LFCS Study Plan
The LFCS blueprint lays out what the exam covers; this page decides when you study each part, for how long, and — because this is the one exam on this shelf that is performance-based rather than multiple choice — how. Five domains, and they are not five equal boxes: Operations Deployment and Networking are 25% each, half the paper between just two domains, while Storage and Essential Commands take 20% apiece and Users and Groups closes out at 10%. Every study block below pairs a short read on the blueprint page with real hands on a real Linux terminal, because a multiple-choice trick — recognizing the right answer among four — does not exist on this exam. The grader logs into the machine you leave behind and checks whether the thing you were asked to build actually works. This plan is built around that fact from day one.
Most tests ask you to circle the right answer. This one hands you a real bike with a flat tire, a wrench, and two hours, then checks whether the tire actually holds air afterward — no credit for describing how you'd fix it. So the only way to practice for it is to actually fix flat tires, over and over, not to read a book about tires. This plan gives you a little bit of real wrench-time every single day for four weeks, spends the most days on the two biggest jobs (the engine and the chain — together half of what gets graded), and finishes with one full timed run at a whole broken bike before you ever book the real test.
systemctl command or a partition table, exactly the unhurried pace this exam rewards; Benny turns every reading into something actually built and tested on a machine before the day is over.Spend the calendar where the marks are — two domains are half the exam
☺ Like you're 10: Don't give all five topics the same number of days. Give the two biggest ones — together worth half your grade — half your calendar.
The Linux Foundation is unusually generous here: unlike some vendor exams that hide their weighting, LFCS publishes exact percentages for all five domains. Read the full domain table and every named competency on the LFCS blueprint first if you haven't already — this page assumes you know what each domain covers and focuses purely on pacing and practicing it.
Turned into a 28-day, 40-hour domain-study budget, split by weight — every hour below is terminal time, not reading time:
| Domain | Weight | Hours (of 40) | Where it lives on the calendar |
|---|---|---|---|
| Operations Deployment | 25% | 10h | Days 2–8 |
| Networking | 25% | 10h | Days 9–15 |
| Storage | 20% | 8h | Days 16–20 |
| Essential Commands | 20% | 8h | Days 21–24 |
| Users and Groups | 10% | 4h | Days 25–26 |
| Total | 100% | 40h | + 2h cold diagnostic (day 1) + 2h timed mock (day 27) + 1h light review (day 28) = 45h over 28 days |
LFCS is the only exam on this nine-certification shelf that is performance-based rather than multiple choice, and that changes what an "hour of study" even means. On a knowledge exam, reading a page and answering a practice question both count. Here, reading about LVM without ever running pvcreate teaches you almost nothing the grader can see. Every hour in the table above assumes a real Linux terminal open in front of you — a laptop VM is enough — because the only skill this exam actually measures is whether your hands, not your recognition memory, produce a working system.
A two-minute readiness check before day one
☺ Like you're 10: Four weeks is a guess that fits most people. Get your practice machine ready first, and be honest about how shaky your basic Linux is before you start the clock.
This plan assumes you have one throwaway Linux VM you can become root on — a local VM under Multipass, VirtualBox or libvirt/KVM is ideal, since Operations Deployment's own "manage virtual machines (libvirt)" competency means you'll want a hypervisor around anyway; a cheap cloud instance works too. The exam has been distribution-agnostic since May 2023, so no single distro is officially required, but since one Operations Deployment competency names SELinux specifically rather than "a mandatory access control system," a Fedora-family distro (Fedora, Rocky, AlmaLinux) is the safer practice target than Debian/Ubuntu's AppArmor-based defaults — a strong hint from the competency wording itself, not an official confirmation. If you already administer Linux servers day to day and know your way around both apt and dnf without thinking, compress this to two weeks: skip straight to whichever domains feel least automatic — usually Storage's automounters or the newer nft syntax — and use the extra time for the mock and its follow-up. If you're comfortable with Kubernetes and cloud platforms but raw Linux administration — LVM, systemd units, packet filters — feels like someone else's job, run the full 28 days as written; this is exactly the candidate this plan targets, and it's the same gap Linux Fundamentals for Platform Engineers exists to close. If a terminal still feels unfamiliar beyond cd and ls, spend a weekend first just living in a shell — piping commands, editing files with vim or nano, reading man pages — before day one, because every day of this plan assumes basic command-line fluency already in hand.
