LFCS 162 🐧 LFCS Exam Objectives Review — Domain 2 - KandZ

⏱️ Estimated read: 8 min | |

The previous chapter reviewed Domain 1: Essential Commands. This chapter covers Domain 2: Operations Deployment. This is the largest domain on the exam, weighted at 25% of the total score . The objectives are the broadest of any domain: the kernel tuning, the process and service management, the scheduled jobs, the package management, the system recovery, the virtualization, the containers, and the SELinux enforcement. The critical trap is the assumption that “operations” means only the systemctl commands. The domain tests the full lifecycle of a running system: the boot sequence, the runtime changes, the persistent configuration, and the recovery from the failure .

Key point: Operations Deployment is 25% of the exam. The objectives are the kernel parameter configuration (the sysctl runtime and the /etc/sysctl.d/ persistence), the process and service diagnosis (the systemctl, the journalctl, the ps), the job scheduling (the cron, the at, the systemd timers), the package management (the apt, the dnf), the recovery from the hardware and filesystem failures, the VM management (the libvirt, the virsh), the container management (the podman, the docker), and the MAC enforcement (the SELinux).

Why Domain 2 requires a specific mental model

The breadth problem. The domain covers the kernel, the processes, the services, the packages, the containers, the VMs, and the security. The candidate must demonstrate the proficiency across the entire stack, not the specialization in one area. The review must be systematic: the objective by the objective, the command by the command .

The runtime versus persistent problem. The operations domain is full of the “temporary” and the “permanent” distinctions. The sysctl -w is the runtime; the /etc/sysctl.d/99-custom.conf is the persistent. The systemctl start is the runtime; the systemctl enable is the persistent. The mount is the runtime; the /etc/fstab is the persistent. The firewall-cmd --add-service is the runtime; the --permanent is the persistent . The exam tests the persistence, not just the immediate effect.

The recovery problem. The domain includes the “recover from the hardware, the operating system, or the filesystem failures” . The candidate must know the rescue mode, the emergency mode, the fsck, the xfs_repair, the GRUB recovery, and the root password reset. The recovery tasks are the ones that the daily use does not exercise.

The container and VM problem. The domain includes the basic containers (the podman, the docker) and the basic VMs (the libvirt, the virsh). The candidate must know the image pull, the container run, the container stop, the VM create, the VM start, and the VM stop . The depth is the basics, not the advanced orchestration.

The trade-off. The domain is 25% of the exam, but the depth is the breadth. The candidate who specializes in one area will miss the points in the others. The review must cover the entire domain, with the practice on the live system.

a. The kernel parameters and the process management

The objectives: the kernel parameters (the runtime and the persistent), the process diagnosis, the service management, and the system logs.

# Runtime kernel parameter
sudo sysctl -w net.ipv4.ip_forward=1

# Persistent kernel parameter
echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/99-custom.conf
sudo sysctl --system

# Process diagnosis
ps aux | grep nginx
top -b -n 1
pgrep -a nginx

# Service management
sudo systemctl start nginx
sudo systemctl enable nginx
sudo systemctl status nginx
sudo systemctl reload nginx

# System logs
sudo journalctl -u nginx -p err --since "1 hour ago"

The sysctl -w changes the runtime. The /etc/sysctl.d/ file makes the change persistent. The ps aux and the top show the processes. The systemctl manages the services. The journalctl -u filters the logs by the unit .

b. The scheduled jobs, the packages, and the recovery

The objectives: the job scheduling (the cron, the at, the systemd timers), the package management (the apt, the dnf), and the recovery (the rescue mode, the fsck, the GRUB).

