I85PREP
⌘ K
Ruankao System Analyst (Senior) study materials
Ruankao System Analyst (Senior) study resources

Ruankao System Analyst (Senior): Networks, Security, and Information Assurance

Ruankao System Analyst (Senior) · Work through your exam, one topic at a time.

All guide sections

Networks, Security, and Information Assurance

Domain 6 combines addressing arithmetic, protocol and device knowledge, and security engineering. Expect at least one subnetting calculation and several questions on cryptographic services and access control models.

Networks

  • OSI layers and devices: hub at layer 1, switch at layer 2, router at layer 3, application gateway at higher layers. TCP/IP collapses these into network access, internet, transport and application.
  • CIDR: a /n prefix leaves 32−n host bits, so 2^(32−n) addresses and 2^(32−n)−2 usable hosts for normal subnets. Private ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16.
  • TCP is connection-oriented with a three-way handshake; UDP is connectionless and suits streaming and DNS queries. NAT translates addresses; VLAN segments a switch; IPsec and SSL VPNs secure remote access.

Security services

  • The CIA triad plus authenticity, non-repudiation and accountability frames most questions.
  • Symmetric algorithms (AES, SM4) are fast but need key distribution; asymmetric algorithms (RSA, ECC, SM2) solve key exchange and signatures but are slow; hashes (SHA-256, SM3) provide integrity.
  • A digital signature is a hash encrypted with the sender's private key: it gives integrity, authentication and non-repudiation, not confidentiality.
  • PKI: certification authority, certificates binding identity to public key, CRL and OCSP for revocation.
  • Access control: DAC (owner's discretion), MAC (labels; Bell-LaPadula no read up, no write down; Biba no read down, no write up), RBAC (roles). GB/T 17859-1999 defines five protection levels from user self-protection to access verification.
  • Controls: firewall, IDS for detection, IPS for blocking, DMZ for exposed services, WAF for web traffic, least privilege, separation of duties.

Continuity

RTO is the maximum tolerable downtime; RPO is the maximum tolerable data loss. Full, incremental and differential backups differ in restore time and storage; a business continuity plan covers the organisation, a disaster recovery plan covers IT recovery.

Worked example

Split 192.168.10.0/24 into /26 subnets. Each subnet has 2^(32−26) = 64 addresses and 62 usable hosts. Subnet boundaries are .0, .64, .128 and .192; the second subnet's broadcast is 192.168.10.127, so its host range is .65 to .126, and .64 is the network address.

Traps

  • Saying data is encrypted with the sender's private key for confidentiality.
  • Confusing IDS with IPS.
  • Using 2^n − 2 when the question asks for total addresses.
  • Swapping RTO and RPO.