Ruankao Information System Operations Administrator (Junior) flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

OSI model layers

Seven layers from bottom: physical, data link, network, transport, session, presentation, application. Each layer provides services to the layer above and uses the layer below.

Private IPv4 address ranges

10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 are reserved for internal networks and are not routed on the public internet; NAT translates them to public addresses.

ACID properties

Atomicity, Consistency, Isolation, Durability. They guarantee that database transactions either complete fully or roll back, leaving data in a valid state that survives failures.

Primary key versus foreign key

A primary key uniquely and non-nullably identifies each row in a table. A foreign key is a column referencing another table's primary key to enforce referential integrity.

Linux permission mode 755

Owner gets read, write, execute (7); group and others get read and execute (5). Expressed as rwxr-xr-x, common for directories and executable files.

umask 022 effect

Default permissions are computed by subtracting the umask from 777 for directories (755) and from 666 for files (644), removing group and other write access.

Linux load average

Average number of runnable and uninterruptible processes over 1, 5, and 15 minutes. Compare with CPU core count; sustained values above core count indicate saturation.

NTFS explicit deny precedence

When a user belongs to groups with conflicting NTFS permissions, an explicit Deny entry overrides any Allow entries, whether inherited or explicitly assigned.

DHCP DORA process

Client broadcasts Discover, server sends Offer, client sends Request for an offer, server returns Acknowledge. Failure leaves the client with a 169.254.x.x APIPA address.

802.1Q VLAN trunk

A trunk port carries frames for multiple VLANs by inserting a 4-byte tag identifying the VLAN. Access ports carry one untagged VLAN to end devices.

Spanning Tree Protocol purpose

Prevents Layer 2 loops by electing a root bridge and blocking redundant paths, avoiding broadcast storms while keeping a standby link for failover.

Twisted-pair cable distance limit

Ethernet over twisted-pair copper is limited to 100 meters per channel: 90 meters of permanent link plus up to 10 meters of patch cords.

Differential versus incremental backup

Differential backs up all changes since the last full backup, so restore needs the full plus the latest differential. Incremental backs up changes since the last backup of any type, so restore needs the full plus every increment.

Transaction log backup

Captures log records since the previous log backup, enabling point-in-time recovery. Switching to simple recovery mode breaks the log chain and invalidates later log restores.

SQL GRANT and REVOKE

GRANT privilege ON object TO user gives rights; REVOKE removes them. Application accounts should receive only the DML rights their function requires.

SQL JOIN types

INNER returns only matching rows; LEFT returns all left-table rows plus matches; RIGHT the reverse; FULL returns all rows from both sides. Omitting the join condition yields a Cartesian product.

RBAC access control model

Permissions are assigned to roles rather than directly to users, and users are assigned roles. Simplifies administration and supports least privilege and separation of duties.

Multi-factor authentication

Requires two or more factors from different categories: something you know, something you have, something you are. Two passwords do not constitute multi-factor authentication.

Security incident response phases

Preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Evidence must be preserved with a documented chain of custody.

Patch management cycle

Inventory assets, assess vulnerabilities, test patches, deploy in waves, verify installation, and record exceptions with compensating controls and approval.

SNMP polling versus traps

Polling has the management station query device metrics at intervals. Traps are unsolicited event messages sent by the device when a condition occurs.

Symptom versus root cause

A symptom is the observable failure; the root cause is the underlying condition producing it. Restarting a service may clear the symptom while the cause recurs.

RPO versus RTO

Recovery Point Objective is the maximum tolerable data loss measured in time. Recovery Time Objective is the maximum tolerable downtime before service is restored.

3-2-1 backup rule

Keep at least three copies of data, on two different media types, with one copy offsite or offline. The offline copy protects against ransomware and site disasters.

Hot versus cold DR site

A hot site is fully equipped and mirrored, giving near-zero recovery time at high cost. A cold site provides only space and power, giving long recovery time at low cost.

Business impact analysis

Identifies critical business functions, their dependencies, and maximum tolerable downtime, which set the RTO and RPO targets used to design recovery capability.

Incident versus problem

An incident is an unplanned interruption or degradation of service, handled by restoring service. A problem is the underlying cause of one or more incidents, handled by root-cause analysis.

Change advisory board

A group that reviews change requests for risk, impact, and scheduling, then authorizes or rejects them. Emergency changes follow an expedited path and are recorded afterward.

Configuration management database

A repository of configuration items such as servers, applications, and network devices, including their attributes and relationships, used for impact analysis and asset control.

ISO/IEC 20000 and ISO/IEC 27001

ISO/IEC 20000 is the certifiable standard for IT service management. ISO/IEC 27001 specifies requirements for an information security management system.

China log retention requirement

The Cybersecurity Law requires network operators to retain network logs for at least six months. Internal policy or sector rules may require longer retention.

Multi-level protection scheme

China's graded protection system classifies information systems into levels one to five, imposing graded security construction, assessment, and supervision obligations on operators.

Ethical handling of privileged access

Administrators use elevated accounts only for approved tasks, keep activity logged, never inspect business data without authorization, and report suspected incidents honestly.