LFA flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Filesystem Hierarchy Standard

Defines the standard top-level Linux directory layout: /etc for host configuration, /var for variable data such as logs, /usr for read-only shareable programs and libraries, and /tmp for temporary files.

umask 022

A umask masks permission bits when files are created: 022 removes group and other write, so new files default to 644 and new directories default to 755.

Hard link versus symbolic link

A hard link is another directory entry for the same inode and cannot cross filesystems or point to a directory; a symbolic link is a separate file that stores a target path.

setuid bit

A special permission bit (4000) set on an executable that makes it run with the file owner's effective UID rather than the invoking user's, as with /usr/bin/passwd.

systemd default target

The target systemd reaches at boot, changed with systemctl set-default; multi-user.target is a non-graphical multi-user system, and graphical.target adds a display manager on top of it.

Pipe and redirection operators

> writes stdout and truncates the file, >> appends, 2> redirects stderr, &> captures both streams, and | passes stdout into the next command's stdin.

SIGTERM versus SIGKILL

SIGTERM (15) requests graceful termination and can be caught so the process closes files and connections; SIGKILL (9) cannot be caught or ignored and kills the process immediately without cleanup.

LVM volume stack

Physical volumes are combined into a volume group, which is divided into logical volumes that can be resized while mounted and can span multiple physical disks.

crontab five fields

The five scheduling fields are minute, hour, day of month, month, and day of week; an asterisk matches every value, and a step like */5 means every five units.

journalctl -u nginx -f

Queries the systemd journal for a single unit and follows new entries in real time, replacing the need to tail that service's log file manually.

df versus du

df reports used and free space per mounted filesystem from filesystem metadata; du sums apparent file sizes by walking directory trees, so the two totals can legitimately differ.

NIST cloud characteristics

The five essential characteristics are on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service; a model lacking pooling or measurement is not full cloud.

IaaS PaaS SaaS

IaaS supplies virtual machines, storage, and networking; PaaS supplies managed runtimes and databases; SaaS supplies finished applications. The provider manages progressively more of the stack moving upward.

Block versus object storage

Block storage presents raw volumes attached to one server and formatted with a filesystem; object storage keeps key-value objects in buckets reached over HTTP APIs and is not mounted as a disk.

Availability zone

An isolated data-center group within a region with independent power and networking; spreading an application across zones keeps it running when a single zone fails.

RTO and RPO

Recovery time objective is the maximum acceptable downtime after a failure; recovery point objective is the maximum acceptable data loss, measured as an amount of time.

CIA triad

Confidentiality restricts data access to authorized parties, integrity keeps data accurate and unaltered, and availability keeps systems and data reachable when legitimate users need them.

SELinux enforcing mode

The kernel denies any access the loaded policy does not explicitly allow and records denials in the audit log; permissive mode logs the same denials without blocking them.

TLS protects data in transit

TLS encrypts traffic between client and server, authenticates the server with an X.509 certificate from a trusted CA, and detects tampering through message authentication codes.

Multi-factor authentication

Requires two or more independent credential types, such as a password plus a one-time code from a device, so a stolen password alone cannot grant access.

Salted password hashing

Each password is hashed with a unique random salt using a deliberately slow algorithm such as bcrypt or argon2, which blocks rainbow tables and prevents identical passwords from producing identical hashes.

Continuous delivery versus deployment

Continuous delivery keeps every change releasable but deploys on human approval; continuous deployment sends every change that passes the pipeline to production automatically with no approval gate.

Terraform state file

Records the mapping between declared resources and real infrastructure; Terraform compares it with configuration and provider APIs to compute a plan before applying changes.

Ansible idempotency

A playbook describes a desired end state, so running it repeatedly produces the same result and only modifies resources that already differ from that state.

Docker image layers

Each Dockerfile instruction creates a cached read-only layer; unchanged layers are reused across builds, and a running container adds a writable layer on top of the image.

Kubernetes Pod

The smallest deployable unit, wrapping one or more containers that share a network namespace, an IP address, and any mounted volumes attached to the Pod.

Blue-green deployment

Two identical environments run side by side; traffic switches to the new version in one step, and rolling back means switching the router back to the old environment.

HTTP 502 versus 504

502 Bad Gateway means an upstream server returned an invalid response or refused the connection; 504 Gateway Timeout means the upstream did not respond before the proxy timeout expired.

PUT versus POST

PUT creates or replaces a resource at a client-known URL and is idempotent; POST submits data to a server-chosen URL and repeating it can create duplicate resources.

Log levels

Severity order is DEBUG, INFO, WARN, ERROR, FATAL; production typically records INFO and above, while DEBUG is enabled temporarily to diagnose a specific problem.

Semantic versioning

Versions take the form MAJOR.MINOR.PATCH, where MAJOR signals incompatible API changes, MINOR adds backward-compatible features, and PATCH delivers backward-compatible bug fixes.

Blameless postmortem

After an incident the team documents the timeline, root cause, and follow-up actions, focusing on system and process fixes rather than punishing the individuals involved.

Reverse proxy upstream errors

nginx or a load balancer returns 502 when its upstream is unreachable or sends malformed data and 504 when the upstream exceeds proxy_read_timeout; the proxy error log names the cause.