The 28-day schedule
☺ Like you're 10: Here's the whole four weeks on one strip — a full quarter of it is just the two biggest domains.
The bar below is the table beneath it, drawn to scale. Block width is set by day count. Notice how much of the strip Operations Deployment and Networking take up together — that's the 50% they represent, made visible.
| Days | Focus | What to do |
|---|---|---|
| 1 | Cold diagnostic | Sit a full hands-on mock, untimed, on your practice VM before reading anything. It measures your starting map, not your grade. |
| 2–8 | Operations Deployment (25%) | Processes & services, job scheduling, packages, VM management (libvirt), container engines, SELinux, recovery from failure. |
| 9–15 | Networking (25%) | IPv4/IPv6 & hostname resolution, time sync, troubleshooting, OpenSSH, packet filtering & NAT, static routing, bridging & bonding, reverse proxies. |
| 16–20 | Storage (20%) | LVM, the virtual filesystem, filesystem creation & repair, remote filesystems, swap, automounters, storage performance. |
| 21–24 | Essential Commands (20%) | Git basics, service troubleshooting, performance monitoring, disk-space forensics, SSL certificates. |
| 25–26 | Users and Groups (10%) | Local accounts, environment profiles, resource limits, ACLs, LDAP-backed accounts. |
| 27 | Timed mock exam | A full two-hour, closed-book run against a real VM, exactly as the real exam is graded. |
| 28 | Light review | Logistics check, a slow pass through the glossary, flashcards. No new material. Early night. |
Week 1 close-up — Operations Deployment, a quarter of the exam on its own
☺ Like you're 10: This week is "keep the machine running and install what it needs" — the engine room.
Start with processes and services, since half the exam's incident-style tasks reduce to "something isn't running — fix it." systemd & journald covers the mechanics in depth; here, drill the loop until it's automatic.
# diagnose, then act systemctl status crond.service # state, PID, last log lines systemctl list-units --failed # everything that failed to start journalctl -u crond -p err --since "1 hour ago" systemctl enable --now chronyd # enable AND start in one command # job scheduling — three mechanisms, all examinable crontab -e # per-user recurring jobs echo "tar czf /backup/daily.tgz /data" | at now + 5 minutes systemctl list-timers # systemd timers — the modern alternative to cron
Package management is where "distribution-agnostic" bites hardest: the exam won't tell you which family you're on, so know both idioms cold, including the query-first habit that keeps you from installing blind.
| Task | Debian family (apt) | RHEL family (dnf) |
|---|---|---|
| Search a repo | apt search nginx | dnf search nginx |
| Install | apt install nginx | dnf install nginx |
| Which package owns this file? | dpkg -S /usr/sbin/nginx | rpm -qf /usr/sbin/nginx |
| List installed | dpkg -l | rpm -qa |
Virtual machines and containers are both "workloads a Linux host manages," just at different weights, and the exam names both explicitly:
# libvirt — VM management
virsh list --all
virsh start mission-vm
virsh dominfo mission-vm
virsh net-list --all # libvirt's own virtual networking
# a container engine — create, manage, inspect
podman run -d --name web -p 8080:80 nginx:latest
podman ps
podman inspect web --format '{{.State.Status}}'
podman logs webClose the week with SELinux, the competency most self-taught sysadmins skip because their daily distro doesn't ship it by default.
getenforce # Enforcing, Permissive, or Disabled ls -Z /var/www/html # SELinux context on a file semanage fcontext -a -t httpd_sys_content_t "/srv/web(/.*)?" restorecon -Rv /srv/web # apply the context you just declared audit2allow -a -M mypolicy # turn AVC denials into a loadable policy
Operations Deployment says "create and enforce MAC using SELinux" — not "a mandatory access control system." That specificity is a genuine tell, since Debian and Ubuntu ship AppArmor instead. If your daily driver is Debian-family, spend an extra hour this week on a Fedora-family VM getting getenforce, contexts and audit2allow comfortable, rather than assuming AppArmor experience transfers — it doesn't, the concepts rhyme but the tools don't.
