Domain 1: 201: Capacity Planning
- vmstat reports paging activity, run/blocked process counts, block I/O, and CPU time; the si/so columns show pages swapped in/out per second and should normally read 0.
- free -m distinguishes 'used', 'free', and 'available' memory; because buffers/cache are reclaimable, the 'available' column is the true indicator of memory pressure, not 'free'.
- iostat -x shows per-device %util (approaching 100% means saturation) plus await (average I/O service time); high values indicate the disk is the bottleneck.
- High %iowait in top/iostat means the CPU is idle waiting on I/O; processes stuck in the D (uninterruptible sleep) state are blocked on disk or network I/O.
- sysstat provides sar for historical trend analysis; sadc (the data collector, run via sa1) writes binary records under /var/log/sa/saNN, read back with sar -u -f.
- ps aux --sort=-%mem | head lists the top memory consumers; --sort=-%cpu ranks by CPU usage instead.
- The OOM killer selects a victim process based on its oom_score, biased by oom_score_adj (range -1000 to +1000) to protect or sacrifice specific processes.
- vm.swappiness (0-100) controls how aggressively the kernel swaps; a low value like 1-10 favors keeping pages in RAM, useful for latency-sensitive or database workloads.
- systemd resource limits cap a service via directives such as MemoryMax=512M and CPUQuota=50% in the unit file, enforced through cgroups.
- For trend retention and alerting, feed collected metrics into a time-series monitoring system such as Prometheus, collectd, Nagios, or MRTG rather than relying on point-in-time tools.
Domain 2: 201: Linux Kernel
- modprobe loads a module by name and automatically resolves dependencies via modules.dep, unlike the low-level insmod which loads only one explicit file; modprobe -r unloads modules.
- lsmod formats /proc/modules into a table of loaded modules with their size and the modules that depend on each one; depmod rebuilds modules.dep after adding modules.
- Module options are set persistently in a file under /etc/modprobe.d/ ending in .conf ('options <module> <param>=<value>'); 'blacklist <module>' prevents auto-loading.
- To force a module to load early at boot, list it in a file under /etc/modules-load.d/; modprobe behavior and options stay in /etc/modprobe.d/.
- uname -r prints the running kernel release; an 'invalid module format' error usually means the module was built for a different kernel version than the one running.
- If a needed driver lives in a module, rebuild the initramfs with dracut (Red Hat) or update-initramfs (Debian) so it is available during early boot.
- dmesg reads the kernel ring buffer for hardware probing and driver messages; -T adds human-readable timestamps and -w follows new entries. journalctl -k shows the same kernel log.
- Runtime kernel parameters live under /proc/sys and are volatile; persist them in /etc/sysctl.conf or /etc/sysctl.d/, applied with sysctl -p. The workflow is sysctl -w to test live, then persist once validated.
- /proc is a virtual procfs filesystem populated by the kernel, exposing per-PID directories plus system files like /proc/cpuinfo, /proc/meminfo, and /proc/modules.
- Configuring a custom kernel uses make targets such as oldconfig (refine an existing .config for a new source), defconfig (defaults), and menuconfig (interactive), followed by make and make modules_install.
Domain 3: 201: System Startup
- systemd starts units in parallel based on declared dependencies and supports socket and D-Bus activation to launch services on demand.
- systemctl is the primary control tool: start, stop, restart, enable (autostart), disable, mask, and status. disable removes autostart but still permits manual start; mask symlinks the unit to /dev/null so it cannot start at all until unmasked.
- Ordering and requirements are separate: After=/Before= set sequence, while Wants= (soft) and Requires= (hard) set dependency strength; a network service should use After= and Wants= on network-online.target.
- systemctl set-default <target> sets the boot target (multi-user.target or graphical.target); systemctl list-dependencies <target> shows what it pulls in.
- rescue.target (formerly runlevel 1) gives a minimal single-user maintenance environment; emergency.target is even more minimal with only the root filesystem mounted read-only.
- Restart=on-failure with RestartSec controls automatic restarts; StartLimitIntervalSec and StartLimitBurst prevent rapid crash-loop restarts from running unbounded.
