

Run a command immune to hangups so it keeps running after you log out.

Append & to a command to run it in the background; manage with jobs, fg, bg.

The time-based job scheduler daemon that runs jobs on a schedule.

A user's table of scheduled cron jobs; edit with crontab -e, list with crontab -l.

Five fields: minute, hour, day-of-month, month, day-of-week, then the command.

A cron schedule meaning 'run every day at 2:00 a.m.'

The modern alternative to cron for scheduling systemd units.

Schedule a command to run once at a specified future time.

User account records (username, UID, GID, home directory, shell) — no passwords.

Stores users' hashed passwords and password-aging policy.

Defines groups and their members.

Create a new user account.

Modify an existing user account (e.g. add to a group with -aG).

Delete a user account (use -r to also remove the home directory).

Create a new group.

Set or change a user's password.

Show a user's UID, GID, and group memberships.

Each user has one primary group and may belong to several secondary groups.

Run a single command as another user (usually root) per /etc/sudoers rules.

Safely edit /etc/sudoers; it validates syntax so a typo can't break sudo.

su switches to another user entirely; sudo runs one command with elevation and logs it.

The group whose members are allowed to use sudo (wheel on RHEL, sudo on Debian).

A directory for drop-in sudoers files, kept separate from /etc/sudoers.

A lightweight, isolated process packaging an app and its dependencies; shares the host kernel.

Containers share the host kernel (lightweight); VMs run a full guest OS (heavier).

A read-only template built from a Dockerfile; the basis for containers.

A running instance of a Docker image.

A text file of instructions used to build a Docker image.

Build an image from a Dockerfile.

Create and start a container from an image.

List running containers (add -a to include stopped ones).

List the images stored locally.

Define and run multi-container applications from a YAML file.

A daemonless, rootless container engine that is largely Docker-compatible.

A store for container images (e.g. Docker Hub) that you push to and pull from.

Read (r=4), write (w=2), execute (x=1) for owner, group, and others.

Owner rwx (7), group r-x (5), others r-- (4) = octal 754.

Change a file's permission bits, numeric (754) or symbolic (u+x).

Owner read/write; group and others read-only — typical for a regular file.

Owner read/write/execute; group and others read/execute — typical for a script/dir.

Change a file's owner (chown user file) and optionally group (user:group).

Change a file's group ownership.

Subtracts default permission bits from newly created files and directories.

Required to enter (cd into) the directory, not just read it.

The first ls -l character: - file, d directory, l symlink, b/c device.

Special bit (4) that runs a program with the privileges of its file owner (e.g. passwd).

Special bit (2) that runs a file as its group, or makes new files inherit a dir's group.

Special bit (1) on a directory letting users delete only files they own (e.g. /tmp).

Sets the SUID bit plus rwxr-xr-x.

Sets the sticky bit plus rwxrwxrwx (the /tmp permissions).

Access Control Lists grant fine-grained per-user/per-group permissions beyond rwx.

Set/view extended file attributes (e.g. +i makes a file immutable).

Mandatory Access Control — a system-enforced policy users cannot override.

Discretionary Access Control — the file owner decides permissions (standard rwx).

Label-based mandatory access control; default on RHEL-family systems.

Enforcing (block + log), permissive (log only), and disabled.

Show the current SELinux mode (Enforcing, Permissive, or Disabled).

Temporarily switch SELinux between enforcing (1) and permissive (0).

Show detailed SELinux status and policy information.

Reset a file's SELinux context to the policy default.

Manage SELinux policy (ports, file contexts, booleans) persistently.

Where the persistent SELinux mode is set across reboots.

Path-based mandatory access control using profiles; default on Ubuntu/SUSE.

Enforce (apply the profile) and complain (log only).

Show the status of loaded AppArmor profiles.

SELinux labels objects (RHEL); AppArmor targets program paths (Ubuntu/SUSE).

Pluggable Authentication Modules — the framework controlling how users authenticate.

Grant users and processes only the access they actually need.

