Working a practical exam: order, verification and persistence

Do these on your own system. They get harder. Check each result, then tick it off.

1. Warm-upDone

   Turn a task into checks

   Take this task: "Create a 300 MiB logical volume lvdata in volume group vgapp with 16 MiB extents, format it XFS, and mount it persistently on /srv/data." List every fact a grader could check (at least six) and the command that shows each.

   Check your result

   Facts: partition/PV exists, VG name and PE size 16 MiB, LV name and size about 300 MiB, file system type XFS, mount point /srv/data, persistent entry in /etc/fstab, mounted after reboot. Commands: pvs, vgs -o +vg_extent_size, lvs, lsblk -f, findmnt, grep data /etc/fstab.

   Hint

   For each noun and number in the task there is a check. For each word like "persistent" there is a reboot check.

   Solution

   sudo pvs
   sudo vgs -o vg_name,vg_extent_size
   sudo lvs -o lv_name,lv_size
   lsblk -f
   findmnt /srv/data
   grep /srv/data /etc/fstab
   sudo findmnt --verify

2. PracticeDone

   Choose an order

   You are given these tasks: (1) reset the root password of node2 (needs a reboot); (2) set up NFS autofs for home directories; (3) create users with a shared group; (4) write a script; (5) configure repositories; (6) install packages; (7) extend a logical volume; (8) SELinux web server on a new port. Number them in the order you would do them and say why for each early choice.

   Check your result

   A sound answer puts repositories before package installs, users before shared-directory permissions and NFS homes, the reboot task early or batched, and leaves the most complex task (SELinux web) for when basics are secure.

   Hint

   Prerequisites first (repos before installs, groups before permissions), batch reboots, bank easy points early, keep a time reserve for the hard one.

   Solution

   1. Repositories (everything else installs from them)
   2. Install packages (httpd, autofs, nfs-utils, tuned, ...)
   3. Users and groups (needed by permissions and autofs)
   4. Reset root password on node2 (reboot node2 while node1 work continues)
   5. LVM extend (short, deterministic)
   6. Script (short, deterministic)
   7. NFS/autofs homes (depends on users and node2 being back)
   8. SELinux web server on a new port (longest, depends on packages, firewall)

3. PracticeDone

   Write your own verification cards

   For each objective area write one command (or two) that proves a task is done: users and sudo, password aging, cron, a systemd timer, tuned, default target, NFS mount, autofs, firewall rule, SSH key login, SELinux file context, SELinux port, SELinux boolean, swap, repository, Flatpak. Use the table in this lesson as a model.

   Check your result

   A page of commands where each prints a clear yes/no or the value asked for, e.g. getsebool httpd_can_network_connect prints --> on.

   Hint

   Prefer commands whose output states the answer: is-enabled, get-default, -l, --list-*, getsebool, findmnt.

   Solution

   sudo -l -U harry; chage -l harry; crontab -l -u natasha
   systemctl list-timers report.timer --no-pager
   tuned-adm active; systemctl get-default
   findmnt -t nfs4; automount -m | head
   firewall-cmd --list-all; ssh -o PreferredAuthentications=publickey node2 true
   ls -Zd /srv/web; semanage port -l | grep 8081; getsebool -a | grep httpd_enable
   swapon --show; dnf repolist; flatpak list

4. PracticeDone

   The final reboot

   On your lab, after configuring a few things (a mount, a service, a firewall rule, a SELinux boolean, a kernel argument), run the end-of-exam procedure: mount -a, findmnt --verify, a reboot, then a check that each setting is still in force. Write down what you found that did not survive.

   Check your result

   Everything configured with persistence flags (--permanent, -P, enable, fstab, config files) is present after the reboot. Anything done at runtime only is missing.

   Hint

   The usual failures: firewalld without --permanent, setsebool without -P, systemctl start without enable, setenforce instead of the config file, mount instead of fstab, hostname instead of hostnamectl.

   Solution

   sudo mount -a && sudo findmnt --verify
   systemctl --failed --no-pager
   sudo reboot
   # after the reboot
   findmnt /srv/data; systemctl is-enabled httpd; firewall-cmd --list-all
   getsebool httpd_can_network_connect; cat /proc/cmdline

5. ChallengeDone

   Time budget and a recovery plan

   For a 3-hour practice exam with about 23 tasks, write a budget: time for reading all tasks, per-task limit, a rule for when to skip a task, a reserve for the final reboot and verification, and what you do if a task breaks something that other tasks need (for example a bad /etc/fstab).

   Check your result

   A concrete plan with numbers: e.g. 10 min to read, ~6 min per task, skip at 1.5× budget, 15 min reserve, snapshots impossible in the exam so edit carefully and keep a backup copy of each file you change.

   Hint

   You cannot snapshot in the real exam. Copy a file before you edit it (cp -a file file.bak) and always run the checking command (mount -a, sshd -t, visudo -c) before leaving the file.

   Solution

   0:00-0:10  read every task; mark easy / hard / needs-reboot
   0:10-2:30  work in dependency order; skip any task that passes 1.5x its time
   2:30-2:45  return to skipped tasks
   2:45-3:00  reboot, run the verification card, fix what did not persist
   Safety: cp -a before edits; mount -a / sshd -t / visudo -c / findmnt --verify after.