# Cron job
echo "0 2 * * * /usr/bin/backup.sh" | sudo tee -a /etc/cron.d/backup

# Systemd timer
sudo systemctl enable --now backup.timer

# Package management (Debian)
sudo apt update && sudo apt install nginx

# Package management (RHEL)
sudo dnf install nginx

# Filesystem check
sudo fsck -f /dev/sdb1

# XFS repair
sudo xfs_repair /dev/sdc1

# Rescue mode
# Boot with the "systemd.unit=rescue.target" kernel parameter

The cron is the traditional scheduler. The systemd timer is the modern alternative. The apt and the dnf are the package managers. The fsck and the xfs_repair are the filesystem repair tools. The rescue mode is the recovery boot .

c. The virtualization, the containers, and the SELinux

The objectives: the VM management (the virsh), the container management (the podman), and the SELinux enforcement.

# VM management
virsh list --all
virsh start web-vm
virsh shutdown web-vm
virsh undefine web-vm

# Container management
podman pull nginx:latest
podman run -d --name web -p 8080:80 nginx:latest
podman ps
podman stop web

# SELinux enforcement
getenforce
sudo setenforce 0
sudo semanage fcontext -a -t httpd_sys_content_t "/srv/web(/.*)?"
sudo restorecon -Rv /srv/web

The virsh manages the VMs. The podman manages the containers. The getenforce and the setenforce control the SELinux mode. The semanage fcontext and the restorecon fix the context labels .

Complete Example Session

# ============================================
# PART 1: KERNEL PARAMETER
# ============================================

sudo sysctl -w net.ipv4.ip_forward=1
echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/99-custom.conf
sudo sysctl --system

# ============================================
# PART 2: PROCESS DIAGNOSIS
# ============================================

ps aux | grep nginx
pgrep -a nginx

# ============================================
# PART 3: SERVICE MANAGEMENT
# ============================================

sudo systemctl start nginx
sudo systemctl enable nginx
sudo systemctl status nginx

# ============================================
# PART 4: SYSTEM LOGS
# ============================================

sudo journalctl -u nginx -p err --since "1 hour ago"

# ============================================
# PART 5: SCHEDULED JOB
# ============================================

echo "0 2 * * * /usr/bin/backup.sh" | sudo tee -a /etc/cron.d/backup

# ============================================
# PART 6: PACKAGE MANAGEMENT
# ============================================

sudo apt update && sudo apt install nginx

# ============================================
# PART 7: VM MANAGEMENT
# ============================================

virsh list --all
virsh start web-vm

# ============================================
# PART 8: CONTAINER MANAGEMENT
# ============================================

podman run -d --name web -p 8080:80 nginx:latest
podman ps

# ============================================
# PART 9: SELINUX
# ============================================

getenforce
sudo semanage fcontext -a -t httpd_sys_content_t "/srv/web(/.*)?"
sudo restorecon -Rv /srv/web

The nine parts trace the Domain 2 objectives: the kernel parameter, the process diagnosis, the service management, the logs, the scheduled job, the packages, the VM, the container, and the SELinux.

Quick Reference

Kernel and Processes

Command	Purpose
`sysctl -w`	Runtime kernel parameter
`/etc/sysctl.d/`	Persistent kernel parameter
`ps aux`	Process list
`pgrep -a`	Process search
`top`	Process monitor

Services and Logs

Command	Purpose
`systemctl start`	Start the service
`systemctl enable`	Enable at boot
`systemctl reload`	Graceful reload
`journalctl -u`	Service logs

Scheduling

Command	Purpose
`crontab -e`	User cron
`/etc/cron.d/`	System cron
`systemctl enable --now .timer`	Systemd timer

Package Management

Command	Purpose
`apt update`	Update the package list
`apt install`	Install
`dnf install`	Install (RHEL)

Virtualization and Containers

Command	Purpose
`virsh list --all`	List the VMs
`virsh start`	Start the VM
`podman run`	Run the container
`podman ps`	List the containers

SELinux

Command	Purpose
`getenforce`	Current mode
`setenforce 0`	Permissive
`semanage fcontext`	Context rule
`restorecon -Rv`	Apply the context

