BCCITB cheat sheet

CPU components: ALU performs arithmetic and logic; control unit fetches, decodes, and coordinates; registers hold the working data set; cache sits between CPU and RAM in a speed/capacity trade-off (L1 fastest and smallest, L3 largest and slowest).

Instruction cycle (fetch-decode-execute) repeats per clock tick; clock speed in GHz is cycles per second, but IPC (instructions per cycle) and core count also determine throughput, so GHz alone does not rank CPUs.

RAM is volatile working memory; DRAM needs periodic refresh, SRAM (used for cache) does not. Storage (HDD/SSD/NVMe) is non-volatile, so data survives power loss.

Storage hierarchy by speed: registers > cache > RAM > SSD (SATA ~550 MB/s, NVMe Gen3/Gen4 several GB/s) > HDD (~100-200 MB/s).

Motherboard buses: PCIe for expansion (x1/x4/x16 lanes), SATA for drives, USB for peripherals, and DIMM slots for RAM. M.2 slots carry either SATA or NVMe drives, so keying determines compatibility.

RAID rules: RAID 0 stripes (no redundancy), RAID 1 mirrors, RAID 5 stripes with single parity (survives one drive failure, usable capacity n-1), RAID 6 double parity (survives two), RAID 10 mirrors then stripes.

Power and form factors: ATX/micro-ATX/Mini-ITX differ in board size and slot count; PSU wattage must cover CPU + GPU + drives with headroom; 80 PLUS ratings (Bronze to Titanium) measure efficiency, not output wattage.

Binary units: 1 byte = 8 bits; 1 KB = 1024 bytes (KiB), 1 MB = 1024 KB, 1 GB = 1024 MB, 1 TB = 1024 GB. Vendor drive capacity often uses decimal (10^3) units, explaining 'missing' space.

Peripheral interfaces: USB 2.0 = 480 Mbps, USB 3.x = 5-20 Gbps, Thunderbolt 3/4 = 40 Gbps, HDMI/DisplayPort carry video plus audio. Hot-swap applies to USB and most SATA/NVMe bays, not internal CPU or RAM.

Kernel modes: kernel mode has unrestricted hardware access; user mode is sandboxed. A system call is the controlled transition from user to kernel mode (e.g., file I/O, process creation).

Process vs thread: a process has its own address space; threads share the process address space and heap but have separate stacks and registers. Context switching saves and restores CPU state.

Scheduling: preemptive schedulers can interrupt a running task (round-robin, priority); non-preemptive run to completion. Starvation occurs when low-priority tasks never run; aging mitigates it.

Memory management: paging divides memory into fixed-size pages/frames; virtual memory maps logical to physical addresses via page tables; thrashing is excessive paging that collapses throughput.

File systems: NTFS (Windows, journaling, ACLs, compression), FAT32 (4 GB max file size), exFAT (large files, cross-platform), ext4 (Linux journaling), APFS (macOS).

Windows tools: Task Manager (processes, startup, performance), Device Manager (drivers), Disk Management (partitions, volumes), Event Viewer (logs), Services (msc), Registry (regedit).

Linux essentials: chmod permissions rwx = 4/2/1 (e.g., 755 = rwxr-xr-x), chown changes owner, ps/top list processes, grep searches text, systemd unit files manage services.

Licensing models: proprietary/perpetual, subscription (Microsoft 365), open source (GPL requires sharing modifications; MIT/BSD permissive), OEM licenses tie to hardware and are non-transferable.

Patch and update strategy: OS patches fix security flaws; application updates fix bugs and features. Test before wide deployment; roll back via restore points or snapshots if a patch breaks systems.

OSI layers (1-7): Physical, Data Link, Network, Transport, Session, Presentation, Application. TCP/IP maps to Link, Internet, Transport, Application.

Key protocols and ports: HTTP 80, HTTPS 443, FTP 20/21, SSH 22, Telnet 23, SMTP 25, DNS 53, DHCP 67/68, POP3 110, IMAP 143, SNMP 161, LDAP 389, RDP 3389.

TCP vs UDP: TCP is connection-oriented with handshake, sequencing, and retransmission (web, email, SSH); UDP is connectionless, lower latency, no delivery guarantee (DNS queries, VoIP, streaming, DHCP).

IPv4 addressing: 32-bit, dotted decimal; private ranges 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; loopback 127.0.0.1; APIPA 169.254.x.x means DHCP failed. IPv6 is 128-bit, written in hex.

Subnetting: /24 = 255.255.255.0 with 256 addresses (254 usable); usable hosts = 2^(host bits) - 2. Network address is all host bits 0; broadcast is all host bits 1.

DNS resolves names to IPs (A, AAAA, CNAME, MX, TXT records); DHCP leases IP, mask, gateway, and DNS automatically; NAT translates private to public addresses.

Switches forward by MAC at Layer 2; routers forward by IP at Layer 3; VLANs segment a switch logically; a default gateway is the router address for off-subnet traffic.

Wi-Fi standards: 802.11n (Wi-Fi 4, 2.4/5 GHz), 802.11ac (Wi-Fi 5, 5 GHz), 802.11ax (Wi-Fi 6, 2.4/5/6 GHz). 2.4 GHz has longer range, 5 GHz more channels and speed.

