IUP ITS cheat sheet

Incident management restores service as fast as possible; problem management finds and eliminates root cause via known-error records and workarounds.

Priority = Impact × Urgency (ITIL-style matrix). A high-impact, high-urgency incident is P1; a low-impact, low-urgency request is P4.

Service level agreement (SLA) is with the customer; operational level agreement (OLA) is internal between teams; underpinning contract (UC) is with an external supplier.

First-call resolution (FCR) = incidents closed at first contact ÷ total incidents × 100. Higher is better; track by channel.

MTTR = total downtime ÷ number of incidents; MTBF = total uptime ÷ number of failures. Availability = MTBF ÷ (MTBF + MTTR).

Change types: standard (pre-approved, low risk), normal (CAB review), emergency (expedited approval). A change freeze blocks normal changes during critical periods.

The service desk is a single point of contact (SPOC); tiered support escalates functional (skills) or hierarchical (authority) when unresolved.

Major incident: declare a major-incident manager, open a bridge, communicate at fixed intervals, and separate technical recovery from stakeholder comms.

CSI (continual service improvement) uses the Deming cycle: Plan–Do–Check–Act, driven by SLA reports, customer surveys, and trend analysis.

OSI layers 1–7: Physical, Data Link, Network, Transport, Session, Presentation, Application. Switches operate at L2; routers at L3.

Private IPv4 ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. APIPA 169.254.0.0/16 means DHCP failed.

Subnet hosts = 2^(host bits) − 2. /24 gives 254 usable; /30 gives 2 usable (point-to-point links).

TCP is connection-oriented (three-way handshake SYN, SYN-ACK, ACK) and reliable; UDP is connectionless and faster for voice/video/DNS.

Well-known ports: 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 3389 RDP. Memorize these for troubleshooting.

DNS resolves names to IPs (A/AAAA records); DHCP assigns addresses via DORA (Discover, Offer, Request, Acknowledge).

VLANs segment broadcast domains at L2; inter-VLAN routing requires a router or L3 switch (router-on-a-stick uses 802.1Q trunk subinterfaces).

Wi-Fi security order: WPA3 > WPA2 > WEP. WPA2-Personal uses PSK; WPA2-Enterprise uses 802.1X/RADIUS.

Troubleshooting order: physical/link first (cable, LED, duplex), then IP config (ipconfig/ifconfig, ping loopback 127.0.0.1), then DNS, then routing (tracert, traceroute).

CIA triad: Confidentiality (encryption, access control), Integrity (hashing, digital signatures), Availability (redundancy, backups, DDoS protection).

Authentication factors: something you know (password), have (token), are (biometrics). MFA requires two or more different factor types.

Symmetric encryption (AES) is fast for bulk data; asymmetric (RSA, ECC) solves key exchange and supports signatures. TLS uses both.

Hashing (SHA-256) is one-way and detects tampering; salt defeats rainbow tables; HMAC adds a shared key for integrity plus authenticity.

Defense in depth layers controls: perimeter firewall, IDS/IPS, endpoint protection, least privilege, patching, logging/SIEM, and user awareness.

Phishing indicators: mismatched sender domain, urgency, unexpected attachments, hover-link mismatch, and requests for credentials or payment.

Risk = likelihood × impact. Treatment options: mitigate, transfer (insurance), avoid, or accept (documented residual risk).

Incident response phases: Preparation → Identification → Containment → Eradication → Recovery → Lessons learned.

Zero trust: never trust, always verify - authenticate and authorize every request regardless of network location; enforce least privilege and micro-segmentation.

Windows: services.msc manages services; Event Viewer logs Application, Security, System; Task Manager shows CPU, memory, disk, network.

Linux: systemctl start|stop|enable|status manages units; journalctl -xe reads logs; top/htop shows processes; df -h and du -sh check disk usage.

File permissions: Linux rwx = 4+2+1; chmod 755 = owner rwx, group r-x, others r-x. Windows NTFS uses ACLs with explicit vs inherited permissions.

Active Directory: users, computers, and groups live in OUs; Group Policy Objects (GPOs) apply settings to OUs and are processed LSDOU (Local, Site, Domain, OU).

Virtualization: Type 1 hypervisor runs on bare metal (ESXi, Hyper-V); Type 2 runs on a host OS (VirtualBox, VMware Workstation).

