IBM Full Stack Software Developer cheat sheet

SDLC phases: requirements, design, implementation, testing, deployment, maintenance; iterative models repeat phases per increment.

Git object model: blobs store file content, trees store directory listings, commits point to a tree plus parent commits, refs point to commits.

Git branch is a movable pointer to a commit; HEAD is a pointer to the current branch, so checkout moves HEAD, not files' history.

Merge creates a new commit with two parents; rebase rewrites commits onto a new base, producing new SHAs and a linear history.

HTTP status classes: 2xx success, 3xx redirect, 4xx client error, 5xx server error; 401 means unauthenticated, 403 means authenticated but forbidden.

REST constraints: client-server, statelessness, cacheability, uniform interface, layered system, optional code-on-demand.

Idempotent methods: GET, PUT, DELETE, HEAD; POST and PATCH are not idempotent, so retries need idempotency keys.

Big-O common cases: array index O(1), linear search O(n), balanced-tree search O(log n), comparison sort O(n log n), nested loops O(n^2).

Agile ceremonies: sprint planning, daily standup, sprint review, retrospective; a user story states role, goal, and benefit.

HTML semantic elements (header, nav, main, article, section, footer) convey structure to assistive technology and search engines.

CSS box model: content, padding, border, margin; box-sizing: border-box makes width include padding and border.

CSS specificity order: inline style > ID > class/attribute/pseudo-class > element/pseudo-element; !important overrides normal declarations.

Flexbox distributes items along one axis (main axis); Grid lays out rows and columns in two dimensions simultaneously.

JavaScript is single-threaded with an event loop; promises and async/await schedule microtasks that run before the next macrotask.

DOM updates are expensive: batch changes, use document fragments, and let frameworks diff a virtual DOM before touching real nodes.

React component state is immutable from outside; setState/useState triggers re-render, props flow one way from parent to child.

Fetch returns a promise resolving to a Response; check response.ok because HTTP 4xx/5xx do not reject the promise.

Responsive design uses relative units, media queries, and the viewport meta tag; mobile-first means base styles target small screens.

Node.js runs JavaScript on V8 with a non-blocking event loop; CPU-heavy work blocks all requests, so offload it to worker threads.

Express middleware signature is (req, res, next); calling next() passes control, next(err) jumps to the error-handling middleware.

SQL joins: INNER returns matching rows only, LEFT keeps all left rows, RIGHT keeps all right rows, FULL keeps both sides.

ACID: atomicity (all or nothing), consistency (valid states), isolation (concurrent safety), durability (survives crash).

Normalization reduces redundancy (1NF atomic values, 2NF no partial dependency, 3NF no transitive dependency); denormalization trades storage for read speed.

Indexes speed reads but slow writes and consume space; a composite index is usable left-to-right by leading columns.

JWT has header, payload, signature; the payload is base64url-encoded, not encrypted, so never store secrets there.

Password storage uses a slow salted hash such as bcrypt or Argon2; hashing is one-way, so recovery means reset, not decryption.

REST resource naming uses plural nouns and HTTP verbs for actions; status codes carry outcome, not the response body alone.

IaaS gives virtual machines and networks, PaaS gives managed runtimes, SaaS gives finished applications; control decreases as you move right.

NIST cloud traits: on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service.

Regions contain availability zones; deploying across zones survives a data-center failure, while regions address latency and residency.

Horizontal scaling adds instances, vertical scaling enlarges one instance; stateless services scale horizontally.

Object storage (e.g., buckets) suits unstructured files; block storage attaches to a single server; file storage offers shared POSIX access.

Shared responsibility: the provider secures the physical layer and managed-service internals; the customer secures data, identities, and configuration.

Serverless functions scale to zero and bill per invocation and duration; cold starts add latency after idle periods.

Managed message queues decouple producers from consumers, absorbing bursts and enabling retry without blocking the request path.

Least privilege and identity-based policies govern cloud access; rotate long-lived credentials and prefer short-lived tokens.

A container packages code with its dependencies and shares the host kernel; a virtual machine bundles a full guest OS.

A Docker image is built from ordered layers; each Dockerfile instruction creates a layer, and unchanged layers are cached on rebuild.

Containers are ephemeral: any file written outside a volume disappears when the container is removed.

Dockerfile order matters for cache hits; copy dependency manifests and install before copying source so code edits do not bust the dependency layer.

Port mapping -p host:container publishes a container port; containers reach each other by service name on a user-defined network.

Docker Compose defines multi-container apps in YAML with services, networks, and volumes for local orchestration.

A registry stores tagged images; docker push and docker pull move images between local and remote registries.

Container images should run as non-root, use minimal base images, and pin versions to reduce attack surface and drift.

Kubernetes Pod is the smallest deployable unit; a Deployment manages ReplicaSets to maintain desired pod count and support rolling updates.

CI builds and tests every change automatically; CD automatically delivers to an environment, and continuous deployment releases to production without manual approval.

A pipeline stage fails fast: lint and unit tests run before integration tests, which run before build and deploy.

Infrastructure as Code declares desired state; tools reconcile actual state to it, and idempotent applies can be rerun safely.

Blue-green deployment switches traffic between two identical environments; canary releases shift a small percentage of traffic first.

Observability rests on logs (events), metrics (aggregates over time), and traces (request paths across services).

SLI is a measured indicator, SLO is a target for it, and SLA is a contractual commitment with consequences.

Rollback requires immutable, versioned artifacts; rebuilding from a branch is not a rollback because inputs may have changed.

Secrets belong in a secret manager injected at runtime, never committed to Git or baked into an image layer.

Twelve-factor apps keep config in environment variables, run stateless processes, and treat logs as event streams.

