RHCE review: certification paths + consistent lesson objectives

docs/course/certification-paths.md

@@ -0,0 +1,124 @@
+# Certification Paths
+
+This course teaches Linux operations in a distro-agnostic way: the goal is a
+durable operator model that works on Red Hat, Debian, Ubuntu, SUSE, and their
+derivatives. That approach maps well onto the major Linux certifications, which
+test the same underlying skills — user and permission management, storage,
+networking, services, logging, security, and automation — even when they use one
+distribution's exact tooling on the exam.
+
+The tables below map this course's chapters to the objective areas of common
+certifications. They are a study aid, not a replacement for each vendor's
+official objective list. Certification objectives and exam versions change over
+time, so always confirm the current objectives on the vendor's site before you
+schedule an exam.
+
+!!! note "How to read these maps"
+    A chapter reference means the course covers the topic area an objective
+    lives in, not that the chapter reproduces the exam word for word. Where an
+    exam is tied to one distribution (RHCSA and RHCE are RHEL-specific), practice
+    the RHEL tooling — `dnf`, `nmcli`, `firewalld`, `systemd`, `podman`,
+    `stratis`, `chrony`, `tuned` — on a RHEL 9 or compatible system such as
+    AlmaLinux 9 or Rocky Linux 9.
+
+## Red Hat Certified System Administrator (RHCSA, EX200, RHEL 9)
+
+RHCSA is a hands-on, task-based exam performed on live RHEL 9 systems. You are
+graded on the state of the system after your work, so practice until the tasks
+are muscle memory. The following chapters cover the RHCSA objective areas.
+
+| RHCSA objective area | Course chapters |
+| --- | --- |
+| Manage users and groups, set password aging | Ch08 (User Management) |
+| Manage file permissions, ACLs, and SELinux contexts and modes | Ch03 (Access Control and Rootly Powers), Ch05 (The Filesystem), Ch27 (Security) |
+| Configure local storage: partitions, LVM, and Stratis | Ch20 (Storage) |
+| Manage systemd services, boot targets, rescue mode, and reset the root password | Ch02 (Booting and System Management Daemons) |
+| Schedule tasks with `cron`, `at`, and systemd timers | Ch04 (Process Control) |
+| Install and manage software with `dnf`, modules, and repositories | Ch06 (Software Installation and Management) |
+| Configure networking with `nmcli` and host firewall with `firewalld` | Ch13 (TCP/IP Networking), Ch14 (Physical Networking), Ch27 (Security) |
+| Find, run, and manage containers with `podman`, including as systemd services | Ch25 (Containers) |
+| Review system journals and logs with `journalctl`, configure time with `chrony` | Ch10 (Logging) |
+| Tune system performance profiles with `tuned` | Ch29 (Performance Analysis) |
+
+!!! tip "RHCSA practice discipline"
+    Two skills decide RHCSA outcomes more than any single command: recovering a
+    system you cannot log in to (boot to `rescue`/`emergency`, break into the
+    root shell, reset the root password, and — on RHEL — relabel SELinux) and
+    making changes persist across reboot. Reboot your practice VM after every
+    task and confirm the change survived.
+
+## Red Hat Certified Engineer (RHCE, EX294, RHEL 9)
+
+On RHEL 9 the RHCE exam (EX294) is entirely about automation with Ansible. You
+write and run playbooks that configure managed RHEL hosts: managing inventories,
+variables, facts, templates, roles, handlers, and using Ansible modules to
+perform the same administration tasks RHCSA tests by hand.
+
+| RHCE (EX294) objective area | Course chapters |
+| --- | --- |
+| Install and configure an Ansible control node, inventories, and configuration | Ch23 (Configuration Management) |
+| Write playbooks, use variables, facts, loops, conditionals, and handlers | Ch23 (Configuration Management), Ch07 (Scripting and the Shell) |
+| Use templates (Jinja2), roles, and Ansible Galaxy content | Ch23 (Configuration Management) |
+| Automate RHCSA-level tasks (users, storage, services, software) with modules | Ch23 (Configuration Management) plus the RHCSA chapters above |
+
+!!! note "Honest scope for RHCE"
+    This course introduces Ansible and configuration management in Chapter 23,
+    and Chapter 07 builds the shell and scripting fundamentals that automation
+    rests on. That is enough to understand the model and start writing
+    playbooks, but it is an introduction rather than full EX294 exam depth. To
+    prepare for RHCE, work through Chapter 23, then study the official Red Hat
+    course material (RH294) and the upstream Ansible documentation, and practice
+    writing idempotent playbooks and roles against RHEL 9 managed nodes until the
+    workflow is automatic.
+
+## CompTIA Linux+ and LPIC-1 (high level)
+
+CompTIA Linux+ (XK0-005) and LPIC-1 are distribution-neutral, which lines up
+well with how this course teaches. They cover a broad base of everyday Linux
+administration rather than one vendor's tooling, so most of the early and middle
+chapters apply.
+
+!!! note "Linux+ (XK0-005) at a glance"
+    Linux+ spans system management, shells and scripting, security, and
+    troubleshooting. Chapters 02-08 cover boot and services, access control, the
+    filesystem, software management, scripting, and users. Chapters 13-15 cover
+    networking and routing. Chapters 20-22 cover storage and shared filesystems.
+    Chapters 23-27 add automation, virtualization, containers, and security, and
+    Chapters 28-31 cover monitoring, performance, and operations practice.
+
+!!! note "LPIC-1 at a glance"
+    LPIC-1 (exams 101 and 102) covers system architecture and boot, package
+    management, the GNU and Unix commands, filesystems and the FHS, shells and
+    scripting, networking fundamentals, and basic security. Chapters 01-08 build
+    the command-line, filesystem, software, and user foundations; Chapters 10-13
+    add logging, the kernel, and networking basics; Chapter 27 covers the
+    security fundamentals LPIC-1 expects.
+
+## How to use this course for exam prep
+
+!!! tip "Turn the operator loop into exam habits"
+    Every lesson reinforces the same five-step loop:
+    **Inspect → Change → Verify → Document → Automate.** Hands-on exams reward
+    exactly this discipline. Inspect the current state before you touch anything,
+    make the smallest change that satisfies the task, verify it with real command
+    output, and — for hands-on exams — reboot and confirm the change persisted.
+    On RHCE, the final step of the loop becomes the whole exam: encode the change
+    as an idempotent Ansible playbook.
+
+Work certification prep like this:
+
+1. Pick a target exam and read its current official objectives.
+2. For each objective area, do the mapped chapter's labs in a disposable VM or
+   container until the task is quick and reliable.
+3. Practice on the exam's distribution when the exam is vendor-specific (RHEL 9
+   or a compatible rebuild for RHCSA and RHCE).
+4. Use the [Capstone](capstone.md) as a full-scope rehearsal: it exercises the
+   operator loop end to end across many chapters, which is close to how a
+   hands-on exam feels — a sequence of realistic tasks under time pressure with
+   evidence that your changes actually worked.
+
+!!! note "The certification is a checkpoint, not the goal"
+    The lasting outcome of this course is the operator's judgment: knowing what
+    to inspect, changing one thing at a time, proving the result, and handing off
+    clean notes. A certification confirms that skill on a given day. Keep
+    practicing the loop after the exam and the credential stays true.

