LFCA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

FHS /etc directory

Holds host-specific configuration files such as passwd, fstab, and service configs. It is not for variable data or binaries; edits here change system behavior and usually require a service reload.

Sticky bit on directory

A permission bit (1xxx) that restricts deletion inside a directory to the file owner, the directory owner, or root. Commonly set on /tmp so users cannot remove each other's files.

Hard link vs symlink

A hard link is a second directory entry pointing to the same inode and cannot cross filesystems. A symlink is a separate file containing a path and may point anywhere, even to a missing target.

SIGTERM vs SIGKILL

SIGTERM (15) requests a graceful exit and can be caught or ignored by the process. SIGKILL (9) is enforced by the kernel, cannot be caught, and may leave state inconsistent.

awk field variables

awk splits each input line into fields: $1 is the first field, $NF is the last, and $0 is the whole line. NR is the record number and NF is the number of fields.

systemd unit reload

After editing a unit file, run systemctl daemon-reload so systemd rereads unit definitions. Then restart the service with systemctl restart name to apply the change to the running process.

cron field order

A crontab entry has five time fields in order: minute, hour, day of month, month, day of week, followed by the command. In system crontabs a user field precedes the command.

journalctl -b and -p

journalctl -b shows logs from the current boot only, and -p err filters to priority error and above. Combine with --since and --until to narrow the time range.

ss -tulpn

Lists listening sockets: -t TCP, -u UDP, -l listening only, -p shows the owning process, and -n keeps ports numeric. Used to confirm which service is bound to a port.

usermod -aG

Adds a user to a supplementary group without removing existing memberships; omitting -a replaces the group list. The new membership takes effect at the user's next login session.

IaaS responsibility boundary

The provider manages physical hosts, network, and hypervisor; the customer manages the guest OS, middleware, runtime, applications, and data. Patching the guest OS is the customer's job.

PaaS responsibility boundary

The provider manages the OS, runtime, and scaling infrastructure; the customer manages application code, configuration, and data. The customer does not patch the underlying operating system.

Availability zone

An isolated failure domain within a cloud region, typically with independent power and networking. Deploying across multiple zones lets a workload survive the loss of one zone.

Elasticity vs scalability

Scalability is the capacity to handle growth by adding resources; elasticity is the automatic adjustment of resources up or down in response to current demand, including scale-in when demand falls.

Cloud egress charges

Fees charged for data leaving the provider's network, usually per GB. Ingress is commonly free. Egress costs make data transfer a significant factor in multi-cloud and hybrid designs.

Object vs block storage

Object storage manages data as key-value objects over HTTP, scales horizontally, and suits static assets and backups. Block storage presents a volume to one instance and suits databases and filesystems.

MFA factor categories

MFA requires factors from at least two different categories: knowledge (password), possession (token, key), and inherence (biometric). Two passwords from the same category do not satisfy MFA.

Symmetric vs asymmetric encryption

Symmetric encryption uses one shared key and is fast, so it protects bulk data. Asymmetric encryption uses a public/private pair for key exchange and signatures. TLS uses both together.

Password hashing with salt

Passwords are stored as one-way hashes with a unique random salt per password. The salt prevents precomputed rainbow-table attacks, and the one-way function prevents recovery of the original password.

Principle of least privilege

Grant each user, process, or service only the permissions required to perform its function, and no more. This limits the damage from credential compromise and accidental misconfiguration.

SELinux and AppArmor

Mandatory access control systems that enforce system-defined policy on processes, overriding discretionary owner permissions. SELinux uses labels; AppArmor uses per-program path profiles.

TLS certificate validation

The client checks that the server certificate is signed by a trusted CA, is within its validity dates, and matches the requested hostname. Failure in any check produces a certificate error.

Continuous delivery vs deployment

Continuous delivery keeps every passing build releasable but requires a manual approval to release. Continuous deployment automatically releases every build that passes the pipeline.

Git rebase vs merge

Merge combines two histories and preserves a merge commit. Rebase replays commits onto a new base, producing a linear history but rewriting commit hashes, so avoid rebasing shared branches.

Idempotent configuration management

A task is idempotent when running it repeatedly converges to the same state without additional side effects. Ansible, Puppet, and Chef modules are designed to be idempotent.

Container vs virtual machine

Containers share the host kernel and isolate processes with namespaces and cgroups, so they start quickly with low overhead. VMs run a full guest OS on a hypervisor with stronger isolation.

SLI, SLO, and error budget

An SLI is a measured service indicator such as request success rate; an SLO is the target value for that indicator; the error budget is one minus the SLO, the allowed amount of failure.

Canary deployment

A release strategy that routes a small percentage of traffic to the new version, monitors error rates and latency, and then expands or rolls back based on the observed results.

HTTP status code classes

2xx indicates success, 3xx a redirect, 4xx a client-side error such as bad credentials, and 5xx a server-side error. The class narrows which layer to investigate first.

Connection refused vs timeout

Connection refused means the host is reachable but nothing is listening on the port. A timeout means no response arrived, suggesting a firewall drop, routing problem, or overloaded service.

Twelve-factor configuration

Store configuration in environment variables rather than in code, so the same build artifact runs in every environment. Secrets should be injected at runtime, not committed to the repository.

curl -I and -v

curl -I sends a HEAD request and prints response headers only, useful for checking status and redirects. curl -v prints the full request/response exchange including TLS handshake details.