ITA cheat sheet

CPU fetch-decode-execute cycle: fetch instruction from memory at the program counter, decode the opcode, execute via ALU or control unit, then store results and increment the counter.

Storage hierarchy by speed and cost: CPU registers > cache (L1/L2/L3) > RAM > SSD > HDD > optical/tape; volatile tiers (registers, cache, RAM) lose contents on power loss, non-volatile tiers retain data.

RAM is volatile working memory addressed by the CPU; ROM is non-volatile firmware storage. More RAM raises the number of concurrently resident processes, not clock speed.

Binary units: 1 byte = 8 bits; 1 KB = 1024 bytes; 1 MB = 1024 KB; 1 GB = 1024 MB; 1 TB = 1024 GB. Decimal (SI) prefixes use powers of 1000, so a 1 TB drive shows about 931 GiB in an OS using binary prefixes.

Motherboard buses carry data, addresses, and control signals; PCIe supplies high-speed expansion slots, SATA connects drives, and USB is hot-swappable serial peripheral I/O.

Power supply wattage must cover the sum of component draw plus headroom; an undersized PSU causes random shutdowns or boot failures under load rather than data corruption alone.

RAID levels: RAID 0 stripes with no redundancy; RAID 1 mirrors; RAID 5 stripes with single parity (survives one disk failure); RAID 6 uses dual parity (survives two); RAID 10 mirrors then stripes.

Virtualization: a hypervisor (Type 1 bare-metal or Type 2 hosted) partitions physical CPU, memory, and I/O among virtual machines, each with its own guest OS.

An OS manages processes, memory, file systems, devices, and users; the kernel runs in privileged mode, while user applications run in restricted mode and request services through system calls.

Process states: new, ready, running, waiting (blocked), and terminated. A context switch saves one process's register state and restores another's.

Scheduling algorithms: first-come first-served (non-preemptive), shortest job first (optimal average wait but starvation-prone), round robin (time slice, fair), and priority scheduling.

Virtual memory maps logical addresses to physical frames via page tables; a page fault loads the missing page from disk, and thrashing occurs when faults outpace useful work.

File systems: NTFS (Windows, journaling, permissions, quotas), ext4 (Linux journaling), APFS (Apple, copy-on-write snapshots), FAT32 (4 GB per-file limit, broad compatibility).

Software licensing categories: proprietary/commercial, freeware (free but closed), open source (source available under a license such as GPL or MIT), shareware (trial then pay).

Installation types: clean install wipes the target volume; upgrade preserves settings and applications; dual boot installs a second OS on separate partitions selected at boot.

Patch management sequence: identify vulnerabilities, test patches in a staging environment, deploy in rollout waves, verify installation, and document exceptions.

OSI layers 1-7: Physical, Data Link, Network, Transport, Session, Presentation, Application. TCP/IP maps them to Link, Internet, Transport, and Application.

IPv4 private ranges: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16; 127.0.0.0/8 is loopback and 169.254.0.0/16 is link-local (APIPA) when DHCP fails.

Subnet math: usable hosts = 2^(host bits) - 2; a /24 mask (255.255.255.0) leaves 8 host bits and 254 usable addresses.

TCP is connection-oriented with a three-way handshake (SYN, SYN-ACK, ACK) and retransmission; UDP is connectionless with no delivery guarantee, used for streaming and DNS queries.

Common ports: 20/21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 110 POP3, 143 IMAP, 443 HTTPS, 3389 RDP.

DHCP assigns addresses via DORA (Discover, Offer, Request, Acknowledge); DNS resolves names to addresses through recursive and authoritative servers.

Switches forward frames by MAC address within a LAN; routers forward packets by IP address between networks; VLANs logically segment one physical switch.

Wi-Fi standards 802.11n (2.4/5 GHz), 802.11ac (5 GHz), 802.11ax (Wi-Fi 6); WPA2/WPA3 encrypt wireless traffic, WEP is obsolete and insecure.

CIA triad: confidentiality (encryption, access control), integrity (hashing, checksums), availability (redundancy, backups, DDoS mitigation).

Symmetric encryption (AES) uses one shared key and is fast; asymmetric encryption (RSA, ECC) uses a public/private key pair and enables key exchange and digital signatures.

Hashing (SHA-256) is one-way and detects tampering; a digital signature encrypts a hash with the sender's private key so receivers verify authenticity with the public key.

Backup types: full copies everything; incremental copies changes since the last backup of any type; differential copies changes since the last full backup. Restore needs the full plus the chain.

The 3-2-1 rule: at least three copies of data, on two different media, with one copy off-site.