Week 2 close-up — Networking, the other quarter
☺ Like you're 10: This week is "make two machines talk to each other, safely and on time" — wires, addresses, and locks on the door.
Modern tools only — the exam is current, and ifconfig/netstat-era muscle memory costs you time translating under pressure.
# addressing, resolution, and the clock ip -br addr ; ip route nmcli con mod eth0 ipv4.addresses 10.0.0.15/24 ipv4.gateway 10.0.0.1 nmcli con mod eth0 ipv6.method auto resolvectl status # what resolver is this host ACTUALLY using? chronyc tracking # offset from the time server, right now chronyc sources -v # which servers, and how good is each one? # monitor and troubleshoot ss -ltnp # who is listening, and which process owns it dig +short api.internal @10.0.0.53 # ask a specific server, bypass host config ip -s link show eth0 # drop/error counters — is the NIC actually healthy?
OpenSSH, both sides, is its own named competency — practice generating a keypair, deploying it, and locking the server down, not just connecting with a password.
ssh-keygen -t ed25519 -f ~/.ssh/mission_ed25519 ssh-copy-id -i ~/.ssh/mission_ed25519.pub dot@10.0.0.15 # /etc/ssh/sshd_config — the server side of the exam's own trust model PermitRootLogin no PasswordAuthentication no AllowUsers dot benny
Then packet filtering, routing and the two "wire two things together" competencies people under-practice because they sound niche:
# nftables — the modern packet filter
nft add table inet filter
nft add chain inet filter input { type filter hook input priority 0 \; }
nft add rule inet filter input tcp dport 22 accept
nft add rule inet filter forward ip saddr 10.0.0.0/24 masquerade # NAT
ip route add 192.168.50.0/24 via 10.0.0.254 # static routing
# a bridge and a bond, via NetworkManager
nmcli con add type bridge ifname br0
nmcli con add type bond ifname bond0 mode active-backup
# a reverse proxy — one line of the shape the exam expects you to write
# /etc/nginx/conf.d/upstream.conf
# location / { proxy_pass http://127.0.0.1:8080; }You've now covered 50% of the exam's weight in two weeks — the entirety of Operations Deployment and Networking — which means from day 16 onward, every remaining domain is worth less than either week you just finished. That's the whole argument for front-loading the calendar this way: the two hardest, highest-value domains get full attention while your energy is freshest, not squeezed in at the end.
Week 3 close-up — Storage, then Essential Commands
☺ Like you're 10: First, where things are actually kept and how much room is left. Then, a grab-bag of tools every real sysadmin reaches for daily.
Storage (days 16–20) starts and ends with LVM — the layer between raw disks and the filesystems that sit on them, and the domain's single most commonly examined sequence.
pvcreate /dev/sdb /dev/sdc vgcreate data_vg /dev/sdb /dev/sdc lvcreate -n app_lv -L 20G data_vg mkfs.xfs /dev/data_vg/app_lv mount /dev/data_vg/app_lv /srv/app echo "/dev/data_vg/app_lv /srv/app xfs defaults 0 2" >> /etc/fstab # grow it live — a very common task shape lvextend -r -L +10G /dev/data_vg/app_lv # -r resizes the filesystem too, in one step
Then the rest of the domain: remote filesystems, swap, and automounters, which quietly save you from hardcoding every mount in /etc/fstab.
mount -t nfs 10.0.0.20:/export/data /mnt/data # remote filesystem mkswap /dev/data_vg/swap_lv ; swapon /dev/data_vg/swap_lv # autofs — mounts appear on access, unmount themselves when idle # /etc/auto.master # /mnt/auto /etc/auto.data # /etc/auto.data # data -fstype=nfs 10.0.0.20:/export/data iostat -xz 1 5 # storage performance, five samples
Essential Commands (days 21–24) is a deliberately mixed bag — Git, service troubleshooting, performance monitoring, disk-space forensics and SSL certificates — but it isn't as new as it looks.
