Linux Foundation Certified System Administrator Roadmap

Weeks 1–2: develop a fast evidence loop before broad configuration work.

• Navigate, create, copy, move, remove, archive, search, filter, compare, and redirect safely.
• Understand paths, inodes, hard and symbolic links, modes, ownership, umask, setgid, sticky directories, and ACL masks.
• Inspect process identity, parentage, state, CPU, memory, I/O, files, sockets, signals, and exit status.
• Use systemctl for status, start, stop, restart, reload, enable, dependencies, properties, and failed-state recovery.
• Use journal evidence and application logs without assuming a restart is a diagnosis.
• Create service and timer units with dedicated identities, dependencies, resource limits, and durable logs.
• Practice safe shell expansions, explicit checks, bounded destructive operations, and useful exit codes.
• Complete the first service-host project through baseline and systemd setup.

Weeks 3–4: make software, kernel, container, VM, and security state durable and diagnosable.

• Configure runtime and persistent kernel parameters and verify after reboot.
• Search, install, validate, update, and remove packages through trusted repositories.
• Treat signature failure as a trust problem, not an obstacle to bypass.
• Manage container images, runtime instances, networks, volumes, identities, and resource limits.
• Operate libvirt guests, storage pools, networks, definitions, and service logs.
• Use SELinux audit evidence to correct labels, Booleans, ports, and narrow policy in enforcing mode.
• Practice boot and filesystem recovery from snapshots while protecting the base exam or lab host.
• Complete Operations Deployment questions 1–7 and 26–31.

Weeks 5–6: configure and troubleshoot one packet path at a time in both directions.

• Persist IPv4 and IPv6 addresses, routes, hostnames, resolver behavior, and time synchronization.
• Inspect links, addresses, neighbors, routes, rules, sockets, DNS responses, service probes, and bounded captures.
• Configure OpenSSH with synthetic keys, safe ownership and modes, source restrictions, and console recovery.
• Create staged packet-filter rules and verify established, allowed, denied, and persistence behavior.
• Enable forwarding and scoped NAT while validating return routing and connection tracking.
• Build bond and bridge layers without duplicate Layer 3 identity or loops.
• Configure a reverse proxy and distinguish backend, DNS, TLS, policy, and service-context failures.
• Complete Networking questions 8–13 and 32–37 plus the gateway project.

Weeks 7–8: operate each storage and identity layer independently, then test their interaction.

• Identify block devices safely; build PVs, VGs, LVs, filesystems, mount points, fstab, and swap.
• Grow both the logical volume and filesystem, then verify capacity at each layer.
• Diagnose block pressure, inode exhaustion, deleted-open files, I/O latency, queues, errors, and mount state.
• Use filesystem-specific repair tools only in the documented safe state.
• Configure NFS and automount behavior with deliberate integrity, timeout, identity, and boot choices.
• Create users and groups, lock and offboard accounts, manage profiles and resource limits, and test new-login behavior.
• Use access and default ACLs while understanding the ACL mask and directory inheritance.
• Trace centralized identity across NSS resolution, PAM authentication, account policy, TLS, home, shell, and service rules.

Week 9+: practice outcomes, persistence, validation, and time management rather than command memorization alone.

• Read the requested end state, identify the designated host, and inspect current state before changing it.
• Use the narrowest command sequence that meets the requirement and preserves unrelated configuration.
• Verify runtime state, persistent configuration, service behavior, permissions, network direction, and reboot behavior when relevant.
• Practice moving among designated lab hosts without confusing contexts; keep the base host constraints visible.
• Use man pages and installed distribution documentation efficiently during authorized practice.
• Complete all three projects with fault injection, backup or rollback, evidence, and teardown.
• Answer all 50 original scenarios and review all 40 unique cards through hands-on reproduction.
• Run timed two-hour rehearsals, but do not infer an official result from a practice score.