Best Practices

✅ Do This:

echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/99-custom.conf
<!-- Persist the kernel parameter -->                # ✅

sudo systemctl enable nginx
<!-- Enable the service at boot -->                  # ✅

sudo restorecon -Rv /srv/web
<!-- Fix the SELinux context -->                     # ✅

❌ Don’t Do This:

sudo sysctl -w net.ipv4.ip_forward=1
# Only the runtime, no persistence
<!-- The change is lost on reboot -->                # ❌

sudo systemctl start nginx
# Only the runtime, no enable
<!-- The service does not start at boot -->          # ❌

# Ignore the SELinux context
<!-- The web server cannot read the files -->        # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Kernel parameter lost	Used `sysctl -w` only	Add to `/etc/sysctl.d/`
Service not starting at boot	Used `start` only	Use `enable`
SELinux denial	Wrong context	`semanage fcontext` + `restorecon`
Container not reachable	No port mapping	`-p host:container`
VM not booting	Wrong disk or config	`virsh domblklist`

Real-World Examples

1. Kernel Parameter

sysctl -w net.ipv4.ip_forward=1

2. Service Start

systemctl start nginx

3. Service Enable

systemctl enable nginx

4. Journal

journalctl -u nginx

5. Cron

echo "0 2 * * * /backup.sh" | crontab -

6. Package Install

apt install nginx

7. VM Start

virsh start web-vm

8. Container Run

podman run -d nginx

9. SELinux Mode

getenforce

10. SELinux Context

restorecon -Rv /srv/web

Visual

Domain 2 Structure

┌──────────────────────────────────────────────┐
│  Domain 2: Operations Deployment (25%)       │
│  ├── Kernel parameters                       │
│  ├── Processes and services                  │
│  ├── Scheduled jobs                          │
│  ├── Package management                      │
│  ├── Recovery                                │
│  ├── Virtualization                          │
│  ├── Containers                              │
│  └── SELinux                                 │
└──────────────────────────────────────────────┘

Runtime vs Persistent

┌──────────────────────────────────────────────┐
│  Runtime                                     │
│  ├── sysctl -w                               │
│  ├── systemctl start                         │
│  ├── mount                                   │
│  └── firewall-cmd --add-service              │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Persistent                                  │
│  ├── /etc/sysctl.d/                          │
│  ├── systemctl enable                        │
│  ├── /etc/fstab                              │
│  └── firewall-cmd --permanent                │
└──────────────────────────────────────────────┘

Summary

Item	Value
Domain weighting	25%
Kernel parameters	`sysctl`, `/etc/sysctl.d/`
Processes	`ps`, `top`, `pgrep`
Services	`systemctl`
Logs	`journalctl`
Scheduling	`cron`, `systemd timers`
Packages	`apt`, `dnf`
VMs	`libvirt`, `virsh`
Containers	`podman`, `docker`
SELinux	`getenforce`, `semanage`, `restorecon`

Key takeaways:

The domain is 25% of the exam. The Operations Deployment covers the kernel, the processes, the services, the packages, the recovery, the VMs, the containers, and the SELinux. The breadth is the requirement, not the depth in one area.
The runtime versus persistent distinction is the trap. The sysctl -w is not the persistence. The systemctl start is not the enable. The mount is not the /etc/fstab. The exam tests the persistent configuration.
The recovery is the part that the daily use does not exercise. The rescue mode, the fsck, the xfs_repair, the GRUB recovery, and the root password reset. The candidate must practice these on the live system.
The containers and the VMs are the basics. The podman run, the virsh start, the container stop, the VM shutdown. The depth is the basics, not the orchestration.
The SELinux is the MAC enforcement. The getenforce, the setenforce, the semanage fcontext, the restorecon. The candidate must know the context and the boolean.

Remember: Domain 2 is the operations. The kernel, the processes, the services, the packages, the VMs, the containers, and the SELinux. The runtime is not the persistent. The recovery is the practice. The exam tests the full lifecycle.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!