Authentication factors: something you know (password), something you have (token), something you are (biometrics). MFA combines two or more distinct factor types.

Phishing indicators: mismatched sender domain, urgency, unexpected attachments, and links whose displayed text differs from the actual URL; verify by contacting the sender independently.

Least privilege and role-based access control grant only the rights needed for a job; separation of duties prevents one person from both authorizing and executing a sensitive transaction.

Troubleshooting order: identify the problem, establish a theory, test the theory, establish a plan of action, verify functionality, document findings.

Change one variable at a time and retest; simultaneous changes obscure which action fixed or worsened the fault.

POST beep codes and diagnostic LEDs indicate hardware faults before the OS loads; no display plus repeated beeps typically points to RAM or GPU seating.

Layered isolation: test physical cabling and power first, then link lights and switch port, then IP configuration (ipconfig/ifconfig), then DNS resolution, then application.

Command-line diagnostics: ping (reachability), tracert/traceroute (path), ipconfig /all or ifconfig (address config), nslookup (DNS), netstat (connections).

Safe mode loads minimal drivers to distinguish OS/driver faults from hardware faults; if the fault disappears in safe mode, suspect a driver or startup program.

Escalation criteria: unresolved after defined effort, requires privileged access, or affects multiple users or a production service.

Documentation fields: symptom, affected asset, steps taken, root cause, resolution, and time to resolve; the knowledge base entry enables faster repeat resolution.

Relational model: tables (relations) hold rows (records) and columns (attributes); a primary key uniquely identifies a row and a foreign key references another table's primary key.

Normalization: 1NF removes repeating groups, 2NF removes partial dependencies on part of a composite key, 3NF removes transitive dependencies on non-key attributes.

ACID transactions: Atomicity (all or nothing), Consistency (valid state transitions), Isolation (concurrent transactions do not interfere), Durability (committed data survives failure).

SQL categories: DDL (CREATE, ALTER, DROP), DML (SELECT, INSERT, UPDATE, DELETE), DCL (GRANT, REVOKE), TCL (COMMIT, ROLLBACK).

Joins: INNER returns matching rows only; LEFT/RIGHT return all rows from one side plus matches; FULL returns all rows from both; CROSS returns the Cartesian product.

Indexes speed lookups on indexed columns but slow writes and consume storage; a query filtering on an unindexed column triggers a full table scan.

NoSQL families: key-value, document, column-family, and graph; they relax fixed schemas and favor horizontal scaling over strict joins.

Backup and recovery terms: RPO is the maximum acceptable data loss (time between backups); RTO is the maximum acceptable downtime to restore service.

Client-server flow: browser sends an HTTP request, the server returns a status code and body; 2xx success, 3xx redirect, 4xx client error (404 not found), 5xx server error.

HTTP is stateless; cookies, sessions, and tokens carry state between requests. HTTPS wraps HTTP in TLS for encryption and server authentication.

HTML structures content, CSS styles presentation, and JavaScript adds client-side behavior; separation of the three improves maintainability.

REST principles: resources identified by URLs, standard verbs (GET, POST, PUT, DELETE), stateless requests, and representations such as JSON.

MVC separates model (data and rules), view (presentation), and controller (request handling), allowing independent change of each layer.

Input validation must be enforced server-side; client-side validation improves usability but is bypassable. Parameterized queries prevent SQL injection, and output encoding prevents XSS.

Version control basics: commit records a snapshot, branch isolates work, merge combines histories, and conflicts occur when both branches change the same lines.

Responsive design uses fluid grids, flexible images, and media queries to adapt layout to viewport width; mobile-first CSS starts with small-screen rules.

ITIL service lifecycle stages: service strategy, design, transition, operation, and continual service improvement.

Incident vs problem: an incident is an unplanned interruption or degradation restored as quickly as possible; a problem is the underlying cause, managed through root cause analysis.

Priority = impact x urgency; severity describes technical effect while priority sets the order of response against SLAs.

SLA defines agreed service levels (availability, response time, resolution time); OLA is an internal agreement between teams supporting the SLA; underpinning contracts cover external suppliers.

Change types: standard (pre-approved, low risk), normal (assessed and approved by change advisory board), emergency (expedited approval for critical fixes).

Service desk tiers: Tier 1 logs and resolves common requests, Tier 2 handles deeper technical work, Tier 3 engages specialists or vendors.

Configuration management database records configuration items and their relationships, enabling impact analysis before changes.

Professional ethics: protect confidential data, disclose conflicts of interest, follow acceptable-use and licensing rules, and report security incidents promptly.