Troubleshooting order: ping loopback, then gateway, then public IP, then DNS name. If IP works but names fail, suspect DNS; if no gateway, suspect DHCP or link layer.

CIA triad: Confidentiality (encryption, access control), Integrity (hashing, checksums, digital signatures), Availability (redundancy, backups, DDoS protection).

Authentication factors: something you know (password, PIN), have (token, smartcard), are (biometrics). MFA requires two or more different factor types; two passwords are not MFA.

Symmetric encryption (AES) uses one shared key and is fast; asymmetric (RSA, ECC) uses a public/private pair for key exchange and signatures. TLS combines both.

Hashing (SHA-256) is one-way and used for integrity and password storage with salt; MD5/SHA-1 are deprecated for security. Hashing is not encryption.

Malware types: virus (needs host and user action), worm (self-propagating over network), trojan (disguised), ransomware (encrypts and demands payment), rootkit (hides privileged access), spyware (collects data).

Social engineering: phishing (email), spear phishing (targeted), vishing (voice), smishing (SMS), pretexting, tailgating. Defense includes verification procedures and awareness training.

Backup rules: 3-2-1 means 3 copies, 2 media types, 1 offsite. Full, incremental (changes since last backup), and differential (changes since last full) differ in restore time and storage.

Access control: least privilege, role-based access control (RBAC), principle of separation of duties. Patch management closes known vulnerabilities; CVSS scores rate severity.

Common attacks: brute force (try all), dictionary (wordlist), credential stuffing (reused passwords), MITM (interception), SQL injection (malicious input), DDoS (overwhelming traffic), zero-day (unpatched).

Structured method: identify the problem, establish a theory, test the theory, plan and implement a fix, verify full functionality, document findings.

Start with the simplest and most likely cause (cable, power, permissions) before hardware replacement; change one variable at a time to isolate the fault.

No POST/no display: check power, monitor cable, RAM seating, and beep codes or diagnostic LEDs; clear CMOS if BIOS settings are corrupt.

Boot failure: safe mode, last known good configuration, boot order, and startup repair. If a drive is not detected, check cabling, power, and BIOS drive mode.

Performance issues: check CPU, RAM, and disk usage in Task Manager/Activity Monitor; high disk queue often indicates a failing HDD or full disk.

Network troubleshooting: ipconfig/ifconfig for IP, ping for reachability, tracert/traceroute for path, nslookup for DNS, and check link lights and switch port.

Printer issues: check queue (stuck jobs), spooler service, driver version, and connectivity. A print job that never clears usually needs spooler restart.

Escalation rules: handle within scope; escalate when it requires admin rights, vendor support, or exceeds your authority. Log symptoms, steps, and results for the next tier.

Documentation and ticketing: record symptoms, actions, and resolution; use a knowledge base to speed repeat issues; verify with the user before closing.

Service models: IaaS (virtual machines, storage, networking), PaaS (managed runtime and databases), SaaS (finished applications). Responsibility for patching shifts from customer to provider as you move IaaS to SaaS.

Deployment models: public, private, hybrid, and community cloud. Hybrid combines on-premises with public cloud and requires consistent identity and networking.

Cloud characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service (pay-as-you-go).

Virtualization: a hypervisor (Type 1 bare-metal, Type 2 hosted) runs VMs; containers share the host OS kernel and are lighter and faster to start than VMs.

Containers and orchestration: Docker packages applications with dependencies; Kubernetes schedules and scales containers across nodes.

Serverless/FaaS runs code on demand without managing servers; billing is per invocation and execution time; cold starts add latency.

AI and ML basics: supervised learning uses labeled data, unsupervised finds patterns, reinforcement learning uses rewards. Generative AI produces text or images from prompts; verify outputs for accuracy.

IoT and edge: IoT devices are network-connected sensors/actuators; edge computing processes data near the source to reduce latency and bandwidth.

Security in cloud: shared responsibility model, identity and access management, encryption at rest and in transit, and least-privilege policies.

ITIL service lifecycle concepts: service strategy, design, transition, operation, continual improvement. Modern ITIL 4 uses the service value chain and practices rather than lifecycle stages.

Incident vs problem: an incident is an unplanned interruption or degradation restored as quickly as possible; a problem is the underlying cause investigated to prevent recurrence.

Change management: standard (pre-approved, low risk), normal (reviewed by change advisory board), emergency (expedited). Every change needs a rollback plan.

Service desk tiers: Tier 1 logs and resolves common issues; Tier 2 handles deeper technical work; Tier 3 is vendor or engineering escalation.

SLA vs OLA: an SLA is an agreement with the customer (uptime, response time); an OLA is an internal agreement between teams supporting the SLA.

Priority = impact x urgency. High impact and high urgency yield critical priority; low-impact requests may be handled as service requests, not incidents.

Knowledge management: create, validate, and maintain articles; link them to tickets to reduce resolution time and repeat escalations.

Professional conduct: protect confidentiality, follow data protection laws (e.g., GDPR), maintain accurate records, and disclose conflicts of interest.

Metrics: MTTR (mean time to repair), MTBF (mean time between failures), first-contact resolution rate, and SLA compliance. Track trends, not single events.