docs/lessons/13_tcp_ip_networking/13.10_linux_networking.md

@@ -7,6 +7,11 @@ operators move through those layers in order instead of guessing at one command.
 This lesson pulls the Chapter 13 pieces together into a practical Linux
 workflow.
 
+!!! abstract "What you will learn"
+    - Identify the active network manager before editing any interface configuration.
+    - Move through interface, address, route, DNS, socket, firewall, and log evidence in a repeatable order.
+    - Apply a record, change, verify, and persist pattern so network changes stay safe and reversible.
+
 ## Know the Active Network Manager
 
 Different Linux systems persist network configuration in different places.

docs/lessons/13_tcp_ip_networking/13.1_tcp-ip_and_its_relationship_to_the_internet.md

@@ -18,6 +18,11 @@ When someone says "the network is down," they might mean:
 
 TCP/IP gives you a way to separate those possibilities instead of guessing.
 
+!!! abstract "What you will learn"
+    - Map a networking problem to the link, internet, transport, and application layers using the evidence each layer provides.
+    - Use `ip addr`, `ip route get`, `ping`, `dig`, `ss`, and `curl` to prove which layer is actually failing.
+    - Separate DNS, firewall, and service-binding failures from genuine IP-connectivity loss during triage.
+
 ## The Practical Stack
 
 Linux networking is often explained with the TCP/IP stack. The layers are a

docs/lessons/13_tcp_ip_networking/13.2_networking_basics.md

@@ -8,6 +8,11 @@ They are the checklist you use when a service cannot be reached.
 This lesson builds the operator model you need before you edit routes, firewall
 rules, DNS settings, or service configuration.
 
+!!! abstract "What you will learn"
+    - Group networking checks into link, address, route, and name questions and run them in that order.
+    - Interpret subnet prefixes, default routes, and socket state to decide whether a destination is local or needs a router.
+    - Recognize firewall and virtual-network boundaries (nftables, firewalld, bridges, VPNs) before changing any policy.
+
 ## Interfaces
 
 A network interface is the Linux kernel's representation of a network

docs/lessons/13_tcp_ip_networking/13.4_ip_addresses-_the_gory_details.md

@@ -8,6 +8,11 @@ prefix, higher-level services fail in confusing ways.
 This lesson focuses on the details administrators actually use during
 operations.
 
