Linux Command Reference
The commands that come up in exam scenarios, grouped by what you are trying to do. The permissions table is the one worth memorizing, because octal notation appears in questions that are not otherwise about permissions.
Linux Command Reference · firsttry.app/cheatsheets/linux-commands · original reference written from published exam objectives. Not affiliated with any certification body.
Files and directories
| Command | What it does |
|---|---|
| ls -la | List all files including hidden, long format |
| find /path -name "*.log" | Find by name under a path |
| find / -size +100M | Find files over 100 MB |
| grep -r "text" /path | Search file contents recursively |
| tail -f /var/log/syslog | Follow a file as it is written |
| du -sh /path | Directory size, human readable |
| df -h | Filesystem usage |
| ln -s target link | Create a symbolic link |
| tar -czvf out.tar.gz dir | Create a compressed archive |
| tar -xzvf in.tar.gz | Extract a compressed archive |
Permissions and ownership
| Command | What it does |
|---|---|
| chmod 755 file | rwx for owner, rx for group and others |
| chmod u+x file | Add execute for the owner |
| chown user:group file | Change owner and group |
| umask 022 | Default permissions mask for new files |
| chmod u+s file | Set SUID. Runs as the file owner |
| chmod g+s dir | Set SGID. New files inherit the group |
| chmod +t dir | Sticky bit. Only the owner may delete |
| getfacl / setfacl | Read and set access control lists |
Octal permissions
| Octal | Symbolic | Meaning |
|---|---|---|
| 7 | rwx | Read, write, execute |
| 6 | rw- | Read, write |
| 5 | r-x | Read, execute |
| 4 | r-- | Read only |
| 3 | -wx | Write, execute |
| 2 | -w- | Write only |
| 1 | --x | Execute only |
| 0 | --- | No access |
Processes, services and networking
| Command | What it does |
|---|---|
| ps aux | All running processes |
| top / htop | Live process view |
| kill -9 PID | Force terminate a process |
| systemctl status nginx | Service state |
| systemctl enable --now nginx | Start and enable at boot |
| journalctl -u nginx -f | Follow one service's logs |
| ip addr | Interface addresses |
| ip route | Routing table |
| ss -tulpn | Listening sockets with process names |
| dig example.com | DNS lookup |
| traceroute example.com | Path to a host |
Exams covered
Try it here
Three verified practice questions on this material. Answer one, and see the official page behind the answer.
1-4System Management
An administrator wants a cron job every Sunday. In the day-of-week field, which value means Sunday?
Deploy, configure, and maintain systems
A technician needs the authentication failures for a host. Which file under /var/log holds them?
Troubleshooting
An engineer wants detailed information about the overall health of a cluster from one command rather than object by object. Which command produces it?
Five free questions on every practice exam. No account, no card.