CPU fetch-decode-execute cycle: fetch instruction from memory at the program counter, decode the opcode, execute via ALU or control unit, then store results and increment the counter.

Storage hierarchy by speed and cost: CPU registers > cache (L1/L2/L3) > RAM > SSD > HDD > optical/tape; volatile tiers (registers, cache, RAM) lose contents on power loss, non-volatile tiers retain data.

RAM is volatile working memory addressed by the CPU; ROM is non-volatile firmware storage. More RAM raises the number of concurrently resident processes, not clock speed.

Binary units: 1 byte = 8 bits; 1 KB = 1024 bytes; 1 MB = 1024 KB; 1 GB = 1024 MB; 1 TB = 1024 GB. Decimal (SI) prefixes use powers of 1000, so a 1 TB drive shows about 931 GiB in an OS using binary prefixes.

Motherboard buses carry data, addresses, and control signals; PCIe supplies high-speed expansion slots, SATA connects drives, and USB is hot-swappable serial peripheral I/O.

Power supply wattage must cover the sum of component draw plus headroom; an undersized PSU causes random shutdowns or boot failures under load rather than data corruption alone.

RAID levels: RAID 0 stripes with no redundancy; RAID 1 mirrors; RAID 5 stripes with single parity (survives one disk failure); RAID 6 uses dual parity (survives two); RAID 10 mirrors then stripes.

Virtualization: a hypervisor (Type 1 bare-metal or Type 2 hosted) partitions physical CPU, memory, and I/O among virtual machines, each with its own guest OS.

An OS manages processes, memory, file systems, devices, and users; the kernel runs in privileged mode, while user applications run in restricted mode and request services through system calls.

Process states: new, ready, running, waiting (blocked), and terminated. A context switch saves one process's register state and restores another's.

Scheduling algorithms: first-come first-served (non-preemptive), shortest job first (optimal average wait but starvation-prone), round robin (time slice, fair), and priority scheduling.

Virtual memory maps logical addresses to physical frames via page tables; a page fault loads the missing page from disk, and thrashing occurs when faults outpace useful work.

File systems: NTFS (Windows, journaling, permissions, quotas), ext4 (Linux journaling), APFS (Apple, copy-on-write snapshots), FAT32 (4 GB per-file limit, broad compatibility).

Software licensing categories: proprietary/commercial, freeware (free but closed), open source (source available under a license such as GPL or MIT), shareware (trial then pay).

Installation types: clean install wipes the target volume; upgrade preserves settings and applications; dual boot installs a second OS on separate partitions selected at boot.

Patch management sequence: identify vulnerabilities, test patches in a staging environment, deploy in rollout waves, verify installation, and document exceptions.

OSI layers 1-7: Physical, Data Link, Network, Transport, Session, Presentation, Application. TCP/IP maps them to Link, Internet, Transport, and Application.

IPv4 private ranges: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16; 127.0.0.0/8 is loopback and 169.254.0.0/16 is link-local (APIPA) when DHCP fails.

Subnet math: usable hosts = 2^(host bits) - 2; a /24 mask (255.255.255.0) leaves 8 host bits and 254 usable addresses.

TCP is connection-oriented with a three-way handshake (SYN, SYN-ACK, ACK) and retransmission; UDP is connectionless with no delivery guarantee, used for streaming and DNS queries.

Common ports: 20/21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 110 POP3, 143 IMAP, 443 HTTPS, 3389 RDP.

DHCP assigns addresses via DORA (Discover, Offer, Request, Acknowledge); DNS resolves names to addresses through recursive and authoritative servers.

Switches forward frames by MAC address within a LAN; routers forward packets by IP address between networks; VLANs logically segment one physical switch.

Wi-Fi standards 802.11n (2.4/5 GHz), 802.11ac (5 GHz), 802.11ax (Wi-Fi 6); WPA2/WPA3 encrypt wireless traffic, WEP is obsolete and insecure.

CIA triad: confidentiality (encryption, access control), integrity (hashing, checksums), availability (redundancy, backups, DDoS mitigation).

Symmetric encryption (AES) uses one shared key and is fast; asymmetric encryption (RSA, ECC) uses a public/private key pair and enables key exchange and digital signatures.

Hashing (SHA-256) is one-way and detects tampering; a digital signature encrypts a hash with the sender's private key so receivers verify authenticity with the public key.

Backup types: full copies everything; incremental copies changes since the last backup of any type; differential copies changes since the last full backup. Restore needs the full plus the chain.

The 3-2-1 rule: at least three copies of data, on two different media, with one copy off-site.

