Ruankao Information System Management Engineer (Intermediate) cheat sheet

Separate incident restoration from problem investigation and a routine service request.

Maintain actual configuration relationships and accountable change ownership.

A code rollback does not necessarily reverse a data migration.

Availability percentages require a measurement window and explicit exclusions.

Asset inventory and configuration baselines underpin every operational control.

Changes need an appropriate authorization path, recovery planning and relevant evidence.

Emergency changes still require retrospective documentation within a defined window.

Monitor log sources for silence, not just for events.

Distinguish historical Revision 2 phases from current NIST incident-response guidance integrated with broader risk management.

Containment precedes eradication in almost every scenario.

Capture volatile evidence (memory, connections) before disk and before power-off.

Compute effective share and filesystem access using the actual inheritance and permission rules.

rwx = 4/2/1; chmod 755 = owner rwx, others r-x

Key paths: /etc, /var/log, /etc/named.conf, /etc/httpd/conf/httpd.conf, SSH port 22

RAID 5 usable = (n−1)×disk, tolerates one failure; RAID 10 = n/2 capacity

Type 1 hypervisor runs on bare metal; type 2 runs on a host OS

A same-store snapshot alone is not independent protection against loss of that store.

Draw a scheduling timeline before averaging waits.

Distinguish a TLB miss from a nonresident page fault.

LRU is a stack algorithm; FIFO can exhibit Belady’s anomaly.

Protect the shared invariant and analyze actual wait dependencies.

State candidate keys and functional dependencies before normalizing.

Transactions, logs, permissions and recovery require an explicit DBMS model.

Replication is not an independent recovery history.

Use actual query plans and waits to investigate performance.

For ordinary IPv 4 LAN subnets use 2^h−2; /31 point-to-point and /32 routes are exceptions.

RIP: hop count, max 15, 16 = unreachable, UDP 520, 30 s updates

OSPF cost and timers follow the actual reference-bandwidth, network-type and implementation settings.

BGP runs over TCP 179 and is a path-vector inter-AS protocol

PAT multiplexes many private hosts onto one public address using ports

IPv 6 has no broadcast; NDP replaces ARP

CIA triad plus authenticity, non-repudiation and accountability define what is protected.

Risk combines threat, vulnerability and business impact; a vulnerability alone is not a risk.

Bell-LaPadula: no read up, no write down - confidentiality.

Biba: no read down, no write up - integrity.

Governance decides acceptable risk and accountability; management decides how to achieve it

Risk appetite (board-approved) differs from tolerance (variation) and capacity (maximum bearable)

Three Lines Model: internal audit must remain independent of control ownership

Identification, authentication, authorisation and accounting are four distinct steps.

MFA needs two different factor categories, not two instances of one.

RBAC suits stable job roles; ABAC suits context-dependent, fine-grained rules.

Kerberos uses a KDC with TGT and service tickets for SSO.

Symmetric ciphers handle bulk data; asymmetric ciphers solve key distribution and signatures.

Signing uses a specified signature scheme with the signer’s private key; verification and custody are essential to origin evidence.

ECB leaks patterns; use authenticated modes such as GCM or encrypt-then-MAC.

Distinguish tolerated data loss from tolerated interruption.

A recovery point and restore time must both meet the stated targets.

A same-failure-domain snapshot alone does not cover loss of that domain.

Verify complete restore procedures and actual dependency behavior.