# git — the basic operations named in the competency git clone git@git.internal:platform/configs.git git add . ; git commit -m "add nginx upstream config" ; git push git log --oneline -5 ; git diff HEAD~1 # disk-space forensics — the classic "df says full, du disagrees" hunt df -hT du -xhd1 /var | sort -h | tail # who actually ate the space? lsof +L1 # a deleted-but-still-open file, holding space hostage # SSL certificates — generate, inspect, verify openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes openssl x509 -in cert.pem -noout -dates -subject # validity window and CN, fast openssl s_client -connect api.internal:443 -servername api.internal
Essential Commands' "create, configure and troubleshoot services" reads like a repeat of Operations Deployment's process-and-service competency from Week 1 — and functionally, it mostly is. If you drilled systemctl/journalctl thoroughly then, this part of Week 3 is largely free review; spend the reclaimed time on SSL certificates and the du/lsof disk-space hunt instead, since those are the genuinely new skills this domain adds.
Week 4 — Users and Groups, then revision and the timed mock
☺ Like you're 10: The smallest topic first, then one full honest practice run at the whole thing before you spend real money.
Users and Groups (days 25–26) is the lightest domain at 10%, but still worth two full days — accounts, environment, limits, ACLs and LDAP all show up as separate named competencies.
useradd -m -G developers -s /bin/bash dot passwd dot groupadd platform-admins ; usermod -aG platform-admins dot # environment profiles — system-wide vs. per-user echo 'export EDITOR=vim' > /etc/profile.d/editor.sh tail -3 ~/.bashrc # resource limits — /etc/security/limits.conf, enforced via PAM echo "dot soft nofile 4096" >> /etc/security/limits.conf ulimit -a # what's actually in force, right now # ACLs — finer-grained than owner/group/other setfacl -m u:dot:rx /srv/app getfacl /srv/app # LDAP-backed accounts — client-side config the exam expects you to recognize grep -E 'passwd|group' /etc/nsswitch.conf # should list 'sss' or 'ldap' alongside 'files' id dot # resolves through nsswitch, wherever the account lives
| Day | What you do |
|---|---|
| 27 | Sit a full timed, two-hour mock on your practice VM — closed book, root via sudo -i, man pages only, exactly the constraints of the real exam. Score it honestly against 67%. |
| 28 | Light recall only — flashcards, a slow pass through the glossary, a logistics check against the table below. No new material. Early night. |
Clear day 27's mock comfortably above 67% and you can book the real exam. Land right on the line, and hold off one more day: patch whichever domain the mock exposed, run one more focused session against the LFCS practice tasks, and re-check before committing a date — one score near the line is noise, a second clean pass is signal.
"I was sure LVM was my strong suit — I'd run pvcreate and lvextend a dozen times in practice. Then the mock's storage task said 'the volume group is out of physical extents, and no more disks are attached.' I sat there for ten minutes assuming I'd misread it, because every drill I'd done assumed there was always another disk to add. There wasn't one this time — the actual task was shrinking a different, mostly-empty logical volume first to free up extents, then growing the one that needed it. Every rep I'd done was the happy path. The mock was the first time I hit the version of the question where the easy answer isn't available."
(Composite, illustrative account — not a specific person's story.)
Exam-day logistics — verify before you book
☺ Like you're 10: Two hours, at a real terminal, someone watching on camera, about four hundred and forty-five dollars, and a second try included in the price.
These figures come from the Linux Foundation's own LFCS certification page and its candidate-facing exam instructions, read in 2026. This is the one exam on the shelf that shares its format and proctoring platform with the CNPE — worth sitting early for that reason alone, as a low-stakes rehearsal of a format you may meet again.