- At the GRUB menu, press 'e' to edit a boot entry and Ctrl-x to boot it; appending rd.break or init=/bin/bash to the linux line drops to a shell for password/recovery. Regenerate config with grub2-mkconfig -o /boot/grub2/grub.cfg (Red Hat) or update-grub (Debian).
- On UEFI systems, efibootmgr manages firmware boot entries and boot order (efibootmgr -o), and Secure Boot can refuse to load unsigned kernels or modules unless signed with an enrolled MOK key.
- A Type=oneshot service runs once and exits; pairing it with RemainAfterExit=yes keeps it reported as active after the process finishes.
- SysVinit concepts still map onto systemd: runlevels correspond to targets, and telinit/init requests are translated, so recognize the legacy equivalents when a question contrasts old and new tooling.
Domain 4: 201: Filesystems and Storage
- Reference filesystems in /etc/fstab by UUID= or LABEL= rather than kernel device names like /dev/sdb1, because device names can change between boots while UUIDs are stable.
- Growing an ext filesystem on LVM is two steps: lvextend -L +10G /dev/vg/lv to enlarge the logical volume, then resize2fs /dev/vg/lv to grow the filesystem; you may first need pvresize and vgextend for room.
- XFS can be grown online with xfs_growfs but cannot be shrunk; repair is done offline with xfs_repair on an unmounted device, and fsck.xfs is effectively a no-op.
- df reports space usage but a filesystem can report full while df shows free space if it has exhausted its inodes; check inode usage with df -i.
- LVM snapshots create an online point-in-time copy of a volume, ideal for consistent backups of a live filesystem without taking it offline.
- mount -o ro mounts a filesystem read-only, useful for safe inspection or recovery; mount -o remount,rw changes it back without unmounting.
- RAID provides disk fault tolerance (mdadm software RAID with levels like RAID1 or RAID6); layering LVM on top of RAID adds flexible logical volume management. Check array state in /proc/mdstat.
- badblocks scans an unmounted device for bad sectors; run it (or a destructive write test) only on filesystems that are not in use, and let smartctl report drive health via SMART attributes.
- Advanced/copy-on-write filesystems: Btrfs and ZFS (zpool/raidz) offer built-in snapshots, checksums, and transparent compression (e.g., lz4), replacing an mdadm+LVM stack in some designs.
- Journaling filesystems (ext4, XFS) protect metadata integrity after a crash; e2image -ra copies only used blocks of an ext filesystem far faster than a raw dd of the whole device.
Domain 5: 201: Networking Configuration
- ip route from iproute2 prints the kernel routing table (destination, via gateway, dev); the legacy route -n shows the same data numerically.
- ip route add default via <gateway> sets the default route and ip route add 10.0.0.0/24 via 192.168.1.1 dev eth0 adds a static route; both are non-persistent and lost on reboot.
- ip addr add <ip>/<mask> dev <iface> assigns an address live; persistence requires a NetworkManager profile (nmcli con add type ethernet, ipv4.method manual) or the distro's interface config files.
- ss -tlnp lists listening TCP sockets numerically with the owning PID and program, replacing the older netstat -tlnp for identifying which daemon owns a port.
- tcpdump uses BPF filter syntax: tcpdump -i eth0 tcp port 443 captures only HTTPS traffic on eth0, and -n disables name resolution for speed.
- Bonding active-backup mode provides failover with no switch configuration, while 802.3ad (LACP) aggregates bandwidth but requires matching switch-side LACP configuration.
- Policy-based routing uses multiple routing tables plus ip rule entries to route by source address, mark, or other criteria rather than destination alone.
- net.ipv4.ip_forward and other network tunables set via sysctl are runtime-only; write them to /etc/sysctl.d/ to persist across reboots.
- Tunnels and VPNs commonly break on MTU/MSS mismatch; lowering the interface MTU or clamping MSS fixes intermittent large-packet failures, and TCP window scaling matters on high-bandwidth, high-latency (long fat) links.
- Wireless clients are configured with wpa_supplicant (wpa_supplicant.conf key_mgmt, ssid, psk) and inspected with iwconfig/iwlist; a hidden SSID needs scan_ssid=1 in the network block.