Secure Shell — an encrypted protocol for remote login and file transfer.

Generate an SSH public/private key pair.

The server file (~/.ssh/authorized_keys) holding clients' public keys.

Client proves it holds the private key matching a public key on the server.

Copy your public key to a server's authorized_keys for passwordless login.

The SSH server config; harden by disabling root login and password auth.

Copy files over SSH (scp) or transfer interactively over SSH (sftp).

A dynamic, zone- and service-based firewall manager (RHEL family).

The command-line client for firewalld.

Uncomplicated Firewall — a simple front-end to iptables/nftables (Ubuntu).

The legacy packet-filtering framework for defining firewall rules.

The modern successor to iptables for packet filtering.

A firewall posture that blocks everything except explicitly allowed traffic.

Linux Unified Key Setup — the standard for full-disk (block-device) encryption.

The tool used to set up and manage LUKS-encrypted volumes.

GNU Privacy Guard — encrypt, decrypt, and digitally sign files.

A one-way function (e.g. sha256sum) used to verify integrity, not to encrypt.

Secures a service's traffic in transit and authenticates its identity.

Layer multiple controls (permissions, MAC, firewall, encryption) so one failure isn't fatal.

Monitors logs and bans IPs after repeated failed login attempts.

Encrypt/verify with the public key; decrypt/sign with the private key.

Multi-factor authentication — combine something you know, have, and/or are.

View and set Access Control Lists for fine-grained per-user permissions.

Toggle an SELinux boolean to allow or deny optional policy behavior.

firewall-cmd --add-service=http --permanent, then --reload.

The first script line (#!/bin/bash) naming the interpreter that runs the file.

chmod +x script.sh, then run it with ./script.sh.

name="value" with no spaces; reference it as $name or "$name".

The status of the last command: 0 = success, non-zero = error.

if [[ condition ]]; then ... fi — runs commands when the test is true.

Evaluate a condition (file checks, numeric/string comparisons) for if and while.

for f in *.log; do ... done — iterate over a list of items.

while [[ condition ]]; do ... done — repeat while the test stays true.

until [[ condition ]]; do ... done — repeat until the test becomes true.

Match a variable against patterns — a cleaner multi-way branch than nested ifs.

Send one command's standard output as the next command's standard input.

> writes output to a file (overwrite); >> appends to it.

Feed a file's contents to a command as standard input.

Redirect standard error to the same place as standard output.

Search text for lines matching a pattern (regular expression).

Ignore case / search recursively / invert the match.

A stream editor for filtering and transforming text (e.g. find-and-replace).

A text-processing language for working with columns and fields.

Extract columns / sort lines / collapse or count duplicate lines.

$(command) inserts a command's output into another command or variable.

&& runs the next command only if the previous succeeded; || only if it failed.

$1, $2, ... are a script's arguments; $0 is the script name, $# the count.

name() { commands; } — group reusable commands into a callable block.

Catch signals (e.g. EXIT, INT) in a script to run cleanup before exiting.

Shell wildcards: * (any chars), ? (one char), [abc] (a character set).

Read a line of input into a variable, often for interactive scripts.

Print text to standard output (printf gives precise formatting).

A distributed version-control system tracking changes via commits, branches, merges.

Copy a remote repository to your local machine.

Stage changes so they'll be included in the next commit.

Save a snapshot of staged changes (git commit -m "message").

Send commits to the remote / fetch and merge from the remote.

Create branches and switch between them to work in isolation.

Combine the changes from another branch into the current one.

Show the working-tree state / view the commit history.

An orchestrator that automates deploying, scaling, and managing containers.

An agentless automation tool using YAML playbooks pushed over SSH.

Running an automation repeatedly yields the same end state, changing only what differs.

A YAML file describing the desired state as a series of tasks.

A file listing the hosts (and groups) Ansible manages.

A reusable unit of work (e.g. apt, copy, service) a task invokes.

An agent-based configuration-management tool using a declarative language.

An agent-based configuration-management tool using Ruby 'recipes'.

