VPOL cheat sheet

Virtualization type 1 (bare-metal) hypervisor runs directly on hardware; type 2 runs on a host OS and adds latency.

RAID 0 stripes with no redundancy; RAID 1 mirrors; RAID 5 tolerates one disk failure; RAID 6 tolerates two; RAID 10 combines mirroring and striping.

RPO (recovery point objective) sets maximum tolerable data loss in time; RTO (recovery time objective) sets maximum acceptable downtime.

Storage tiers: block (SAN, raw volumes), file (NAS, SMB/NFS shares), object (HTTP API, bucket/key, eventual consistency common).

3-2-1 backup rule: three copies, two media types, one copy offsite; immutable or air-gapped copies defend against ransomware.

Cloud service models: IaaS gives compute/storage control; PaaS gives managed runtime; SaaS gives finished application only.

A load balancer health check removes unhealthy nodes from rotation; sticky sessions pin a client to one backend and reduce resilience.

Capacity headroom is calculated as (provisioned capacity - peak utilization) / provisioned capacity; sustained headroom below 20% signals expansion need.

A hypervisor snapshot captures point-in-time disk state but is not a backup; snapshots on the same array do not survive array loss.

Single point of failure exists when any one component's loss stops the service; N+1 redundancy tolerates one failure, 2N tolerates full duplication.

Availability percentage maps to annual downtime: 99.9% ≈ 8.76 h, 99.99% ≈ 52.6 min, 99.999% ≈ 5.26 min per year.

Loose coupling via asynchronous messaging lets producers and consumers scale and fail independently; synchronous chains propagate latency and failure.

CAP theorem: during a network partition a distributed system must choose consistency or availability, not both.

Idempotent operations can be retried safely; design retries with exponential backoff and jitter to avoid thundering herds.

Stateless application tiers scale horizontally; session state belongs in a shared store or client token, not on a single node.

A DMZ segments internet-facing services from internal networks; traffic crosses through a firewall or proxy at each boundary.

Design reviews compare the proposed solution against requirements, constraints, and a reference architecture before build begins.

Blue-green deployment keeps two identical environments and switches traffic; canary release shifts a small traffic percentage first.

Least privilege: grant the minimum permissions needed for the task and time-bound elevated access; review entitlements on a fixed cadence.

Defense in depth layers preventive, detective, and corrective controls; no single control is assumed sufficient.

Encryption states: at rest (storage media), in transit (TLS), in use (memory enclaves); key management is separate from data custody.

Authentication verifies identity; authorization decides permitted actions; MFA strengthens authentication, RBAC/ABAC govern authorization.

Common control families: administrative (policy, training), technical (firewall, encryption), physical (locks, badges).

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, lessons learned.

Compliance evidence must be current, attributable, and retained per the stated retention period; a policy without evidence is an assertion, not proof.

Vulnerability severity is commonly scored with CVSS base metrics (attack vector, complexity, privileges, impact); patch SLAs scale with severity.

Data classification tiers (public, internal, confidential, restricted) drive handling, encryption, and retention requirements.

Incident priority is derived from impact (users/services affected) and urgency; priority determines response target, not the reverse.

MTTR = total downtime / number of incidents; MTBF = total operating time / number of failures; availability = MTBF / (MTBF + MTTR).

Change management: standard (pre-approved, low risk), normal (reviewed), emergency (expedited with retrospective review).

A known error is a root cause identified without permanent fix; it belongs in the known-error database with a workaround.

Root cause analysis uses methods such as 5 Whys and fishbone diagrams; corrective actions need owners and due dates.

Monitoring layers: infrastructure metrics, application performance, synthetic transactions, and log aggregation; alert on symptoms users feel.

Escalation paths are functional (to a specialist) or hierarchical (to management); both are defined before an incident occurs.

Service desk tiers: L1 triage and known fixes, L2 technical diagnosis, L3 engineering or vendor escalation.

Post-incident review is blameless and produces tracked action items; repeat incidents indicate unresolved root cause.

Governance assigns decision rights and accountability; management executes within those rights. Frameworks such as COBIT separate the two.

ITIL service lifecycle stages: strategy, design, transition, operation, continual improvement.

A service level agreement (SLA) is contractual; an operational level agreement (OLA) is internal; an underpinning contract covers a supplier.

Risk = likelihood × impact; risk responses are mitigate, transfer, avoid, or accept, and each accepted risk needs an owner.

Budget categories: capital expenditure (capex) for long-lived assets, operating expenditure (opex) for recurring services; cloud shifts capex toward opex.

Portfolio management balances run-the-business versus change-the-business spend and retires services with low value.

Policy hierarchy: policy (mandatory intent), standard (specific requirements), procedure (step-by-step), guideline (recommended).

Vendor due diligence covers security posture, financial stability, exit/portability terms, and data residency before contract award.

KPIs measure outcome (availability, first-contact resolution); a KPI tied to a target becomes a service level objective.