Concepts·Linux Foundation Certified System Administrator

LFCS exam format and lab strategy

LFCS is a two-hour performance-based exam: you are given tasks on a live system and graded on the end state, not on how you reached it. This guide covers what that format rewards, why the exam is sat on either Ubuntu or Rocky and what that means for preparation, and introduces the machines every later page runs on.

Start Here Guide 1 of 38 Beginner

PlatformsUbuntu 26.04 LTS + AlmaLinux 10.2
LVM2.03.31 (Ubuntu) / 2.03.36 (AlmaLinux)
nftables1.1.6 (Ubuntu) / 1.1.5 (AlmaLinux)
TimeAbout 12 min

Exam format and the five domain weights are the Linux Foundation's published certification page, linked below. Nothing here is derived from this site's practice questions - a question bank is edited, and a guide that quotes one goes quietly out of date.

Firewallufw 0.36.2 enabled but reporting inactive / firewalld active
Network confignetplan + systemd-networkd / NetworkManager 1.56.0

Both distributions, because the commands on this page differ between them. Every output is captured on the host it belongs to.
Server Name	IP Address	OS	Roles	CPU	RAM	HDD
LFCS-A01	192.168.0.70	Ubuntu 26.04 LTS	Primary host - most guides run only here	2 Core	4 GB	50 GB
LFCS-C01	192.168.0.72	AlmaLinux 10.2	The other distribution - dnf, firewalld and NetworkManager	2 Core	4 GB	50 GB

This guide includes

Use this before you book anything. This matters because LFCS is sat on a live system against a two-hour clock, and you choose Ubuntu or Rocky at the start - so half the commands you revise have two correct spellings and only one of them counts on the day.

identifying a machine's distribution, kernel and package family in one command
running that same command on both families and watching the answers diverge
listing the subsystems that differ between the two machines you may be given
checking which shell you are actually in, and what $BASH_VERSION reports under zsh

Before you start

The machines, and why there are two distributions
The candidate chooses the distribution at the start of the exam.
bash Example session
```
$hostnamectl hostname; . /etc/os-release; echo "$PRETTY_NAME  kernel $(uname -r)"lfcs-a01Ubuntu 26.04 LTS  kernel 7.0.0-30-generic$hostnamectl hostname; . /etc/os-release; echo "$PRETTY_NAME  kernel $(uname -r)"lfcs-c01AlmaLinux 10.2 (Lavender Lion)  kernel 6.12.0-211.7.3.el10_2.x86_64
```
Note
LFCS is sat on Ubuntu or Rocky, and you pick at the start. So a path that only ever showed apt would have taught half the syllabus, and one asserting "the dnf equivalent is..." without running it would be guessing. Every guide here whose commands differ shows both, captured on both.

AlmaLinux stands in for the RPM family. Rocky, Alma and RHEL behave identically for everything on this syllabus; where they would not, the guide says so.

The five domains are Essential Commands, Operations Deployment, Users and Groups, Networking and Storage. Their weights are on the Linux Foundation page linked below, and every guide on this path carries its domain as a chip.

Which distribution you choose is a real decision, not a formality. Pick the one you use daily: the exam grades the end state, so fluency with its firewall and package tools is worth more than knowing both families badly.

The lab here is AlmaLinux rather than Rocky, and for this syllabus they are interchangeable - same packages, same service names, same file locations. Where a difference would matter, the guide says so rather than leaving you to find out.

Expected resultUbuntu 26.04 LTS and AlmaLinux 10.2, on kernels 7.0.0-30-generic and 6.12.0-211.7.3.el10_2.

