DMCP cheat sheet

RAID 0 = striping with no parity (capacity = N × disk size); RAID 1 = mirroring (capacity = 50%); RAID 5 = single parity, tolerates one drive failure, usable capacity = (N−1) × smallest disk; RAID 6 = double parity, tolerates two failures, usable capacity = (N−2) × smallest disk; RAID 10 = mirrored stripes, tolerates one failure per mirror pair.

RAID is not a backup: it protects against drive failure, not deletion, corruption, ransomware, or site loss. A data-protection strategy requires independent copies (3-2-1 rule: 3 copies, 2 media types, 1 offsite).

RPO = maximum acceptable data loss (time between backups); RTO = maximum acceptable downtime to restore service. Design backup frequency to meet RPO and restore method to meet RTO.

Backup types: full (all data), incremental (changes since last backup of any type), differential (changes since last full). Restore chain: full + latest differential, or full + all incrementals since that full.

Snapshots are point-in-time metadata copies, typically copy-on-write; they are fast and space-efficient but usually reside on the same array, so they do not satisfy offsite or air-gap requirements alone.

Storage protocols: SAS/SATA for direct-attached block; iSCSI (block over TCP/IP, typically 10/25/100 GbE); Fibre Channel (block over dedicated FC fabric, 8/16/32/64 Gbps); NFS/SMB for file; S3 for object.

SAS and SATA connectors are physically incompatible; a SAS controller can address SATA drives, but SATA controllers cannot address SAS drives. SAS supports dual-porting for multipath high availability.

WORM/immutable retention and object lock protect backup copies from deletion or encryption by malware; air-gapped or offline copies provide the strongest ransomware resilience.

Server form factors: 1U/2U rack (standard in data centers), blade (shared chassis power/cooling/switch), tower (small office). Rack unit U = 44.45 mm (1.75 in) of vertical height.

CPU selection: core count drives parallel workload capacity; clock speed drives single-thread performance; TDP drives cooling and power budget. Memory channels must be populated symmetrically to reach rated bandwidth.

Memory types: DDR4/DDR5 DIMMs; RDIMM (registered, buffered, higher capacity) vs LRDIMM (load-reduced, highest capacity) vs UDIMM (unbuffered, typically client/workstation). ECC detects and corrects single-bit errors.

NUMA: each CPU socket owns local memory; remote memory access is slower. Pin latency-sensitive workloads to a single socket or size VMs within one NUMA node.

Power and cooling: PSU redundancy (1+1 or 2+2), hot-swap fans, and inlet-air temperature limits (ASHRAE A1–A4 envelopes). Oversubscribing PSU capacity reduces efficiency; size to ~70–80% load.

Firmware stack: BIOS/UEFI → BMC (out-of-band management, e.g., iDRAC, iLO, XCC) → bootloader → OS/hypervisor. Keep BMC and BIOS/UEFI firmware current and coordinated with the OS vendor support matrix.

GPU/accelerator servers require high-wattage PSUs, auxiliary power cables, and airflow designed for add-in cards; check PCIe lane availability and slot spacing before specifying.

Lifecycle: staging/commissioning, production, maintenance, decommission with secure data sanitization (NIST SP 800-88 purge/clear/destroy) before disposal or reuse.

OSI layers: 1 physical, 2 data link (MAC, Ethernet, VLAN), 3 network (IP, ICMP, routing), 4 transport (TCP/UDP), 5–7 session/presentation/application. Troubleshoot bottom-up or top-down but document the method.

Subnetting: usable hosts = 2^h − 2, where h = host bits. /24 = 254 hosts; /25 = 126; /26 = 62; /27 = 30; /28 = 14; /29 = 6; /30 = 2 (point-to-point).

VLANs segment Layer 2 broadcast domains; inter-VLAN routing requires a Layer 3 device (router or L3 switch) or a firewall. 802.1Q tags carry VLAN ID across trunk links.

Link aggregation (LACP/802.3ad) bundles links for bandwidth and redundancy; all member links must match speed/duplex and be configured on both ends. LACP uses active/active or active/passive modes.

TCP vs UDP: TCP is connection-oriented with retransmission and ordering (web, file, iSCSI); UDP is connectionless and lower-latency (DNS, DHCP, VoIP, streaming).

Common ports: 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 123 NTP, 161/162 SNMP, 389/636 LDAP/LDAPS, 443 HTTPS, 445 SMB, 3260 iSCSI, 3306 MySQL, 3389 RDP, 5432 PostgreSQL.

Redundancy: dual switches with MLAG/VPC/stacking, dual-homed servers (two NICs to two switches), redundant uplinks, and diverse physical paths to avoid single points of failure.

Bandwidth vs latency vs jitter: throughput is capacity, latency is delay, jitter is latency variation. Storage replication and voice are latency/jitter-sensitive; bulk backup is bandwidth-sensitive.

Hypervisor types: Type 1 (bare-metal: ESXi, Hyper-V, KVM, Xen) runs directly on hardware; Type 2 (hosted: VirtualBox, VMware Workstation) runs on an OS. Production servers use Type 1.

VM resource controls: reservations guarantee minimum resources, limits cap maximum, shares determine relative priority under contention. Overcommit only resources you can reclaim (e.g., via ballooning, transparent page sharing).

Cloud service models: IaaS (VMs, storage, network), PaaS (managed runtime/database), SaaS (finished application). Responsibility for patching the guest OS shifts to the provider only in PaaS/SaaS.

Cloud deployment models: public, private, hybrid, and multi-cloud. Hybrid requires consistent identity, networking, and data management across environments.

Virtual networking: vSwitch/virtual distributed switch, VLAN or VXLAN overlay, and security groups. Overlay networks decouple VM addressing from physical topology.

Live migration moves a running VM between hosts with minimal downtime; it requires shared storage or storage migration, compatible CPU features (EVC/CPU masking), and adequate network bandwidth.

Containers vs VMs: containers share the host kernel (lightweight, fast startup); VMs include a full guest OS (stronger isolation, different patching model). Kubernetes orchestrates containers.

Cloud cost drivers: compute hours, storage capacity and IOPS, data egress, and licensed software. Reserved/committed instances reduce cost for steady-state workloads; spot instances suit interruptible batch.

Out-of-band management (BMC/IPMI/Redfish) provides power control, console, and health monitoring independent of the OS; in-band agents require a running OS and network stack.

Configuration management tools (Ansible, Puppet, Chef, Salt) enforce desired state. Ansible is agentless over SSH; Puppet/Chef typically use agents and a central server.

Idempotency: running the same automation repeatedly produces the same result without side effects. Design playbooks/manifests to be idempotent and test in a staging environment.

Monitoring stack: metrics (time-series, e.g., Prometheus), logs (centralized, e.g., ELK/Splunk), and traces. Define alerts on symptoms (latency, error rate, saturation) rather than every raw metric.

ITIL practices: incident (restore service), problem (root cause), change (controlled modification), configuration management database (CMDB) records relationships between CIs.

Patch management lifecycle: inventory → assess → test → approve → deploy in waves → verify → report. Maintain rollback snapshots and maintenance windows.

Scripting: PowerShell for Windows, Bash for Linux, Python for cross-platform automation and API integration. Use version control (Git) for all automation artifacts.

Infrastructure as Code (IaC): declarative templates (Terraform, CloudFormation) provision resources reproducibly; state files must be secured and locked to prevent concurrent modification.

CIA triad: confidentiality (encryption, access control), integrity (hashing, signatures), availability (redundancy, backups). Security controls map to preventive, detective, or corrective categories.

Authentication factors: something you know (password), have (token), are (biometric). MFA requires at least two different factor types. Authorization (what you can do) follows authentication (who you are).

Encryption: at rest (AES-256, self-encrypting drives, TDE) and in transit (TLS 1.2/1.3, IPsec). Key management (KMS, HSM) is as critical as the cipher; rotate keys and separate duties.

Access control models: RBAC (role-based), ABAC (attribute-based), MAC (mandatory, classification labels), DAC (discretionary, owner-defined). Least privilege and separation of duties are core principles.

Common frameworks: ISO/IEC 27001 (ISMS), NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover), PCI DSS (cardholder data), HIPAA (health data), GDPR (EU personal data).

Vulnerability vs exploit vs threat vs risk: vulnerability is a weakness; exploit is the method to abuse it; threat is a potential actor/event; risk = likelihood × impact.

Logging and SIEM: retain logs per policy, centralize, correlate, and alert. Chain of custody and forensic imaging preserve evidence for incident response.

Data classification (public, internal, confidential, restricted) drives handling, retention, encryption, and disposal requirements. Sanitization standard: NIST SP 800-88.

Requirements gathering: separate functional (what it must do) from non-functional (performance, availability, security, cost) requirements; quantify with measurable targets (e.g., 99.9% uptime = 8.77 h downtime/year).

Availability math: serial components multiply (0.99 × 0.99 = 0.9801); redundant parallel components improve availability (1 − (1−A)^n). Identify and eliminate single points of failure.

Capacity planning: measure current utilization, forecast growth, and add headroom (commonly 20–30%). Validate with performance testing before go-live.

Solution lifecycle: assess → design → build → test → deploy → operate → optimize → retire. Document assumptions, constraints, dependencies, and acceptance criteria.

Troubleshooting method: define the problem, gather data, form a hypothesis, test the simplest/most likely cause first, isolate by layer or component, implement fix, verify, and document.

Change and escalation: follow change control for production modifications; escalate with clear severity definitions, impact statements, and evidence (logs, timestamps, recent changes).

Total cost of ownership includes acquisition, licensing, power/cooling, rack space, support contracts, staff time, and migration/decommission costs - not just purchase price.

Documentation deliverables: architecture diagrams, rack elevations, IP/VLAN plans, backup/DR runbooks, asset inventory, and as-built records updated at handover.