Authentication factors: something you know (password), something you have (token), something you are (biometrics). MFA combines two or more distinct factor types.

Phishing indicators: mismatched sender domain, urgency, unexpected attachments, and links whose displayed text differs from the actual URL; verify by contacting the sender independently.

Least privilege and role-based access control grant only the rights needed for a job; separation of duties prevents one person from both authorizing and executing a sensitive transaction.

Troubleshooting order: identify the problem, establish a theory, test the theory, establish a plan of action, verify functionality, document findings.

Change one variable at a time and retest; simultaneous changes obscure which action fixed or worsened the fault.

POST beep codes and diagnostic LEDs indicate hardware faults before the OS loads; no display plus repeated beeps typically points to RAM or GPU seating.

Layered isolation: test physical cabling and power first, then link lights and switch port, then IP configuration (ipconfig/ifconfig), then DNS resolution, then application.

Command-line diagnostics: ping (reachability), tracert/traceroute (path), ipconfig /all or ifconfig (address config), nslookup (DNS), netstat (connections).

Safe mode loads minimal drivers to distinguish OS/driver faults from hardware faults; if the fault disappears in safe mode, suspect a driver or startup program.

Escalation criteria: unresolved after defined effort, requires privileged access, or affects multiple users or a production service.

Documentation fields: symptom, affected asset, steps taken, root cause, resolution, and time to resolve; the knowledge base entry enables faster repeat resolution.

Relational model: tables (relations) hold rows (records) and columns (attributes); a primary key uniquely identifies a row and a foreign key references another table's primary key.

Normalization: 1NF removes repeating groups, 2NF removes partial dependencies on part of a composite key, 3NF removes transitive dependencies on non-key attributes.

ACID transactions: Atomicity (all or nothing), Consistency (valid state transitions), Isolation (concurrent transactions do not interfere), Durability (committed data survives failure).

SQL categories: DDL (CREATE, ALTER, DROP), DML (SELECT, INSERT, UPDATE, DELETE), DCL (GRANT, REVOKE), TCL (COMMIT, ROLLBACK).

Joins: INNER returns matching rows only; LEFT/RIGHT return all rows from one side plus matches; FULL returns all rows from both; CROSS returns the Cartesian product.

Indexes speed lookups on indexed columns but slow writes and consume storage; a query filtering on an unindexed column triggers a full table scan.

NoSQL families: key-value, document, column-family, and graph; they relax fixed schemas and favor horizontal scaling over strict joins.

Backup and recovery terms: RPO is the maximum acceptable data loss (time between backups); RTO is the maximum acceptable downtime to restore service.

Client-server flow: browser sends an HTTP request, the server returns a status code and body; 2xx success, 3xx redirect, 4xx client error (404 not found), 5xx server error.

HTTP is stateless; cookies, sessions, and tokens carry state between requests. HTTPS wraps HTTP in TLS for encryption and server authentication.

HTML structures content, CSS styles presentation, and JavaScript adds client-side behavior; separation of the three improves maintainability.

REST principles: resources identified by URLs, standard verbs (GET, POST, PUT, DELETE), stateless requests, and representations such as JSON.

MVC separates model (data and rules), view (presentation), and controller (request handling), allowing independent change of each layer.

Input validation must be enforced server-side; client-side validation improves usability but is bypassable. Parameterized queries prevent SQL injection, and output encoding prevents XSS.

Version control basics: commit records a snapshot, branch isolates work, merge combines histories, and conflicts occur when both branches change the same lines.

Responsive design uses fluid grids, flexible images, and media queries to adapt layout to viewport width; mobile-first CSS starts with small-screen rules.

ITIL service lifecycle stages: service strategy, design, transition, operation, and continual service improvement.

Incident vs problem: an incident is an unplanned interruption or degradation restored as quickly as possible; a problem is the underlying cause, managed through root cause analysis.

Priority = impact x urgency; severity describes technical effect while priority sets the order of response against SLAs.

SLA defines agreed service levels (availability, response time, resolution time); OLA is an internal agreement between teams supporting the SLA; underpinning contracts cover external suppliers.

Change types: standard (pre-approved, low risk), normal (assessed and approved by change advisory board), emergency (expedited approval for critical fixes).

Service desk tiers: Tier 1 logs and resolves common requests, Tier 2 handles deeper technical work, Tier 3 engages specialists or vendors.

Configuration management database records configuration items and their relationships, enabling impact analysis before changes.

Professional ethics: protect confidential data, disclose conflicts of interest, follow acceptable-use and licensing rules, and report security incidents promptly.