Ruankao Information System Supervisor (Intermediate) cheat sheet

Keep owner, contractor and supervisor responsibilities distinct.

Trace requirements to actual test and acceptance evidence.

A supervisor’s observation does not automatically approve a scope change.

Record independence, unresolved exceptions and the limits of sampling.

Decompose actual scope and trace requirements to acceptance evidence.

Critical-path and float calculations require stated network assumptions.

CPI=EV/AC and SPI=EV/PV under the supplied earned-value model.

Choose forecast assumptions and authorization paths explicitly.

Quality = meeting requirements; grade = feature category. Low grade is acceptable, low quality is not.

Managing quality is process-focused; controlling quality inspects deliverables.

Pareto chart prioritises the vital few causes.

Control limits differ from specifications; use the stated chart and run-rule procedure to investigate signals.

External failure can be costly, but compare actual consequences rather than assume one universal ordering.

FFP fits clear scope and transfers cost risk to the seller.

CPFF, CPIF, CPAF place cost risk on the buyer and require cost auditing.

T&M suits urgent or undefined work and needs a ceiling.

RFP asks for a solution plus price; RFQ asks for price.

FPIF settlement must respect the ceiling price.

Use the four-move answer: name the process, cite the evidence, state the consequence, give remedy plus prevention.

Quote formal terminology such as integrated change control, CCB, traceability matrix.

Always show calculation steps for SPI, CPI, EAC, and float.

Every diagnosis must be tied to a specific fact in the scenario.

Pair each corrective action with a preventive control.

Trace observable quality criteria to design and verification evidence.

DFD, ER and UML views answer different questions.

Choose architectural styles from constraints, not product fashion.

Separate verification against specification from validation for actual use.

Hierarchy: access, distribution, core - each with distinct roles

Permanent link ≤ 90 m; full channel ≤ 100 m including patch cords

Six cabling subsystems: work area, horizontal, backbone, telecom room, equipment room, entrance facility

Cat 5 e ≈ 1 G, Cat 6/6 a ≈ 10 G; fibre for backbone and long runs

Acceptance testing: wire map, length, attenuation, NEXT, fibre loss, failover

Deliverables include as-built drawings, IP/VLAN plan and configuration baseline

CIA triad plus authenticity, non-repudiation and accountability define what is protected.

Risk combines threat, vulnerability and business impact; a vulnerability alone is not a risk.

Bell-LaPadula: no read up, no write down - confidentiality.

Biba: no read down, no write up - integrity.

Governance decides acceptable risk and accountability; management decides how to achieve it

Risk appetite (board-approved) differs from tolerance (variation) and capacity (maximum bearable)

Three Lines Model: internal audit must remain independent of control ownership

State whether addresses refer to bytes or words before calculating capacity.

Distinguish PC, instruction register, address register and data register.

For n-bit two’s complement the range is−2^(n−1) through 2^(n−1)−1.

Cache locality and pipeline hazards matter more than a clock-rate label alone.

Derive controls from requirements, assets, flows and trust boundaries.

Test access, failure behavior, recovery and handover evidence.

Physical and media controls need actual design and handling requirements.

Deletion and sanitization are different questions.