Back to cert prep

Practice area

LPIC-1 101: System Architecture

Identify the hardware, kernel, service manager, boot state, failed units, and safe restart path before changing startup behavior.

Linux One Liners is an independent study and practice resource. It is not affiliated with, endorsed by, or approved by LPI, The Linux Foundation, CompTIA, or any certification provider. This site does not provide exam dumps or real exam questions.

Source status

Source status: LPI LPIC-1 overview verified July 3, 2026. Current version 5.0; exams 101-500 and 102-500.

This page paraphrases study areas into command practice. It does not copy official objective text wholesale and is not an exam dump.

Plain-English goal

Practice area: system architecture, hardware discovery, boot flow, service targets, and safe shutdown. Exam/domain: 101-500.

read the situation

Command, output, and next step

Command anatomy

uname -a && cat /etc/os-release | sed -n '1,6p'
uname
the command family
flags
change output shape or scope
target
the file, service, user, mount, or host being inspected
output
evidence you must explain before changing state

Annotated output

Usage: command [OPTION]... TARGET
Try 'command --help' for common flags.
Try 'man command' for full reference.

What to notice

Usage
the command shape and expected target
--help
quick option reference
man
full local manual page when installed

Safe vs unsafe move

Common wrong move

Treating a practice command as a permission to make a broad production change.

Next safe command

command --help

Troubleshooting ladder

  1. Name the symptom.
  2. Inspect read-only state.
  3. Find the owner, service, file, device, mount, or route.
  4. Read the decisive output field.
  5. Choose the next narrow command.
  6. Avoid broad or destructive changes.
  7. Make the smallest justified change if required.
  8. Verify and record what changed.

How to get help

  1. Know the commandUse command --help, then man command for the full reference.
  2. Know the conceptUse apropos keyword or man -k keyword to discover command names.
  3. Maybe a shell builtinUse type command, command -V command, then help command.
  4. Service behaviorUse systemctl status service and journalctl -u service before restarting.
  5. Package ownershipUse dpkg -S, rpm -qf, or the distro package tool for the installed file.

Study plan

  1. Start by proving what machine and kernel you are actually on: architecture, kernel release, distribution, virtualization hints, and current boot.
  2. Practice device discovery without changing drivers: PCI, USB, loaded modules, and the sysfs/proc/dev view of hardware.
  3. Trace startup from firmware to boot loader to kernel to init/service manager, then rehearse how to read failed units and boot logs.
  4. Finish with controlled state changes: default target, rescue target awareness, shutdown, reboot, wall messages, and when not to restart.

Command labs

Run these in a lab shell or disposable machine first. The point is to explain the output, not just memorize the command.

Identify system and kernel

uname -a && cat /etc/os-release | sed -n '1,6p'

Kernel, architecture, and distribution facts should agree with the host you intended to inspect.

Annotated output
Usage: command [OPTION]... TARGET
Try 'command --help' for common flags.
Try 'man command' for full reference.

What to notice: Usage, --help, man.

Next safe command: command --help

Review hardware without changing it

lspci | head && lsusb | head && lsmod | head

Device and module rows should give names, bus information, and loaded kernel module context.

Annotated output
Usage: command [OPTION]... TARGET
Try 'command --help' for common flags.
Try 'man command' for full reference.

What to notice: Usage, --help, man.

Next safe command: command --help

Read boot and unit state

systemctl get-default && systemctl --failed --no-pager && journalctl -b -p warning --no-pager | head -40

A default target, any failed units, and recent boot warnings should be visible without changing services.

Annotated output
nginx.service - A high performance web server
   Loaded: loaded (/lib/systemd/system/nginx.service; enabled)
   Active: failed (Result: exit-code) since Fri 2026-07-03 10:12:04 CDT
Jul 03 10:12:04 web01 nginx[2310]: nginx: [emerg] open() "/etc/nginx/nginx.conf" failed (13: Permission denied)

What to notice: Loaded, Active, Result, log message.

Next safe command: nginx -t

command families

Commands to practice

  • uname
  • lsb_release
  • lspci
  • lsusb
  • lsmod
  • modprobe
  • systemctl
  • journalctl
  • shutdown

Related drills

Flashcards

What should you prove before changing boot or service behavior?

Kernel, distro, current boot, init/service manager, failed units, and recent boot logs.

Why inspect loaded modules before using modprobe?

You need to know whether the module is already present and what device/problem you are changing.

What does systemctl get-default tell you?

The target the system tries to reach during normal boot.

What is the safe first move when a service failed at boot?

Read status and journal output before restart attempts.

Quick quiz

Check the reasoning locally in your browser. Answers are not sent anywhere.

A host rebooted into the wrong mode. Which read-only check comes first?
Show answer

Answer: systemctl get-default

Why: Read the configured default target before changing boot state.

  • systemctl reboot: That changes runtime state before reading the output that explains the failure.
  • modprobe -r: That does not answer the question the output is asking you to prove first.
  • shutdown now: That changes runtime state before reading the output that explains the failure.
Which command is best for PCI device inventory?
Show answer

Answer: lspci

Why: lspci lists PCI devices; lsmod lists loaded modules.

  • lsmod: That does not answer the question the output is asking you to prove first.
  • df -h: That does not answer the question the output is asking you to prove first.
  • crontab -l: That does not answer the question the output is asking you to prove first.
Where should you look for boot warnings on a systemd host?
Show answer

Answer: journalctl -b

Why: journalctl -b reads logs from the current boot.

  • chmod -R: That changes access broadly before proving which path component or owner is wrong.
  • apt install: That does not answer the question the output is asking you to prove first.
  • passwd: That does not answer the question the output is asking you to prove first.

visual practice

Boot path visual walkthrough

Walk the machine from firmware to a running target. Each step names the evidence command you would use before changing boot behavior.

Firmware

BIOS or UEFI initializes hardware and chooses a boot device.

bootctl status 2>/dev/null || test -d /sys/firmware/efi && echo UEFI || echo BIOS

Self-test before moving on