+!!! abstract "What you will learn"
+    - Interpret IPv4 and IPv6 addresses, prefix lengths, and the network, host, and broadcast roles of an address.
+    - Recognize private, loopback, link-local, and documentation ranges, and what a `169.254.x.x` or `fe80::` address implies.
+    - Use `ip route get`, `ip neigh`, and `arping` to check source-address selection and detect duplicate addresses.
+
 ## Address, Prefix, and Interface
 
 Linux assigns IP addresses to interfaces. The address identifies the host on a

docs/lessons/13_tcp_ip_networking/13.5_routing.md

@@ -10,6 +10,11 @@ When troubleshooting, routing answers one core question:
 > If this host sends a packet to that destination, which path will the kernel
 > choose?
 
+!!! abstract "What you will learn"
+    - Read the route table and use `ip route get` to see the interface, gateway, and source address the kernel selects.
+    - Apply longest-prefix match and route metrics to explain how VPN, container, and default routes compete.
+    - Make narrow, reversible route changes safely on remote hosts and identify where persistent routes are owned.
+
 ## Read the Route Table
 
 Start with the modern `ip` command:

docs/lessons/13_tcp_ip_networking/13.7_dhcp-_the_dynamic_host_configuration_protocol.md

@@ -13,6 +13,11 @@ When DHCP is wrong, the host may look connected but fail in confusing ways. It
 might have no address, a duplicate address, the wrong default route, stale DNS
 servers, or an address from the wrong VLAN.
 
+!!! abstract "What you will learn"
+    - Trace the DORA lease exchange and the address, gateway, DNS, and route settings a lease installs.
+    - Inspect and renew a lease safely using the correct tool for NetworkManager, systemd-networkd, or `dhclient`.
+    - Diagnose DHCP-caused DNS and default-route problems and identify a rogue or wrong DHCP source with `tcpdump`.
+
 ## What DHCP Decides
 
 On a typical IPv4 network, a client uses the DORA exchange:

docs/lessons/13_tcp_ip_networking/13.8_security_issues.md

@@ -13,6 +13,11 @@ For a Linux operator, the useful questions are:
 - What logs or alerts would show abuse?
 - What changed recently?
 
+!!! abstract "What you will learn"
+    - Inventory a host's exposure with `ss -tulpen` and interpret localhost, private, and all-address binds.
+    - Reduce attack surface through bind addresses, TLS and SSH verification, and the firewall layer the host actually uses.
+    - Recognize how NAT, VPNs, DHCP, and DNS change trust boundaries, and preserve evidence during a suspected incident.
+
 ## Start With Exposure
 
 List listening sockets:

docs/lessons/20_storage/20.1_i_just_want_to_add_a_disk!.md

@@ -11,6 +11,11 @@ virtual disk, an NVMe namespace, or a cloud block volume. The operational
 steps are the same: inspect, partition if needed, create a filesystem,
 mount it, make the mount persistent, and verify the result.
 
+!!! abstract "What you will learn"
+    - Follow the inspect, partition, format, mount, persist, and verify workflow for adding a disk.
+    - Confirm the correct target device with `lsblk`, `blkid`, and `wipefs -n` before running destructive commands.
+    - Create a durable UUID-based `/etc/fstab` entry and test it with `mount -a` before rebooting.
+
 !!! warning "Do not copy device names blindly"
     Commands such as `mkfs`, `wipefs`, `parted`, and `fdisk` can destroy
     data. `/dev/sdb` in this lesson is only an example. Always identify

docs/lessons/20_storage/20.3_storage_hardware_interfaces.md

@@ -8,6 +8,11 @@ performance, failure signals, naming, and operational risks are different.
 This lesson focuses on recognizing common storage interfaces and knowing
 which Linux tools give useful evidence about each one.
 
+!!! abstract "What you will learn"
+    - Distinguish media types (HDD, SSD) from transports (SATA, SAS, NVMe, USB, Fibre Channel, iSCSI) and cloud block volumes.
+    - Gather per-interface evidence with `lsblk`, `smartctl`, `nvme`, `lsscsi`, and `multipath`.
+    - Choose persistent device identifiers so Linux devices map back to platform volumes and physical assets.
+
 ## Interface Versus Device Type
 
 Do not mix up these terms:

docs/lessons/20_storage/20.4_attachment_and_low-level_management_of_drives.md

@@ -9,6 +9,11 @@ This work is powerful because it operates close to the data. The same
 tools that prepare a new disk can erase the wrong one. Slow down, collect
 evidence, and keep a written note of the device you intend to touch.
 
+!!! abstract "What you will learn"
+    - Detect, rescan, and read existing signatures on attached drives before making any change.
+    - Create partition tables and remove drives safely while respecting LVM, RAID, swap, and mounts.
+    - Recognize destructive commands (`mkfs`, `wipefs`, `dd`, `parted mklabel`, `pvcreate`, `mdadm --create`) and safer read-only habits.
+
 ## The Operator Mindset
 
 Before making a low-level storage change, answer these questions:

mkdocs.yml

@@ -90,6 +90,7 @@ nav:
       - Overview: course/overview.md
       - Lab Setup: course/lab-setup.md
       - Syllabus: course/syllabus.md
+      - Certification Paths: course/certification-paths.md
       - Capstone: course/capstone.md
       - Glossary: course/glossary.md
   - Lessons: