CompTIA Server+ cheat sheet

Rack unit (U) = 1.75 in (44.45 mm) of vertical space; a standard 42U rack provides about 73.5 in of usable height.

RAID 5 is striping with single parity and tolerates one drive failure; RAID 6 uses dual parity and tolerates two; RAID 10 tolerates one failed drive per mirror pair.

RDIMMs buffer address/command signals and are the typical choice for multi-socket servers; LRDIMMs use rank multiplication to reach much higher capacities at slightly higher latency.

ECC memory detects and corrects single-bit errors and detects double-bit errors; it requires CPU/chipset support, and ECC and non-ECC modules cannot be mixed in one server.

Rebuild time scales with drive capacity, not drive count: a large single replacement drive produces a longer, riskier rebuild window than several small drives.

Redundant PSUs should be fed from separate PDUs or circuits; N+1 sizing means any single PSU can carry the entire server load alone.

A BMC (iDRAC, iLO, IPMI) provides out-of-band power control, remote console, sensor readings, and event logs independent of the operating system.

Hot-swap replacement requires a compatible backplane and RAID controller, and the replacement drive should match or exceed the failed drive's capacity and interface.

UEFI replaces legacy BIOS, adds GPT boot support, and with Secure Boot validates bootloader signatures before the OS loads.

Least privilege: assign each account only the rights its role requires, and keep separate accounts for administrative tasks and daily use.

Type 1 hypervisors run directly on server hardware (ESXi, Hyper-V); type 2 hypervisors run as an application on top of a host OS.

VM snapshots capture a point-in-time disk delta, grow as the guest changes, and degrade performance when kept for long periods; they are not backups.

DNS record roles: A maps a name to IPv4, AAAA maps a name to IPv6, CNAME aliases one name to another name, PTR maps an address back to a name.

NTP stratum 1 servers sync directly to a reference clock; each additional stratum level increases distance from the reference and accumulates error.

SNMP traps are unsolicited alerts pushed from agent to manager on an event; polling reads OIDs on a schedule with GET/GETNEXT requests.

Patch deployment uses rings: a small pilot or canary group first, then wider rollout once stability is verified, with a documented rollback path.

RAID provides availability, not backup: it does not protect against deletion, corruption, malware, or loss of the site.

A DHCP reservation binds a fixed IP address to a specific MAC address, giving stable addressing while keeping configuration centralized.

The CIA triad (confidentiality, integrity, availability) is the basis for evaluating whether a control addresses the required risk.

Backup types: full copies all data; incremental copies changes since the last backup of any type; differential copies changes since the last full. Restores need the last full plus every incremental in order, or the last full plus the latest differential.

The 3-2-1 rule: at least three copies of data, on two different media types, with one copy stored offsite.

RTO is the maximum tolerable downtime; RPO is the maximum tolerable data loss. Recovery time increases from hot site to warm site to cold site.

TLS protects data in transit; full-disk or volume encryption, self-encrypting drives, and TPM-backed key storage protect data at rest.

Hardening baseline: disable unused services and ports, change default credentials, apply patches, enable the host firewall, and restrict remote management to a dedicated management network.

Incident response sequence: preparation, identification, containment, eradication, recovery, lessons learned.

Chain of custody must record who handled evidence, when, and where; an undocumented gap can make the evidence inadmissible.

MFA requires two or more different factors (something you know, have, or are); two passwords from the same factor category do not qualify.

Sequence: identify the problem and gather information, establish a theory of probable cause, test the theory, plan and implement the fix, verify full functionality, document findings.

Check for recent changes first; change one variable at a time and revert it if the symptom does not improve, so cause and effect stay attributable.

POST failures surface as beep codes, diagnostic LEDs, or BMC/IPMI system event log entries even when no video output is available.

Correctable ECC errors are logged and corrected automatically; uncorrectable errors raise machine checks and can crash the host. Repeated correctable errors on one DIMM indicate a failing module.

High CPU ready time on a VM indicates host CPU oversubscription; memory ballooning indicates host memory pressure that pushes the guest to swap.

SMART attributes such as reallocated sectors, pending sectors, and spin retry counts predict drive failure before the array degrades.

A degraded array is still serving data but has lost redundancy; a failed array has lost more members than its parity level can tolerate.

Network isolation order: physical link and switch port, then IP configuration, then gateway reachability, then name resolution, then the application layer.

Performance problems are diagnosed by comparing current metrics against a documented known-good baseline captured before the change or fault.