Ruankao Software Designer (Intermediate) cheat sheet

Recursion needs a base case and progress toward that base case.

Overloading uses different signatures; overriding replaces an inherited method.

Unit tests isolate units; integration tests combine them.

Short-circuit evaluation can skip the right operand.

Pass-by-value copies arguments; pass-by-reference can mutate the caller's object.

Decomposition breaks problems down; abstraction removes irrelevant detail.

Binary search requires sorted data and is O(log n).

Merge sort is O(n log n) worst case; bubble sort is O(n^2).

Trace tables prevent guessing about loop output.

Update search bounds to mid + 1 or mid - 1, not mid.

State whether addresses refer to bytes or words before calculating capacity.

Distinguish PC, instruction register, address register and data register.

For n-bit two’s complement the range is−2^(n−1) through 2^(n−1)−1.

Cache locality and pipeline hazards matter more than a clock-rate label alone.

Draw a scheduling timeline before averaging waits.

Distinguish a TLB miss from a nonresident page fault.

LRU is a stack algorithm; FIFO can exhibit Belady’s anomaly.

Protect the shared invariant and analyze actual wait dependencies.

Trace observable quality criteria to design and verification evidence.

DFD, ER and UML views answer different questions.

Choose architectural styles from constraints, not product fashion.

Separate verification against specification from validation for actual use.

Primary keys are unique and non-null; foreign keys enforce referential integrity.

WHERE filters rows before grouping; HAVING filters aggregated groups.

COUNT(*) counts rows; COUNT(column) skips NULL values.

LEFT JOIN preserves unmatched left rows; INNER JOIN removes them.

Precision = relevant retrieved / retrieved; recall = relevant retrieved / all relevant.

OSI upper three layers (session, presentation, application) map to TCP/IP's single application layer

PDU order: bit → frame → packet → segment

Shannon uses S/N as a power ratio; convert dB first

Transmission delay = frame length / bandwidth; propagation delay = distance / velocity

A switch splits collision domains, not broadcast domains

802.1 Q is VLAN tagging, 802.1 X is port-based access control

CIA triad plus authenticity, non-repudiation and accountability define what is protected.

Risk combines threat, vulnerability and business impact; a vulnerability alone is not a risk.

Bell-LaPadula: no read up, no write down - confidentiality.

Biba: no read down, no write up - integrity.

Governance decides acceptable risk and accountability; management decides how to achieve it

Risk appetite (board-approved) differs from tolerance (variation) and capacity (maximum bearable)

Three Lines Model: internal audit must remain independent of control ownership

Link security requirements and threat modeling to real design choices.

Use server-side enforcement and interpreter/context-appropriate defenses.

Static, dynamic and dependency analysis provide different evidence.

Protect and trace source, builds, dependencies and release artifacts.