Ruankao System Architect (Senior) cheat sheet

State whether addresses refer to bytes or words before calculating capacity.

Distinguish PC, instruction register, address register and data register.

For n-bit two’s complement the range is−2^(n−1) through 2^(n−1)−1.

Cache locality and pipeline hazards matter more than a clock-rate label alone.

Draw a scheduling timeline before averaging waits.

Distinguish a TLB miss from a nonresident page fault.

LRU is a stack algorithm; FIFO can exhibit Belady’s anomaly.

Protect the shared invariant and analyze actual wait dependencies.

Trace observable quality criteria to design and verification evidence.

DFD, ER and UML views answer different questions.

Choose architectural styles from constraints, not product fashion.

Separate verification against specification from validation for actual use.

Distinguish interface contracts, integration patterns and vendor products.

At-least-once delivery needs end-to-end duplicate handling.

Compensation is a new business action, not restoration of history.

Evaluate consistency, failures and quality scenarios at the actual system boundary.

Link security requirements and threat modeling to real design choices.

Use server-side enforcement and interpreter/context-appropriate defenses.

Static, dynamic and dependency analysis provide different evidence.

Protect and trace source, builds, dependencies and release artifacts.

CIA triad plus authenticity, non-repudiation and accountability define what is protected.

Risk combines threat, vulnerability and business impact; a vulnerability alone is not a risk.

Bell-LaPadula: no read up, no write down - confidentiality.

Biba: no read down, no write up - integrity.

Governance decides acceptable risk and accountability; management decides how to achieve it

Risk appetite (board-approved) differs from tolerance (variation) and capacity (maximum bearable)

Three Lines Model: internal audit must remain independent of control ownership

Identification, authentication, authorisation and accounting are four distinct steps.

MFA needs two different factor categories, not two instances of one.

RBAC suits stable job roles; ABAC suits context-dependent, fine-grained rules.

Kerberos uses a KDC with TGT and service tickets for SSO.

Symmetric ciphers handle bulk data; asymmetric ciphers solve key distribution and signatures.

Signing uses a specified signature scheme with the signer’s private key; verification and custody are essential to origin evidence.

ECB leaks patterns; use authenticated modes such as GCM or encrypt-then-MAC.

Primary keys are unique and non-null; foreign keys enforce referential integrity.

WHERE filters rows before grouping; HAVING filters aggregated groups.

COUNT(*) counts rows; COUNT(column) skips NULL values.

LEFT JOIN preserves unmatched left rows; INNER JOIN removes them.

Precision = relevant retrieved / retrieved; recall = relevant retrieved / all relevant.

Check feasibility and model assumptions before optimizing.

A linear program can have several optimal solutions; integrality changes the problem.

Series and parallel availability formulas need explicit independence and success conditions.

Read averages, percentages, percentiles and normative terms in their actual context.

Decompose actual scope and trace requirements to acceptance evidence.

Critical-path and float calculations require stated network assumptions.

CPI=EV/AC and SPI=EV/PV under the supplied earned-value model.

Choose forecast assumptions and authorization paths explicitly.