EPSO IT/ICT cheat sheet
EPSO IT/ICT · Keep the key ideas within reach.
ICT quantitative and textual reasoning under supplied assumptions
Logical implication does not automatically reverse.
Percentage changes need the correct original baseline and factors.
Toy technical arithmetic does not prove safe real capacity.
Current EPSO notices govern actual competition scope and administration.
Computing Systems
Fetch-decode-execute uses the PC, IR, ALU, and registers.
Memory hierarchy: registers, cache, RAM, storage, offline.
RAM is volatile; SSDs retain data without power.
A process has its own address space; threads share one.
Authentication verifies identity; authorization grants permissions.
TCP is reliable and connection-oriented; UDP is connectionless and lower overhead.
IP addresses route between networks; MAC addresses work on the local link.
A /26 subnet has 64 addresses and 62 usable hosts.
DNS resolves names; DHCP assigns addresses.
Security protects data; privacy governs collection and use.
Cloud concepts, architecture and service models
Apply the NIST cloud model rather than a marketing label alone.
Self-service, broad access, pooling, elasticity and measurement describe different capabilities.
Pooling and tenant isolation require evidence at the relevant layer.
Elasticity adapts capacity to demand; released compute does not remove every other charge.
Cloud economics depend on utilization, contracts, migration and ongoing costs.
NIST SP 500-292 defines five roles: consumer, provider, auditor, broker, carrier.
The service model determines where the management boundary sits, not the technology used.
In SaaS the consumer still owns identities, access rights, configuration and data.
Programming and Software Development
Recursion needs a base case and progress toward that base case.
Overloading uses different signatures; overriding replaces an inherited method.
Unit tests isolate units; integration tests combine them.
Short-circuit evaluation can skip the right operand.
Pass-by-value copies arguments; pass-by-reference can mutate the caller's object.
Data, Databases, and Information Retrieval
Primary keys are unique and non-null; foreign keys enforce referential integrity.
WHERE filters rows before grouping; HAVING filters aggregated groups.
COUNT(*) counts rows; COUNT(column) skips NULL values.
LEFT JOIN preserves unmatched left rows; INNER JOIN removes them.
Precision = relevant retrieved / retrieved; recall = relevant retrieved / all relevant.
Intelligent search, learning and evaluation
Define states, actions, objective and goal test before choosing a search.
Breadth-first minimum-edge guarantees need equal edge costs.
A-star guarantees depend on heuristic and repeated-state handling assumptions.
Separate training, validation and final evaluation roles.
Precision and recall use different denominators; accuracy can conceal class imbalance.
Cyber-risk identification and analysis
Risk assessment cycles through identification, analysis, and evaluation, producing a maintained risk register
Single loss expectancy = asset value x exposure factor; annualized loss expectancy = SLE x annualized rate of occurrence
Risk requires a threat, a vulnerability, and an impact; none alone is sufficient
Inherent risk is before controls, residual risk after them - always state which is being scored
Control effectiveness and uncertainty affect any expected-loss comparison.
Identity, access and cryptographic protection
Identification, authentication, authorisation and accounting are four distinct steps.
MFA needs two different factor categories, not two instances of one.
RBAC suits stable job roles; ABAC suits context-dependent, fine-grained rules.
Kerberos uses a KDC with TGT and service tickets for SSO.
Symmetric ciphers handle bulk data; asymmetric ciphers solve key distribution and signatures.
Signing uses a specified signature scheme with the signer’s private key; verification and custody are essential to origin evidence.
ECB leaks patterns; use authenticated modes such as GCM or encrypt-then-MAC.
Security operations, monitoring and response
Asset inventory and configuration baselines underpin every operational control.
Changes need an appropriate authorization path, recovery planning and relevant evidence.
Emergency changes still require retrospective documentation within a defined window.
Monitor log sources for silence, not just for events.
Distinguish historical Revision 2 phases from current NIST incident-response guidance integrated with broader risk management.
Containment precedes eradication in almost every scenario.
Capture volatile evidence (memory, connections) before disk and before power-off.