Domain 6: 201: System Maintenance
- rsync uses a delta-transfer algorithm to send only changed file portions; -aHAX preserves hard links, ACLs, and extended attributes, and --link-dest=<previous-backup> creates space-efficient incremental snapshots via hard links.
- tar preserves permissions, ownership, and timestamps; combine it with a compressor via -z (gzip), -j (bzip2), or -J (xz) to produce .tar.gz, .tar.bz2, or .tar.xz archives. Full, incremental, and differential strategies trade backup size against restore complexity.
- rsyslog routes by facility.priority; a selector like *.info;mail.none;authpriv.none /var/log/messages logs everything at info and above except mail and authpriv. Forward over UDP (single @) for speed or TCP/RELP (@@) for reliable delivery.
- logrotate rotates by size or time, compresses old copies, and runs a postrotate script (e.g., signaling the daemon to reopen its log file); the create and dateext directives control the new file's permissions and naming, and logrotate -d does a dry run.
- journald storage and size are tuned with SystemMaxUse= (total disk cap), MaxRetentionSec= (age cap), and Storage= (volatile vs persistent) in journald.conf; journalctl -b shows the current boot.
- nice -n 19 lowers CPU scheduling priority for a new command and renice 19 -p <pid> adjusts a running one; ionice -c2 -n7 sets best-effort I/O priority and -c3 sets idle, so a batch job does not starve interactive work.
- Installing software from source is the classic ./configure && make && make install flow; keep it out of package-managed paths and prefer checkinstall or a package when possible for clean removal.
- Notify logged-in users of maintenance with wall, and set login banners via /etc/motd (post-login) and /etc/issue (pre-login console).
Domain 7: 202: DNS
- BIND's named reads named.conf; validate the config with named-checkconf and each zone file with named-checkzone before reloading with rndc reload.
- Every zone file begins with an SOA record; forgetting to increment the SOA serial after an edit means secondary (slave) servers never pull the update.
- A secondary (slave) zone receives updates via zone transfers triggered by NOTIFY from the primary, providing redundancy without manual zone editing; allow-transfer restricts who may pull the zone.
- Common record types: A/AAAA (host to IPv4/IPv6), PTR (reverse lookup), CNAME (alias), MX (mail exchanger with priority), NS (delegation), and TXT (SPF/DKIM and verification data).
- dig is the primary query/diagnosis tool (dig @server name type, dig +trace, dig -x for reverse); host and nslookup are simpler alternatives.
- A caching/forwarding resolver (BIND with forwarders, or dnsmasq) reduces upstream query cost and latency for a LAN; DNSSEC adds cryptographic validation of responses.
- Split the roles clearly: an authoritative server answers for zones it owns, while a recursive resolver looks up answers on behalf of clients - mixing them unnecessarily widens the attack surface.
Domain 8: 202: Web Services
- Apache config lives under /etc/httpd (Red Hat) or /etc/apache2 (Debian); validate syntax with apachectl configtest (or httpd -t) before reloading, and enable Debian sites/modules with a2ensite/a2enmod.
- The DocumentRoot directive sets the directory served for a host or virtual host; with name-based virtual hosts the first-listed vhost serves requests whose Host header matches no ServerName or ServerAlias.
- Apache's prefork MPM isolates each request in its own process at higher memory cost, while the event/worker MPM scales many connections cheaply using threads.
- A reverse proxy (Nginx or Apache mod_proxy) fronts application servers to add TLS termination, caching, load balancing, and a single public entry point; a 502 Bad Gateway means the proxy could not reach the backend.
- Enable HTTPS with a certificate and key (Let's Encrypt via certbot automates issuance and renewal); redirect HTTP to HTTPS and disable weak protocols/ciphers.
- Squid is a caching forward proxy for outbound client traffic, distinct from a reverse proxy that sits in front of your own servers.
- Performance tuning includes a PHP opcode cache (opcache) and PHP-FPM/FastCGI to avoid re-compiling scripts, plus TLS session resumption to cut repeat handshake cost.