SDLC phases: requirements, design, implementation, testing, deployment, maintenance; iterative models repeat phases per increment.

Git object model: blobs store file content, trees store directory listings, commits point to a tree plus parent commits, refs point to commits.

Git branch is a movable pointer to a commit; HEAD points to the current branch, so checkout moves HEAD rather than rewriting history.

Merge creates a commit with two parents; rebase rewrites commits onto a new base, producing new SHAs and a linear history.

HTTP status classes: 2xx success, 3xx redirect, 4xx client error, 5xx server error; 401 means unauthenticated, 403 means forbidden.

REST constraints: client-server, statelessness, cacheability, uniform interface, layered system, optional code-on-demand.

Idempotent methods: GET, PUT, DELETE, HEAD; POST and PATCH are not idempotent, so retries need idempotency keys.

Big-O common cases: array index O(1), linear search O(n), balanced-tree search O(log n), comparison sort O(n log n), nested loops O(n^2).

Agile ceremonies: sprint planning, daily standup, sprint review, retrospective; a user story states role, goal, and benefit.

HTML semantic elements (header, nav, main, article, section, footer) convey structure to assistive technology and search engines.

CSS box model: content, padding, border, margin; box-sizing: border-box makes width include padding and border.

CSS specificity order: inline style > ID > class/attribute/pseudo-class > element/pseudo-element; !important overrides normal declarations.

Flexbox distributes items along one axis (main axis); Grid lays out rows and columns in two dimensions simultaneously.

JavaScript is single-threaded with an event loop; promises and async/await schedule microtasks that run before the next macrotask.

DOM updates are expensive: batch changes, use document fragments, and let frameworks diff a virtual DOM before touching real nodes.

React component state is immutable from outside; setState/useState triggers re-render, and props flow one way from parent to child.

Fetch returns a promise resolving to a Response; check response.ok because HTTP 4xx/5xx do not reject the promise.

Responsive design uses relative units, media queries, and the viewport meta tag; mobile-first means base styles target small screens.

Node.js runs JavaScript on V8 with a non-blocking event loop; CPU-heavy work blocks all requests, so offload it to worker threads.

Express middleware signature is (req, res, next); calling next() passes control, next(err) jumps to the error-handling middleware.

SQL joins: INNER returns matching rows only, LEFT keeps all left rows, RIGHT keeps all right rows, FULL keeps both sides.

ACID: atomicity (all or nothing), consistency (valid states), isolation (concurrent safety), durability (survives crash).

Normalization reduces redundancy (1NF atomic values, 2NF no partial dependency, 3NF no transitive dependency); denormalization trades storage for read speed.

Indexes speed reads but slow writes and consume space; a composite index is usable left-to-right by leading columns.

JWT has header, payload, signature; the payload is base64url-encoded, not encrypted, so never store secrets there.

Password storage uses a slow salted hash such as bcrypt or Argon2; hashing is one-way, so recovery means reset, not decryption.

REST resource naming uses plural nouns and HTTP verbs for actions; status codes carry outcome, not the response body alone.

IaaS gives virtual machines and networks, PaaS gives managed runtimes, SaaS gives finished applications; control decreases as you move right.

NIST cloud traits: on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service.

Regions contain availability zones; deploying across zones survives a data-center failure, while regions address latency and residency.

Horizontal scaling adds instances, vertical scaling enlarges one instance; stateless services scale horizontally.

Object storage (e.g., buckets) suits unstructured files; block storage attaches to a single server; file storage offers shared POSIX access.

Shared responsibility: the provider secures the physical layer and managed-service internals; the customer secures data, identities, and configuration.

Serverless functions scale to zero and bill per invocation and duration; cold starts add latency after idle periods.

Managed message queues decouple producers from consumers, absorbing bursts and enabling retry without blocking the request path.

Least privilege and identity-based policies govern cloud access; rotate long-lived credentials and prefer short-lived tokens.

A container packages code with its dependencies and shares the host kernel; a virtual machine bundles a full guest OS.

A Docker image is built from ordered layers; each Dockerfile instruction creates a layer, and unchanged layers are cached on rebuild.

Containers are ephemeral: any file written outside a volume disappears when the container is removed.

Dockerfile order matters for cache hits; copy dependency manifests and install before copying source so code edits do not bust the dependency layer.

Port mapping -p host:container publishes a container port; containers reach each other by service name on a user-defined network.

Docker Compose defines multi-container apps in YAML with services, networks, and volumes for local orchestration.

A registry stores tagged images; docker push and docker pull move images between local and remote registries.

Container images should run as non-root, use minimal base images, and pin versions to reduce attack surface and drift.

Kubernetes Pod is the smallest deployable unit; a Deployment manages ReplicaSets to maintain desired pod count and support rolling updates.

CI builds and tests every change automatically; CD automatically delivers to an environment, and continuous deployment releases to production without manual approval.

A pipeline stage fails fast: lint and unit tests run before integration tests, which run before build and deploy.

Infrastructure as Code declares desired state; tools reconcile actual state to it, and idempotent applies can be rerun safely.

Blue-green deployment switches traffic between two identical environments; canary releases shift a small percentage of traffic first.

Observability rests on logs (events), metrics (aggregates over time), and traces (request paths across services).

SLI is a measured indicator, SLO is a target for it, and SLA is a contractual commitment with consequences.

Rollback requires immutable, versioned artifacts; rebuilding from a branch is not a rollback because inputs may have changed.

Secrets belong in a secret manager injected at runtime, never committed to Git or baked into an image layer.

Twelve-factor apps keep config in environment variables, run stateless processes, and treat logs as event streams.