Ruankao Information System Operations Administrator (Junior) cheat sheet

System composition: hardware layer (CPU, memory, storage, I/O), software layer (system software, application software), data layer, and personnel/procedure layer; a missing layer makes the system incomplete.

CPU performance is roughly instructions per cycle × clock frequency; clock frequency alone does not determine throughput because cache size, pipeline depth, and core count also matter.

Memory hierarchy from fastest/smallest to slowest/largest: registers, cache (L1/L2/L3), main memory (RAM), SSD/flash, magnetic disk, tape; each level trades speed for capacity and cost per bit.

RAM is volatile and loses contents on power loss; ROM/EEPROM and flash retain data without power, so firmware and boot code reside in non-volatile memory.

OSI seven layers bottom-up: physical, data link, network, transport, session, presentation, application; TCP/IP collapses these into network interface, internet, transport, application.

TCP is connection-oriented and reliable (handshake, sequencing, retransmission, flow control); UDP is connectionless with no delivery guarantee, used for streaming and DNS queries.

IPv4 address = 32 bits written as four dotted decimal octets; private ranges are 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, which are not routable on the public internet.

Relational database core objects: table (relation), row (tuple), column (attribute), primary key (unique, non-null), foreign key (references another table's primary key), and index (speeds lookup, costs write space/time).

ACID properties: Atomicity (all-or-nothing), Consistency (valid state transitions), Isolation (concurrent transactions do not interfere), Durability (committed data survives failure).

Linux permission model: r=4, w=2, x=1; mode 755 means owner rwx, group r-x, others r-x; the first digit of a 4-digit mode is setuid/setgid/sticky.

chmod changes permission bits, chown changes owner/group, umask subtracts default permissions (umask 022 yields 755 for directories and 644 for files).

User account files on Linux: /etc/passwd stores account info, /etc/shadow stores hashed passwords, /etc/group stores group membership; never edit shadow without vipw/pwconv.

Windows local accounts are managed via lusrmgr.msc or net user; group scope (local, global, universal) and NTFS ACLs (allow/deny, inheritance) determine effective access, with explicit deny taking precedence.

Key performance indicators: CPU utilization and load average, memory usage and swap/paging rate, disk IOPS and queue length, network throughput and error rate; sustained >80% utilization signals capacity risk.

Load average on Linux counts runnable plus uninterruptible processes over 1, 5, and 15 minutes; compare it against CPU core count, not against 1.0 alone.

Server installation baseline: fixed IP or DHCP reservation, correct hostname and DNS, NTP time sync, patched OS, disabled unused services and ports, and a documented build record.

Service management: systemctl start/stop/restart/enable/status on systemd Linux; Windows uses services.msc or sc start/stop; enabled/automatic means start at boot.

Scheduled tasks: cron (crontab fields minute hour day month weekday) on Linux, Task Scheduler on Windows; logs of task execution are required evidence for operations audits.

Switch forwards by MAC address within a VLAN; router forwards by IP address between subnets; a Layer 3 switch performs both routing and switching.

VLAN trunk ports carry multiple VLANs using 802.1Q tags; access ports belong to one VLAN and send untagged frames to end devices.

Spanning Tree Protocol prevents Layer 2 loops by electing a root bridge and blocking redundant ports; without it, broadcast storms saturate the LAN.

DHCP four-step process: Discover, Offer, Request, Acknowledge (DORA); a client that fails to obtain a lease commonly self-assigns a 169.254.x.x APIPA address.

Ping tests ICMP reachability, traceroute/tracert shows the hop path, nslookup/dig resolves DNS, telnet or Test-NetConnection checks TCP port reachability, ipconfig/ifconfig shows local addressing.

Troubleshooting order: physical layer first (cable, link LED, power), then addressing (IP, mask, gateway), then name resolution, then application; a wrong subnet mask breaks same-subnet communication.

Cabling limits: twisted-pair Ethernet is 100 m per run (90 m permanent link plus 10 m patch cords); fiber extends distance and immunity to electromagnetic interference.

Server room environment: intake temperature commonly 18–27 °C, relative humidity 40–60%, redundant power (UPS plus generator), raised floor or cold/hot aisle layout, and fire suppression that is safe for energized equipment.