Domain 9: 202: File Sharing
- Samba's smbd implements SMB/CIFS for Windows-compatible file and printer sharing; nmbd handles NetBIOS name resolution, and a Linux host can serve shares to or join a Windows/AD network.
- smb.conf defines global settings and per-share sections ([share] with path, valid users, read only); testparm validates the file and shows the effective configuration.
- NFS exports are declared in /etc/exports (path plus client and options like rw, ro, root_squash, sync); apply changes with exportfs -ra and list active exports/clients with showmount -e.
- NFS mount tuning uses rsize/wsize for larger read/write blocks; write-critical data should avoid async exports to prevent loss on a server crash, and NFSv4 consolidates ports and adds stronger security.
- smbclient -L //server lists shares and smbclient //server/share connects like an FTP client; mount.cifs mounts a share persistently via /etc/fstab with a credentials file.
- FTP servers such as vsftpd share files over FTP; chroot_local_user confines users to their home directory, and anonymous access should be disabled unless explicitly required.
- Choose the protocol by client: SMB/CIFS for Windows interoperability, NFS for Unix/Linux-to-Linux sharing with better performance in homogeneous networks.
Domain 10: 202: Network Client Management
- A DHCP server (ISC dhcpd, /etc/dhcp/dhcpd.conf) leases addresses from a subnet range and hands out options such as routers, domain-name-servers, and (for PXE) next-server and filename to boot legacy BIOS or UEFI clients.
- PAM (/etc/pam.d/<service>) stacks modules by type - auth, account, password, session - with control flags (required, requisite, sufficient); pam_pwquality/pam_pwhistory enforce password rules and pam_tally2/pam_faillock lock accounts after failures.
- OpenLDAP's slapd serves a directory; ldapsearch/ldapadd query and modify entries described in LDIF, and the DIT is organized under a base DN such as dc=example,dc=com.
- For centralized login, configure the name-service switch (/etc/nsswitch.conf: passwd/group/shadow: files ldap) and an auth client such as SSSD, which caches directory lookups for offline use.
- NIS (ypbind/ypcat) is the legacy directory service; recognize it and its domainname concept, but prefer LDAP/SSSD on modern systems.
- FreeRADIUS provides centralized network access authentication (802.1X, VPN, Wi-Fi), separating the identity store from the devices that enforce access.
- Diagnose client integration with getent passwd <user> (does the name resolve through nsswitch) and id <user> (are the expected groups returned).
Domain 11: 202: E-Mail Services
- Postfix reads main.cf (parameters like myhostname, mydestination, inet_interfaces) and master.cf (service processes); relayhost = [smtp.isp.example]:587 routes outbound mail through a smart host.
- The mail path splits into roles: an MTA (Postfix, Sendmail, Exim) transfers mail over SMTP, an MDA delivers it to mailboxes, and clients retrieve it via a POP3/IMAP server.
- A typical stack pairs Postfix as the MTA with Dovecot as the IMAP/POP3 store; transport_maps route specific domains to designated relays, and Postfix reloads main.cf/master.cf with postfix reload.
- Local delivery aliasing lives in /etc/aliases (e.g., root: admin@example.com); run newaliases (postalias) after editing so the binary alias database is rebuilt.
- Manage the queue with postqueue -p (or mailq) to view and postqueue -f to flush; a growing deferred queue signals a delivery or DNS/MX problem.
- Message filtering and sorting on delivery is done with procmail or, on the server side, Sieve rules executed by the MDA.
- Authenticated submission uses port 587 (submission) with STARTTLS and SASL, keeping port 25 for server-to-server transfer; SPF, DKIM, and DMARC (published in DNS) protect deliverability.
Domain 12: 202: System Security
- OpenSSH server config is /etc/ssh/sshd_config; harden with PermitRootLogin no (or prohibit-password) and PasswordAuthentication no using key-based authentication, effective after reload.
- StrictModes in sshd rejects key auth if ~/.ssh or authorized_keys is group/other-writable or the home directory is writable by group/other; fix the permissions. ssh -L/-R set up local/remote port-forwarding tunnels.