Backup types: full (all data), incremental (changes since last backup), differential (changes since last full). Restore needs full + latest differential or full + all incrementals.

RAID: 0 stripe (performance, no redundancy), 1 mirror, 5 stripe+parity (tolerates one disk), 6 double parity, 10 mirror+stripe.

Patch management cycle: inventory → test in staging → deploy in waves → verify → rollback plan. Reboot requirements must be scheduled.

ERP integrates core business processes (finance, HR, supply chain); CRM manages customer interactions; HRIS handles employee records; SCM manages supplier flows.

SaaS is vendor-hosted multi-tenant; PaaS provides a development platform; IaaS provides virtualized infrastructure. Responsibility for data and access remains with the customer in all models.

Database keys: primary key uniquely identifies a row; foreign key references another table's primary key; composite key uses multiple columns.

Normalization: 1NF removes repeating groups; 2NF removes partial dependencies; 3NF removes transitive dependencies. Denormalization trades integrity for read performance.

ACID: Atomicity, Consistency, Isolation, Durability - properties of reliable transactions. BASE (Basically Available, Soft state, Eventually consistent) is the NoSQL alternative.

ETL (Extract, Transform, Load) feeds data warehouses; data lakes store raw structured and unstructured data; data marts are subject-specific subsets.

Backup and retention: define RPO (max acceptable data loss) and RTO (max acceptable downtime); test restores, not just backups.

Integration patterns: API (REST/JSON), message queue, file transfer, and direct database link. APIs should be authenticated (OAuth 2.0, API keys) and versioned.

Governance frameworks: COBIT (IT governance and management objectives), ITIL (service management), ISO/IEC 27001 (information security management system).

Policy hierarchy: policy (mandatory rules) → standard (specific requirements) → procedure (step-by-step) → guideline (recommended).

Data classification tiers commonly: Public, Internal, Confidential, Restricted. Handling rules (encryption, retention, sharing) follow the tier.

GDPR: lawful basis required, data subject rights (access, erasure, portability), 72-hour breach notification to the supervisory authority.

Least privilege and separation of duties are preventive controls; audit logs and reviews are detective controls.

Audit evidence: change tickets, access reviews, backup restore tests, incident records, and training completion. Retain per policy and legal requirements.

Vendor risk: due diligence before onboarding, contractual security clauses, right-to-audit, and periodic reassessment.

Business continuity (BCP) keeps the business running; disaster recovery (DR) restores IT after a major event. Both are tested on a schedule.

Cloud service models shift responsibility: IaaS (customer manages OS and up), PaaS (customer manages app and data), SaaS (customer manages data and access).

Cloud deployment models: public, private, hybrid, community. Hybrid integrates on-premises with cloud for burst or data-locality reasons.

Containers share the host OS kernel and are lighter than VMs; orchestration (Kubernetes) manages scaling, scheduling, and self-healing.

AI/ML pipeline: data collection → cleaning → feature engineering → training → evaluation → deployment → monitoring for drift.

RPA automates repetitive rule-based tasks; low-code platforms accelerate app delivery but require governance for shadow IT.

IoT devices often ship with weak default credentials; segment them on isolated VLANs and patch firmware on a schedule.

Digital transformation success metrics: cycle time, adoption rate, cost per transaction, customer satisfaction, and error rate - not just deployment count.

Edge computing moves processing near the data source to reduce latency and bandwidth; it complements, not replaces, centralized cloud.

Project constraints: scope, time, cost, quality - changing one affects the others (triple constraint).

PMBOK process groups: Initiating, Planning, Executing, Monitoring and Controlling, Closing. A project charter authorizes the project.

Critical path is the longest sequence of dependent tasks; it determines minimum project duration, and any delay on it delays the project.

Earned value: CV = EV − AC; SV = EV − PV; CPI = EV/AC; SPI = EV/PV. CPI or SPI below 1.0 means over budget or behind schedule.

Risk register: identify, assess probability and impact, plan response (avoid, mitigate, transfer, accept), assign owner, and review.

Change management (people side): communicate the why, engage stakeholders, provide training, and measure adoption. Kotter's 8 steps start with urgency.

RACI matrix: Responsible (does the work), Accountable (owns the outcome, one per task), Consulted (two-way input), Informed (one-way updates).

Go-live readiness: rollback plan, support handover, training complete, acceptance criteria signed off, and communication sent.