| Item | Per the official pages, as of writing |
|---|---|
| Assessment type | Performance-based — real tasks solved from the command line on a live system. No multiple choice. |
| Number of tasks | 17–20 performance-based tasks. |
| Duration | 2 hours. |
| Passing score | 67% — this plan's mock target matches it exactly. |
| Delivery | Online, remote-proctored via streaming audio, video and screen sharing. One active monitor only — dual monitors are not supported. |
| Environment | Linux terminal; root available via sudo -i; some tasks direct you to SSH to designated hosts. Distribution-agnostic since the May 2023 update. |
| Allowed resources | Man pages and documentation installed by the distribution itself, from within the exam terminal. No external research. |
| Price | $445 USD exam-only; bundles run higher with a subscription or a companion course. |
| Attempts included | Two — your initial sitting plus one retake, included in the price. |
| Eligibility window | 12 months from purchase to schedule and sit the exam. |
| Exam simulator | Included, via Killer.sh — two simulation sessions, each with 36 hours of access. |
| Certification validity | 2 years from the date you pass, for exams taken from 1 April 2024 onward — older guides quoting three years describe the retired policy. |
| Prerequisites | None. |
| The retired LFCE | The LFCE was retired 1 May 2022 with no direct replacement. LFCS is the ceiling of this track — the realistic next steps are sideways, into CKA/CKS or one of this course's other project certifications. |
This is an independent, unofficial study resource — not affiliated with or endorsed by the CNCF or The Linux Foundation. Duration, task count, price, retake policy, eligibility window, certification validity and even domain weights are all revised by the Linux Foundation over time. Before you register or pay for anything, read the current official LFCS page and candidate handbook yourself. If anything on this page disagrees with them, they are right and this page is stale.
↗ Official LFCS page — Linux Foundation ◆ Candidate handbook
Foxy: Two hours, no multiple choice, and someone actually grades whatever state you leave the machine in? That sounds terrifying compared to the other exams here.
Sol: Only if you rush it, Foxy. Twenty-eight days, one domain at a time, hands actually on a keyboard every single day — never just reading about it.
Gizmo: Or — hot tip — skip Storage, it's only 20%. Cram Networking instead, it's the fun one. 😈
Timmy: Operations Deployment and Networking are both 25%, Gizmo. That's half the exam right there between just two domains — skip either one and you've halved your own ceiling before you've even started.
Benny: And you can't fake your way past it. No guessing among four options — the grader logs into your VM and checks whether the logical volume you built actually mounts.
Sol: ...which is exactly why every domain gets real time at a real terminal. Slow and thorough beats fast and half-finished, every day of these four weeks.
Remy: Say it back: five domains — Ops Deployment 25%, Networking 25%, Storage 20%, Essential Commands 20%, Users and Groups 10%. Two hours, seventeen to twenty tasks, sixty-seven percent to pass, two attempts included.
Back up a level to see how LFCS sits beside the rest of the shelf at The Project Certifications, or go straight to the practice bank this plan points at throughout: LFCS Practice Tasks.
1. Which two domains are worth 25% each, and what fraction of the exam do they represent together? 2. Why does this plan insist every study hour happen at a real terminal, rather than counting reading time the way a knowledge exam's study plan might? 3. Name all five LFCS domains in weight order, highest to lowest. 4. What changed about the exam in May 2023, and why does that matter for study guides written earlier? 5. What happened to the LFCE, and what should you tell someone showing you an old "LFCS then LFCE" career path? 6. What score should the timed mock clear before you book the real exam, and how long is the real exam itself? 7. Name one place in this plan where two different domains' named competencies overlap almost entirely, and what that means for how you spend your time.
Check your answers
- Operations Deployment and Networking, 25% each — together 50% of the exam, half the paper.
- LFCS is performance-based, not multiple choice — the grader checks the actual state of a machine afterward, so recognizing a correct answer among options (what reading builds) doesn't transfer the way it does on a knowledge exam. Only hands-on repetition produces the skill being tested.
- Operations Deployment 25%, Networking 25%, Storage 20%, Essential Commands 20%, Users and Groups 10%.
- The exam became distribution-agnostic — no platform selection in the preparation checklist — and its domains were restated in their current five-domain form. Any study guide written before mid-2023 assumes a distribution choice that no longer exists.
- The LFCE was retired as of 1 May 2022 with no direct replacement, and does not appear in the current catalog. LFCS is the ceiling of this track — the realistic next step is sideways into the core Kubernetes certifications or another project certification on this shelf, not upward to a credential that no longer exists.
- 67%, comfortably cleared rather than just met; the real exam runs 2 hours across 17–20 performance-based tasks.
- Essential Commands' "create, configure and troubleshoot services" (Week 3) overlaps heavily with Operations Deployment's process-and-service competency (Week 1) — if the first was drilled thoroughly, that part of Week 3 is largely free review, and the reclaimed time is better spent on Essential Commands' genuinely new material: SSL certificates and disk-space forensics.