- nftables is the modern netfilter framework configured with nft; nft -f loads a complete ruleset atomically and it supersedes iptables. Persist iptables rules with iptables-save/iptables-restore.
- A default-deny inbound policy with explicit allow rules for required ports is the baseline; SYN-flood mitigation uses net.ipv4.tcp_syncookies and connection rate-limiting (nftables limit or iptables hashlimit).
- fail2ban watches auth logs and bans offending IPs via firewall rules; TCP wrappers (/etc/hosts.allow, /etc/hosts.deny) provide an additional host-based access layer for supporting daemons.
- OpenVPN and IPsec build encrypted site-to-site or client tunnels; combine with a floating/virtual IP (keepalived/VRRP) for gateway failover.
- Verify integrity and identity: GnuPG (gpg) signs/encrypts and verifies signatures, OpenSSL inspects X.509 certificates (openssl x509 -text/-dates), AIDE detects file tampering against a baseline, and OpenSCAP audits against policy.
- Reduce and audit privilege: grant least privilege via sudoers, drop unneeded services to shrink the attack surface, restrict file capabilities (getcap/setcap), and record sensitive actions with auditd (auditctl -w, ausearch).
LPIC-2 exam tips
- The domains map directly to the two exams: 201 = Capacity Planning, Linux Kernel, System Startup, Filesystems and Storage, Networking Configuration, System Maintenance; 202 = DNS, Web Services, File Sharing, Network Client Management, E-Mail Services, System Security. Study each exam as its own block.
- Know the persistence boundary cold: ip addr/ip route, sysctl -w, and modprobe options are all volatile, while /etc/sysctl.d/, /etc/modprobe.d/, NetworkManager profiles, and iptables-save make them survive a reboot. The exam loves to ask which command persists a change.
- For each network service, memorize the daemon name, its main config file, and its syntax-check command: sshd_config; httpd/apache2 + apachectl configtest; named.conf + named-checkconf/named-checkzone; main.cf for Postfix; smb.conf + testparm; dhcpd.conf.
- Distinguish systemd verbs precisely: enable vs start, disable vs mask, Wants vs Requires, After vs network-online.target. These nuanced differences appear repeatedly.
- Read interpretation of monitoring output is heavily tested: nonzero si/so means swapping, high %iowait plus D-state processes means I/O bottleneck, and 'available' (not 'free') memory is the real metric.
Study guide FAQ
How is the LPIC-2 certification structured and what does each exam cover?
LPIC-2 requires passing two 90-minute exams, 201 and 202, each with about 60 questions. LPI reports each result as a scaled score (roughly 200-800) rather than a fixed percentage. The 201 exam covers capacity planning, the Linux kernel, system startup, filesystems and storage, networking configuration, and system maintenance; the 202 exam covers DNS, web services, file sharing, network client management, email services, and system security. You must hold an active LPIC-1 to receive the LPIC-2 certificate.
How much of the exam is command-line recall versus conceptual?
A large share is exact command, option, and file-path recall: you must know flags like rsync -aHAX, ss -tlnp, lvextend -L +10G, and config paths such as /etc/ssh/sshd_config and main.cf. The remainder tests diagnosis and architecture, such as interpreting vmstat/iostat output or choosing active-backup versus 802.3ad bonding. Fill-in-the-blank questions give no answer choices, so spelling commands correctly matters.
Do I need to know both systemd and the legacy SysV/init tooling?
Focus primarily on systemd, since it is dominant on current distributions: systemctl, unit dependency directives, targets, journald tuning, and systemd timers. You should still recognize legacy equivalents (runlevels mapping to targets, cron versus timers, route versus ip) because questions sometimes contrast the old and new tools or ask which modern command replaces a deprecated one.
Is the exam tied to a specific distribution like Red Hat or Debian?
No, LPIC-2 is intentionally distribution-neutral, but it expects you to know where both families differ. The classic split is config locations such as /etc/httpd versus /etc/apache2 and grub2-mkconfig versus update-grub. Expect questions that hinge on knowing both Red Hat-family and Debian-family conventions rather than assuming one.