BCT(A) cheat sheet

SWOT classifies internal Strengths and Weaknesses and external Opportunities and Threats; pair it with TOWS to convert analysis into strategies.

Porter's Five Forces: rivalry, new entrants, substitutes, supplier power, buyer power; high combined force intensity implies lower industry profitability.

Porter's generic strategies: cost leadership, differentiation, and focus (cost focus or differentiation focus); being stuck in the middle erodes advantage.

PESTLE scans Political, Economic, Social, Technological, Legal, Environmental macro factors; it is external only, unlike SWOT.

Value chain splits activities into primary (inbound logistics, operations, outbound logistics, marketing/sales, service) and support activities.

Span of control: narrow spans produce tall hierarchies with more management layers; wide spans produce flat structures with more delegation.

Organizational structures: functional (efficiency, silos), divisional (product or geography focus), matrix (dual reporting, resource sharing, role conflict).

SMART objectives are Specific, Measurable, Achievable, Relevant, Time-bound; balanced scorecard views are financial, customer, internal process, learning and growth.

BCG matrix: stars (high growth, high share), cash cows (low growth, high share), question marks, dogs; cash cows fund stars and selected question marks.

OSI layers 1-7: Physical, Data Link, Network, Transport, Session, Presentation, Application; TCP/IP maps to Network, Transport, and Application layers.

TCP is connection-oriented with sequencing, acknowledgements, and retransmission; UDP is connectionless with no delivery guarantee, suited to streaming and DNS.

Private IPv4 ranges: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16; NAT translates them to public addresses.

IPv4 uses 32-bit addresses; IPv6 uses 128-bit addresses and removes the need for NAT.

DNS resolves names to IP addresses; DHCP assigns IP configuration automatically; ARP maps IP addresses to MAC addresses on a local network.

Cloud service models: IaaS (virtual machines, storage), PaaS (runtime and development platform), SaaS (finished application); responsibility shifts to the provider as you move up.

Virtualization hosts multiple isolated virtual machines on one physical host via a hypervisor; containers share the host OS kernel and are lighter than VMs.

RAID 0 stripes without parity (no redundancy); RAID 1 mirrors; RAID 5 stripes with single parity (survives one disk failure); RAID 6 tolerates two failures.

Backup types: full copies all data; incremental copies changes since the last backup of any type; differential copies changes since the last full backup.

ACID: Atomicity (all or nothing), Consistency, Isolation, Durability; BASE relaxes consistency for availability in distributed systems.

Normalization: 1NF removes repeating groups, 2NF removes partial dependencies on a composite key, 3NF removes transitive dependencies on non-key attributes.

Primary key uniquely identifies a row and cannot be null; a foreign key references a primary key and enforces referential integrity.

SQL clauses execute logically in the order FROM, WHERE, GROUP BY, HAVING, SELECT, ORDER BY; WHERE filters rows before aggregation, HAVING filters groups after.

INNER JOIN returns matching rows only; LEFT JOIN keeps all left-table rows with nulls where unmatched; CROSS JOIN returns the Cartesian product.

Analytics tiers: descriptive (what happened), diagnostic (why), predictive (what will happen), prescriptive (what action to take).

Central tendency: mean is sensitive to outliers, median is resistant, mode is the most frequent value; standard deviation measures dispersion around the mean.

Correlation measures association, not causation; a confounding variable can produce a spurious relationship between two observed variables.

Data governance assigns data ownership and stewardship, defines a data dictionary and metadata standards, and enforces data quality dimensions such as accuracy and completeness.

CIA triad: Confidentiality (encryption, access control), Integrity (hashing, checksums), Availability (redundancy, backups, DDoS protection).

Authentication verifies identity; authorization determines permitted actions; accounting or auditing logs activity for later review.

Symmetric encryption (AES) uses one shared key and is fast; asymmetric encryption (RSA, ECC) uses a public/private pair and supports key exchange and digital signatures.

Hashing (SHA-256) is one-way and detects tampering; salting adds random data to passwords to defeat rainbow-table attacks.

Risk = likelihood x impact; risk treatment options are mitigate, transfer (insurance), avoid, and accept.

Defense in depth layers controls: preventive, detective, and corrective; administrative, technical, and physical categories.

Least privilege and separation of duties limit insider threat and error; mandatory vacation and job rotation expose fraud.

Phishing, spear phishing, vishing (voice), and smishing (SMS) are social-engineering attacks targeting credentials or payments.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and lessons learned.

Communication process elements: sender, encoding, channel, message, receiver, decoding, feedback, and noise that distorts the message.

Channel richness ranks highest for face-to-face (immediate feedback, multiple cues) and lowest for impersonal written reports; match channel to message complexity.

Synchronous tools (video conferencing, chat, VoIP) require simultaneous presence; asynchronous tools (email, wikis, forums) do not.

Unified communications integrate voice, video, messaging, and presence; VoIP carries voice over IP and depends on low latency and jitter control.

Netiquette and professionalism: reply-all only when all recipients need the content, keep subject lines accurate, and avoid confidential data in unencrypted email.

Active listening components: attending, reflecting, clarifying, and summarizing; paraphrasing confirms understanding before responding.

Virtual team practices: explicit norms, documented decisions, time-zone-aware scheduling, and shared repositories reduce miscommunication.

Meeting effectiveness: publish an agenda in advance, assign roles (facilitator, note-taker), record decisions and action items with owners and due dates.

Presentation structure: state the purpose and key message first, support with evidence, then close with the decision or action requested.

SDLC phases: planning, analysis, design, implementation, testing, deployment, and maintenance; maintenance typically consumes the largest share of lifetime cost.

Waterfall is sequential with fixed requirements; agile uses short iterations, continuous feedback, and welcomes changing requirements.

Scrum roles: Product Owner (backlog priority), Scrum Master (process facilitation), Development Team; artifacts are product backlog, sprint backlog, increment.

Kanban visualizes workflow and limits work in progress to expose bottlenecks; it does not prescribe fixed-length iterations.

Project constraints (triple constraint): scope, time, cost, with quality affected; changing one generally forces adjustment of another.

Critical path is the longest sequence of dependent tasks and determines the minimum project duration; tasks on it have zero float.

Requirements types: functional (what the system does) versus non-functional (performance, security, usability, availability).

Testing levels: unit, integration, system, and user acceptance; black-box tests behavior, white-box tests internal logic.

Change control: document the request, assess impact on scope, schedule, and cost, obtain approval from the change board, then implement and communicate.

IT governance frameworks: COBIT links IT goals to business goals; ITIL structures IT service management practices.

Separation of duties and least privilege are both ethical safeguards and control requirements; auditors should not administer the systems they audit.

Confidentiality obligations persist after employment ends; trade secrets and personal data must not be taken to a new employer.

Conflicts of interest must be disclosed and managed, not concealed; recusal is the standard remedy.

Data protection principles: lawful basis, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability.

Breach notification duties commonly require prompt notice to regulators and affected individuals; delays must be justified and documented.

Records retention schedules define how long records are kept and how they are destroyed; legal holds suspend destruction.

Whistleblowing channels and non-retaliation policies protect reporters; retaliation itself is a governance failure.

Acceptable use policies define permitted use of organizational assets; violations are handled through defined disciplinary and legal processes.