Change to network devices requires a saved configuration backup before modification and a rollback plan; configuration drift between redundant devices is a common outage cause.

Backup types: full (complete copy), differential (all changes since last full), incremental (all changes since last backup of any type); restore of incremental requires the full plus every incremental in sequence.

A transaction log backup enables point-in-time recovery; the log chain is broken by switching to simple recovery mode or by a non-logged bulk operation.

Consistency check commands: DBCC CHECKDB on SQL Server, ANALYZE/CHECK TABLE on MySQL; run them on a schedule and before relying on backups for recovery.

Core SQL: SELECT columns FROM table WHERE condition; INSERT INTO table (cols) VALUES (...); UPDATE table SET col=value WHERE condition; DELETE FROM table WHERE condition; always test the WHERE clause with SELECT first.

JOIN types: INNER returns matching rows only, LEFT returns all left rows plus matches, RIGHT the reverse, FULL both sides; a missing join condition produces a Cartesian product.

GRANT privilege ON object TO user and REVOKE privilege FROM user control database access; the principle of least privilege means application accounts get only required DML rights.

Index maintenance: rebuild or reorganize fragmented indexes, update statistics so the optimizer chooses good plans, and monitor slow-query logs for missing indexes.

Data file growth: pre-size data and log files, monitor free space, and keep log files from filling the disk; a full transaction log stops all writes.

Recovery verification requires restoring to a separate environment and running row-count and checksum validation; an untested backup is not a proven backup.

Access control models: DAC (owner discretion), MAC (mandatory labels/clearance), RBAC (role-based, common in enterprises); authentication factors are knowledge, possession, and inherence, with MFA requiring two or more.

Password policy baseline: minimum length, complexity, history to prevent reuse, maximum age, and account lockout after repeated failures; privileged accounts require stronger controls and periodic review.

Least privilege and separation of duties: administrators should not routinely use domain-admin accounts for daily work; approval and logging are required for privileged operations.

Patch management cycle: inventory assets, assess vulnerabilities, test patches, deploy in waves, verify installation, and record exceptions with compensating controls.

Antivirus/endpoint protection requires current signature or behavioral engine updates, scheduled full scans, real-time protection enabled, and centralized reporting of infected hosts.

Security incident handling phases: preparation, detection and analysis, containment, eradication, recovery, and lessons learned; evidence must be preserved with chain of custody.

Common attack indicators: abnormal login times or locations, privilege escalation, unexpected outbound traffic, ransomware file extensions, and sudden antivirus disablement.

Defense in depth layers: physical, network (firewall, segmentation, IDS/IPS), host (hardening, antivirus, patching), application, and data (encryption, backup, access control).

Log retention and review: retain authentication, privilege, and change logs for the period required by policy or regulation, and review them regularly rather than only after an incident.

Monitoring layers: infrastructure (CPU, memory, disk, network), platform (service status, process count), application (response time, error rate), and business (transaction success rate).

Threshold alerting uses warning and critical levels; alert fatigue is reduced by baselining normal behavior and suppressing duplicate or flapping alerts.

SNMP polling collects device metrics; SNMP traps push events; syslog centralizes device and server logs for correlation.

Structured troubleshooting: define the symptom, gather evidence from logs and monitoring, form and test a hypothesis, isolate by layer or by change, fix, then verify and document.

Check recent changes first: most new faults correlate with a deployment, patch, configuration change, or capacity change made shortly before the incident.

Disk full, memory exhaustion, and connection-pool exhaustion produce similar application errors; check OS resource metrics before blaming the application.

Network diagnosis sequence: link status, IP configuration and gateway, DNS resolution, port reachability, then application logs; each step narrows the fault domain.

Distinguish symptom from root cause: restarting a service clears the symptom but recurrence indicates an unresolved underlying problem to be logged as a problem record.

Post-incident review records timeline, impact, root cause, corrective actions, and owners with due dates; repeat incidents indicate ineffective corrective action.

Recovery Point Objective (RPO) is the maximum acceptable data loss measured in time; Recovery Time Objective (RTO) is the maximum acceptable downtime before service is restored.

Backup strategy 3-2-1: at least three copies of data, on two different media types, with one copy offsite or offline (air-gapped) to resist ransomware.

