Ruankao Information System Management Engineer (Intermediate) key terms

Coordinating the restoration of acceptable service after a disruption, while communicating status and managing relevant impacts. Complete root-cause investigation can continue separately through problem-management work.

A component or other managed element whose state and relationships are relevant to delivering a service. Accurate ownership, versions and dependencies support impact analysis and controlled change.

A system that collects, aggregates, and analyzes log data from various sources to detect security incidents and support compliance reporting.

A structured approach to handling security incidents, typically including preparation, detection, containment, eradication, recovery, and lessons learned.

Discrete functions installed on a server operating system, such as web, mail, file, or directory services. Separating roles limits attack surface, and each role needs its own ports, storage, and update plan.

Running multiple isolated guest systems on shared physical hardware through a hypervisor, improving utilisation and enabling snapshots and live migration. It also changes network design, adding virtual switches and overlays.

A failed lookup in the translation cache, requiring the processor’s defined translation procedure. It does not alone establish that the target virtual page is absent from physical memory.

An architectural exception caused by an absent or disallowed page translation or access under the platform model. Handling depends on mapping, protection and residency rather than always reading a disk.

Dotted-decimal 32-bit addresses split into network and host parts by a prefix length or mask. Subnetting borrows host bits to create smaller networks, and correct mask and gateway planning is fundamental to routing design.

Classless Inter-Domain Routing expresses prefixes as address plus length, such as 192.168.10.0/24, and allows route aggregation. It replaced fixed address classes and is the notation used throughout routing configuration.

The router address a host uses when the destination is outside its own subnet. A wrong or missing gateway, or one on a different subnet, is a common cause of partial connectivity.

Address Resolution Protocol maps a known IPv4 address to a link-layer MAC address by broadcasting a request and caching the reply. Stale or spoofed ARP entries cause intermittent loss or man-in-the-middle attacks.

Internet Control Message Protocol carries error and diagnostic messages between IP nodes, powering ping and traceroute. Many networks filter selected ICMP types, so blocked replies do not always mean a host is down.

A diagnostic technique that sends packets with increasing time-to-live values and collects ICMP time-exceeded replies, revealing each router hop. It helps locate where paths diverge or where filtering begins.

Time To Live is an IPv4 header counter decremented at every router; reaching zero discards the packet and triggers an ICMP message. It limits looping packets and is exploited by traceroute.

The rule that a router chooses the most specific matching route when several entries fit a destination. It explains why a host route overrides a summary and why default routes are used only as a last resort.

A manually configured path to a destination network, with a next hop or outgoing interface. Simple and predictable in small networks, but it does not adapt to failures unless paired with tracking or dynamic routing.

A link-state interior gateway protocol that floods link information, builds a common topology database, and computes shortest paths with Dijkstra's algorithm. Areas limit flooding, and neighbour adjacency requires matching parameters.

A distance-vector interior protocol using hop count as its metric and periodic updates, with a maximum usable count of 15. Simple to configure but slow to converge, which limits it to small or lab environments.

The path-vector protocol that exchanges routes between autonomous systems on the Internet, selecting paths using attributes such as AS path and local preference. It scales by policy control rather than link-state flooding.

A group of networks under one administrative authority and routing policy, identified by an AS number. Interior protocols run inside it; exterior protocols such as BGP connect it to other autonomous systems.

Network Address Translation rewrites addresses and often ports as packets cross between private and public addressing realms. It conserves public IPv4 space but complicates inbound access and protocols carrying addresses in payloads.

The 128-bit successor to IPv4 with a vastly larger address space, built-in neighbour discovery, and no broadcast. Transition techniques include dual stack and tunnelling, and prefix delegation is common on access links.

Splitting an IP packet into smaller pieces so it fits a link's MTU, with reassembly at the destination. It adds overhead and risk of loss; IPv6 moves the decision to the source instead of routers.

The process of converting readable data into an encoded form that unauthorized people cannot easily understand. A key is used to encrypt and typically to decrypt the data.

The process of verifying a user's or system's claimed identity, often through passwords, tokens, biometrics, or multi-factor methods. It answers whether the identity is genuine.

A social-engineering attack that tricks people into revealing sensitive information or clicking malicious links by impersonating a trustworthy organization or person.

Software designed to harm, disrupt, or gain unauthorized access to a computer system. Examples include viruses, worms, ransomware, spyware, and trojan horses.

The gap between people who have effective access to digital technologies and those who do not, often due to cost, location, skills, or infrastructure.

Legal rights that protect creations of the mind, such as inventions, artistic works, software, and trademarks. These rights control use, copying, and distribution.