CS AO flashcards
CS AO · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Principle of least privilege
- Every user, service, and process receives only the rights required for its function, and elevated access is granted temporarily with logging, reducing the blast radius of compromise or error.
- Idempotent configuration
- An operation that can be applied repeatedly and always converges to the same end state, so re-running automation does not duplicate users, append duplicate lines, or corrupt configuration.
- Zombie process
- A process that has exited but whose parent has not yet read its exit status, so it remains in the process table consuming a slot until the parent reaps it or is killed.
- Load average meaning
- The average number of runnable plus uninterruptible processes over one, five, and fifteen minutes; compare against CPU core count to judge saturation rather than using a fixed number.
- Exit code 137
- A process terminated by signal 9 (SIGKILL), computed as 128 plus 9; commonly seen when the kernel out-of-memory killer or an operator forcibly kills a process.
- Kickstart file
- An unattended installation answer file used by RHEL-family installers that specifies partitioning, packages, network, and post-install scripts, enabling repeatable identical builds without manual prompts.
- Blue-green deployment
- Two identical environments where traffic switches from the live blue stack to a prepared green stack after validation, allowing near-instant rollback by switching traffic back.
- Canary release
- A deployment that routes a small percentage of traffic to the new version, monitors error and latency signals, then expands exposure gradually or reverts if health degrades.
- Golden image
- A pre-built, hardened machine template used as the deployment baseline; it guarantees identical starting configuration but must be patched and re-validated on a schedule.
- Configuration drift
- The divergence between a host's actual state and its declared baseline, caused by manual edits or failed automation, and detected by comparing live configuration against the source of truth.
- PAM authentication stack
- The Linux pluggable modules that handle login, password, and session policy for services such as sshd and su, controlling lockout, complexity, and account expiry rules.
- Role-based access control
- An access model where permissions are attached to roles and users are assigned roles, so entitlement changes follow job changes rather than individual per-user permission edits.
- Kerberos in Active Directory
- The default authentication protocol in AD, issuing time-limited tickets from a key distribution center so credentials are not sent on every service request.
- Orphaned account
- A still-enabled account belonging to a departed user or completed project; it retains access without an owner and is a frequent audit finding and intrusion entry point.
- LVM logical volume
- A flexible block device carved from a volume group that can be extended across physical disks, then grown with the filesystem to avoid repartitioning.
- XFS grow limitation
- XFS filesystems can be enlarged online with xfs_growfs but cannot be shrunk, so capacity planning for XFS volumes must over-provision rather than rely on later reduction.
- fstab UUID entry
- A mount table line identifying the device by filesystem UUID instead of kernel device name, preventing boot failures when disks are reordered or renamed.
- Inode exhaustion
- A condition where free blocks remain but no inode entries are left for new files, so writes fail; df -i reveals it while df -h still shows space available.
- RAID 5 tradeoff
- Striping with single distributed parity survives one disk failure but rebuilds are slow and stress remaining disks, so large arrays often favor RAID 6 or RAID 10.
- APIPA address
- A 169.254.0.0/16 self-assigned address a host gives itself when DHCP fails; its presence usually indicates a link or DHCP server problem, not a valid network configuration.
- DHCP DORA sequence
- The four-step lease process: Discover broadcast, Offer from server, Request from client, Acknowledge from server; reservations map a MAC address to a fixed IP.
- CIDR usable hosts
- For a prefix length p, usable host addresses equal 2^(32-p) minus 2, removing the network and broadcast addresses; a /30 therefore provides two usable hosts.
- DNS record types
- A and AAAA map names to IPv4 and IPv6 addresses, CNAME aliases one name to another, MX routes mail, TXT carries policy records, and PTR supports reverse lookup.
- VLAN segmentation
- Layer 2 isolation of broadcast domains on shared switching hardware; traffic between VLANs must be routed by a layer 3 device or tagged subinterface.
- SELinux enforcing mode
- A mandatory access control mode where policy denials block the action and are logged to the audit log; permissive mode logs without blocking and is used only for diagnosis.
- Phishing-resistant MFA
- Authentication bound to the originating site, such as FIDO2 hardware keys, which defeats real-time credential relay; time-based one-time codes can be proxied by an attacker.
- CVSS score
- A standardized 0-10 severity rating for a vulnerability based on exploitability and impact; patch urgency also weighs internet exposure and whether working exploits exist.
- Incremental versus differential
- Incremental backups capture changes since the last backup of any type and need the full chain to restore; differential backups capture changes since the last full and need only two sets.
- RPO versus RTO
- Recovery point objective is the maximum tolerable data loss and sets backup frequency; recovery time objective is the maximum tolerable downtime and sets the recovery method.
- Backup verification
- A backup is only proven by a successful test restore to isolated hardware, validating data integrity and application startup while measuring elapsed time against the recovery objective.
- Blameless post-incident review
- A structured review after an outage that documents timeline and contributing causes without punishing individuals, so people report accurately and systemic fixes are identified.
- Layered connectivity triage
- Test loopback, then gateway, then external IP, then name resolution, then the service port; each success eliminates lower layers and narrows the remaining fault.