Retention and rotation: grandfather-father-son or GFS schemes balance storage cost against retention requirements; retention periods must match legal and business obligations.

Restore time depends on backup type and media: full restores are fastest, incremental chains are slowest; verify that the backup window fits within the available time.

DR site types: cold (space and power only), warm (partial equipment and data), hot (fully mirrored, near-zero RTO); cost rises with reduced RTO.

Recovery drills must be scheduled, scripted, and measured against RTO/RPO; results and gaps are documented and the plan is revised accordingly.

A business continuity plan covers people, processes, facilities, and IT; a disaster recovery plan is the IT-focused subset that restores systems and data.

Business impact analysis identifies critical business functions, their dependencies, and the maximum tolerable downtime that sets RTO/RPO targets.

Backup media handling: label, encrypt, store away from the source site, verify integrity by test restore, and securely wipe or destroy media at end of life.

Incident management restores normal service as quickly as possible; priority is derived from impact (users/business affected) multiplied or ranked with urgency.

Problem management finds and eliminates root causes of incidents; known errors are documented with workarounds in the knowledge base.

Change management authorizes changes through a change request, risk assessment, CAB review, scheduling, and post-implementation review; emergency changes are recorded retroactively.

Configuration management maintains the configuration management database (CMDB) of configuration items and their relationships; accurate CI data speeds impact analysis.

Service desk is the single point of contact for users; tiers are typically L1 (logging, known fixes), L2 (technical specialists), L3 (vendor or engineering).

Service level agreement (SLA) defines measurable targets such as availability percentage and response/resolution times; operational level agreements support SLAs internally.

Major incident process: declare, assemble a response team, communicate status at fixed intervals, restore service, then conduct a review.

Knowledge management captures resolutions and workarounds so recurring incidents can be resolved at first contact; articles require review and version control.

Service continuity and availability management align IT recovery capability with business continuity requirements and are tested alongside DR drills.

Operations records include change records, incident tickets, backup logs, monitoring reports, access logs, and maintenance checklists; each entry needs time, operator, action, and result.

Documentation control requires version number, author, approval, effective date, and change history; superseded documents are archived, not silently overwritten.

ITIL is a framework of good practice, not a mandatory standard; ISO/IEC 20000 is the certifiable service management standard, and ISO/IEC 27001 covers information security management systems.

China's Cybersecurity Law (网络安全法) establishes network operator security obligations, including real-name registration, log retention of at least six months, and incident reporting.

The Data Security Law (数据安全法) requires classified data protection and risk assessment for important data; the Personal Information Protection Law (个人信息保护法) governs consent and handling of personal data.

Multi-level protection scheme (等级保护, MLPS) classifies information systems into levels 1–5 and imposes graded security construction, assessment, and supervision obligations.

Baseline hardening references: disable unnecessary services and default accounts, enforce password policy, apply least privilege, enable audit logging, and keep firmware and OS patched.

Audit readiness requires evidence that controls operate over time, not just that a policy exists; missing logs or unsigned records are common audit findings.

Records retention must satisfy the longest applicable requirement among law, contract, and internal policy; disposal is documented and approved.

Ethical duties of an operations administrator: protect confidentiality of systems and data, act within authorized scope, report incidents honestly, and avoid conflicts of interest.

Never access, copy, or disclose business data beyond the authorization required for the task; privileged access is used only for approved work and is logged.

Case pattern: an alert fires - confirm the symptom with independent evidence, check recent changes, contain impact, restore service, then investigate root cause and document.

Case pattern: suspected ransomware - isolate the host from the network, preserve evidence, notify per the incident plan, restore from a verified offline backup, and do not pay.

Case pattern: a change is requested urgently - assess risk and rollback, obtain the required emergency approval, record the change, and review afterward.

Case pattern: backup fails repeatedly - treat as an incident with high priority because it removes recovery capability; fix the cause and verify with a test restore.

Case pattern: user reports slow system - quantify with metrics, compare against baseline, check resource saturation and recent changes before proposing an upgrade.

Case pattern: conflicting instructions - escalate to the designated owner and follow policy and law over verbal requests; record the decision and its rationale.

Documentation closes every case: record timeline, actions, evidence, root cause, and preventive measures so the next responder can rely on it.