A declarative infrastructure-as-code tool that provisions infrastructure.

Infrastructure as Code — manage systems with version-controlled config files.

Initializes a cloud instance on first boot (users, keys, packages, scripts).

A human-readable data format (indentation-based) used by Compose, Ansible, and Kubernetes.

A named value in the shell environment (export NAME=value) available to processes.

Create a shortcut for a longer command (alias ll='ls -la').

Identify, theorize, test, plan, implement/escalate, verify, document.

Identify the problem — gather info, question users, find what changed.

Document the findings, actions, and outcomes.

journalctl (systemd), /var/log (text logs), and dmesg (kernel) before theorizing.

Find which filesystem is full (human-readable disk usage).

Find which directory is consuming the space (sort with | sort -h).

Check inode usage — a disk can be 'full' of inodes with free space remaining.

A filesystem structure storing a file's metadata; exhaustion blocks new files.

Space isn't freed until the holding process closes; find it with lsof | grep deleted.

Check and repair a filesystem — run only on an unmounted filesystem.

df -h to find the filesystem, du to find the directory, df -i for inodes.

Rotates and compresses logs so /var/log doesn't fill the root filesystem.

Test reachability and round-trip time to a host using ICMP.

Show the per-hop path to a destination to find where traffic stops.

Test DNS name resolution.

Connectivity works but DNS is broken — a name-resolution problem.

Capture and inspect network packets for deep analysis.

List sockets/connections and listening ports (ss is the modern tool).

Points to a DHCP failure or interface misconfiguration.

A local connectivity or routing problem (check ip route).

Show live CPU, memory, load average, and per-process resource usage.

Average processes wanting CPU over 1, 5, 15 minutes; compare to core count.

A value well above the core count means processes are queuing for CPU.

Show total, used, available memory and swap in human-readable form.

Report virtual memory, CPU, and system activity (including swap usage).

Report CPU and per-device disk I/O statistics to find I/O bottlenecks.

Collect and report historical system activity (CPU, memory, I/O) over time.

Show how long the system has run and the 1/5/15-minute load averages.

A finished process not yet reaped by its parent; shows a Z state, harmless but a bug sign.

A running process whose parent died; it's re-parented to PID 1 (systemd).

Uninterruptible sleep — usually blocked on disk or network I/O.

The kernel terminates a process under severe memory pressure to recover.

Look in dmesg or the journal for 'Out of memory' / 'Killed process' messages.

Display the kernel ring buffer — hardware, driver, and boot messages.

List open files and the processes holding them (e.g. what holds a port or deleted file).

Trace the system calls a process makes — useful for diagnosing hangs and failures.

Send a signal to stop a process by PID (kill) or by name (pkill).

Check systemctl status <svc> and journalctl -u <svc> for the failure reason.

Suspect SELinux/AppArmor — check the audit log and contexts.

Search SELinux audit denials and suggest a policy to allow them.

Heavy swap use slows the system; check free -h and vmstat for swap activity.

An error at the GRUB stage points to the bootloader or its config.

The kernel can't continue (often a missing root or initramfs issue).

Check /etc/fstab, the device/UUID, and run fsck if corrupted.

A process set to a low priority (high nice) may run slowly under contention.

ss -tulpn shows which ports are open and which process owns each.

Check /etc/resolv.conf and test with dig; the resolver may be wrong or down.

Check the NTP/chrony service; clock skew breaks TLS, Kerberos, and logs.

Identify it in top/htop, then renice, fix, or kill the runaway process.

Often a sign of filesystem errors; the kernel remounts ro to protect data — check dmesg.

Combines ping and traceroute into a continuous per-hop network diagnostic.

Test with dig/nslookup; fix /etc/resolv.conf or the upstream DNS server.

Re-run a command at intervals to watch a value change (e.g. watch df -h).

Filter the journal to error-priority (and worse) messages.

A user hit a disk quota; check with quota and repquota, then adjust or clean up.

More demand than CPUs — investigate top CPU, memory pressure, or blocked I/O.