LFCE study plan

Build a reusable lab of at least three virtual machines (one router/gateway, two hosts) and snapshot each before changes

Configure persistent hostnames, static addressing, timezone and NTP synchronization on every lab host without using a GUI

Practice systemd unit inspection and control: list failed units, read journal output for a service, and enable/disable units at boot

Write a shell script that rotates and compresses /var/log files older than 7 days and schedule it with a systemd timer

Manage users, groups, and sudo policy: create service accounts with nologin shells and a least-privilege sudoers drop-in validated with visudo -c

Tune kernel parameters at runtime and persistently via sysctl drop-ins, then verify with sysctl -a output

Diagnose a deliberately broken boot by recovering to a rescue target and repairing fstab or a unit failure

Automate package installation and idempotent configuration of three packages using a simple script or configuration-management playbook

Configure static IPv4 addressing, multiple addresses on one interface, and policy routing with two routing tables

Set up and verify name resolution order in nsswitch.conf and test forward and reverse lookups against a local resolver

Capture and analyze traffic with tcpdump to prove which side of a connection drops packets

Harden the host firewall with nftables or firewalld, permitting only required ports and logging drops

Deploy an SSH server with key-only authentication, a non-default port, and per-group Match blocks restricting access

Configure a DHCP or DNS service for the lab subnet and verify leases or records resolve correctly from a client

Implement host-based intrusion detection by writing custom logwatch or journald alert rules for failed SSH logins

Document a rollback procedure for each network service change made this week

Partition a spare disk with GPT, create LVM physical volumes, a volume group, and a logical volume, then grow and shrink the filesystem safely

Configure software RAID 1 with mdadm, simulate a disk failure, and rebuild the array

Persist mounts by UUID in fstab and validate every entry with mount -a and findmnt before rebooting

Set and enforce disk quotas on a filesystem and demonstrate a user hitting the limit

Export an NFS share with restricted client access and mount it from a second host using the correct options

Configure an iSCSI target and initiator, or a Samba share with authenticated access, and verify permissions from the client

Back up a filesystem with rsync over SSH and with tar, then perform a timed restore into a clean directory

Apply file permissions, ACLs, and SELinux or AppArmor contexts so a shared directory works for a group without world-write

Issue and install a TLS certificate for a local web service and verify the chain with openssl s_client

Configure a reverse proxy or virtual host that serves two names from one address

Harden the system with a documented baseline: disable unused services, set password aging, and enable auditd rules for sensitive files

Verify the hardening baseline with a scan or checklist and remediate every failed item

Run a full timed troubleshooting drill covering a broken service, a routing fault, and a full or unmounted filesystem

Automate health checks for services, disk usage, and certificate expiry with a script that exits non-zero on failure

Perform a final review of weak areas using missed practice items and re-run each failed lab from scratch

Write a runbook summarizing the recovery steps for the ten most likely failures in your lab