Success conditionYou know which machine each command on this path ran on.
The tooling that differs between them
Not a preference - the two families genuinely ship different tools.
bash Example session
```
$printf '%-18s %s\n' "package manager" "$(command -v apt-get >/dev/null && echo apt || echo dnf)" "init system" "$(ps -p 1 -o comm=)" "firewall front end" "$(command -v ufw >/dev/null && echo ufw || echo firewall-cmd)" "network config" "$(command -v netplan >/dev/null && echo 'netplan + systemd-networkd' || echo NetworkManager)"package manager    aptinit system        systemdfirewall front end ufwnetwork config     netplan + systemd-networkd$printf '%-18s %s\n' "package manager" "$(command -v apt-get >/dev/null && echo apt || echo dnf)" "init system" "$(ps -p 1 -o comm=)" "firewall front end" "$(command -v ufw >/dev/null && echo ufw || echo firewall-cmd)" "network config" "$(command -v netplan >/dev/null && echo 'netplan + systemd-networkd' || echo NetworkManager)"package manager    aptinit system        systemdfirewall front end ufwnetwork config     netplan + systemd-networkd
```
Note
Four subsystems, two spellings each. Packages, firewall, network configuration and service management - and only the last is the same on both. That is most of Domains 2 and 4.

The exam grades the end state. If the task is "open port 8080", ufw and firewall-cmd are both correct answers - on the machine you chose. Knowing one family fluently and the other well enough to look up is a reasonable strategy; knowing neither is not.

Service management is the one thing they share. systemd is identical on both, which is why the Operations domain feels easier than Networking or Storage - there is only one answer to learn.

Budget your revision by the difference, not by the topic. A command that is the same on both families costs you one thing to learn; a firewall costs you two. That is where the time goes, and it is not visible in the domain weights.

Expected resultapt with ufw and netplan on one side; dnf with firewalld and NetworkManager on the other.

Success conditionYou can see what "either distribution" actually costs you in preparation.
What a performance exam does not give you
The login shell, and why it matters when you are being timed.
zsh Example session
```
$echo "SHELL=$SHELL"; echo "BASH_VERSION=[$BASH_VERSION]"; echo "ZSH_VERSION=[$ZSH_VERSION]"; getent passwd sysadmin | cut -d: -f7SHELL=/bin/zshBASH_VERSION=[]ZSH_VERSION=[5.9]/bin/zsh$bash -c 'echo "under bash -c: BASH_VERSION=$BASH_VERSION"'under bash -c: BASH_VERSION=5.2.26(1)-release
```
Note
There is no partial credit for a script that nearly ran. The grader looks at the end state, so a .bashrc that was never read or a bash-only construct that failed silently costs you the whole task.

echo $SHELL is worth ten seconds at the start. On these hosts the login shell is zsh, so $BASH_VERSION is empty - and every guide on this path that depends on the difference runs bash -c explicitly and says why.

Practise on a live system, not on flashcards. That is the whole argument of this path: the exam asks you to do things, so the pages show things being done.

Which changes what practice looks like. Reading a command is not practising it. Every page on this path was captured by running the commands on a real machine, so they can be re-run rather than read - and re-running them is the preparation.

Verify your own work before moving on. The grader checks the end state after you leave, so a task you believe you finished and did not is worth zero. systemctl is-enabled, findmnt, getent - confirm the change took, every time.

Expected resultSHELL=/usr/bin/zsh with an empty BASH_VERSION, and a version appearing only once the same question is asked under bash -c.

Success conditionYou will not lose exam minutes to a shell that is not the one you assumed.

Troubleshooting

Revision assumes one distribution and the exam offers a choice.

Why: LFCS is distribution-neutral: you pick the family at the start, and the tooling differs - apt/ufw/netplan against dnf/firewalld/NetworkManager.

Fix:Learn both spellings of the four things that differ - package manager, firewall, network configuration and the SELinux/AppArmor layer. Everything else is the same command on both.
A script that works when pasted fails when run from a file.

Why: These hosts log in to zsh, so $BASH_VERSION is empty and the interactive shell is not the one your script runs under.

Fix:Give every script an explicit #!/bin/bash, and check inside it rather than trusting the login shell. echo $SHELL reports the login shell and says nothing about the script.
The exam is treated as a set of facts to recall.

Why: It is a performance exam: you are given a live machine and graded on the state you leave it in, not on the route you took.

Fix:Practise finishing tasks and verifying them - and remember a task is not done until it survives a reboot, which for a service means enable as well as start.

Official sources

← All LFCS guides

LFCS exam format and lab strategy

This guide includes

Before you start

The machines, and why there are two distributions

The tooling that differs between them

What a performance exam does not give you

Troubleshooting

Official sources