SQU IT Exit cheat sheet

Algorithm properties: finiteness (terminates after finite steps), definiteness (each step precisely defined), input (zero or more), output (one or more), effectiveness (each step is basic enough to be carried out).

Big-O formal definition: f(n) = O(g(n)) if there exist constants c > 0 and n0 such that 0 ≤ f(n) ≤ c·g(n) for all n ≥ n0. Big-Omega is the lower bound; Big-Theta means both bounds hold.

Common growth rates (slowest to fastest): O(1) < O(log n) < O(n) < O(n log n) < O(n^2) < O(n^3) < O(2^n) < O(n!).

Three basic control structures: sequence, selection (if/else, switch), iteration (for, while, do-while). Any algorithm can be expressed using only these plus composition.

Recursion requires a base case (terminating condition) and a recursive case that moves toward the base case; each call adds a stack frame, so deep recursion risks stack overflow.

Pass by value copies the argument; pass by reference passes the address so the callee can modify the caller's variable. Java passes object references by value (the reference itself is copied).

Compilation vs. interpretation: compiled code is translated once to machine code before execution (faster runtime); interpreted code is translated line by line at runtime (more portable, slower).

Structured programming avoids goto; modularity decomposes a program into cohesive, loosely coupled modules. Coupling measures inter-module dependence (low is good); cohesion measures intra-module focus (high is good).

Array: O(1) random access by index; insertion/deletion at arbitrary position O(n) due to shifting; fixed size in most languages.

Linked list: O(1) insert/delete at a known node; O(n) search; no random access. Singly linked nodes hold data + next pointer; doubly linked add prev.

Stack (LIFO): push, pop, peek all O(1). Used for expression evaluation, undo, recursion, depth-first search. Queue (FIFO): enqueue at rear, dequeue at front, O(1) with a circular buffer.

Binary search tree: average O(log n) search/insert/delete; worst case O(n) when skewed. In-order traversal yields sorted order. Balanced trees (AVL, red-black) guarantee O(log n).

Hash table: average O(1) lookup/insert/delete; worst case O(n) on collisions. Load factor = n/m; rehashing when load factor exceeds threshold (e.g., 0.75 in Java HashMap).

Sorting complexities (average): bubble/insertion/selection O(n^2); merge sort O(n log n) and stable but O(n) extra space; quicksort O(n log n) average, O(n^2) worst, in-place; heap sort O(n log n) worst, not stable.

Graph representations: adjacency matrix O(V^2) space, O(1) edge lookup; adjacency list O(V+E) space, O(degree) neighbor iteration. BFS uses a queue and finds shortest paths in unweighted graphs; DFS uses a stack/recursion.

Dijkstra's algorithm finds single-source shortest paths on non-negative weighted graphs using a priority queue, O((V+E) log V) with a binary heap. It fails with negative edge weights; use Bellman-Ford (O(VE)) instead.

ACID: Atomicity (all-or-nothing), Consistency (constraints preserved), Isolation (concurrent transactions do not interfere), Durability (committed changes survive failure).

SQL clause logical evaluation order: FROM → WHERE → GROUP BY → HAVING → SELECT → ORDER BY → LIMIT. WHERE filters rows before grouping; HAVING filters groups after aggregation.

Join types: INNER returns matching rows only; LEFT/RIGHT return all rows from one side plus matches (NULLs for non-matches); FULL returns all rows from both; CROSS returns the Cartesian product.

Normalization: 1NF eliminates repeating groups (atomic values); 2NF removes partial dependencies on part of a composite key; 3NF removes transitive dependencies on non-key attributes; BCNF requires every determinant to be a candidate key.

Primary key uniquely identifies a row and cannot be NULL; a foreign key references a primary key in another table and enforces referential integrity. UNIQUE allows one NULL in most systems.

Indexes speed up SELECT/WHERE/JOIN but slow INSERT/UPDATE/DELETE because the index must be maintained. A clustered index defines physical row order (one per table); non-clustered indexes are separate structures.

Aggregate functions: COUNT, SUM, AVG, MIN, MAX. COUNT(*) counts rows including NULLs; COUNT(column) ignores NULLs. GROUP BY groups rows; HAVING filters groups.

Transaction isolation levels (weakest to strongest): READ UNCOMMITTED (dirty reads), READ COMMITTED (non-repeatable reads), REPEATABLE READ (phantom reads), SERIALIZABLE (none).

OSI seven layers (bottom-up): Physical, Data Link, Network, Transport, Session, Presentation, Application. TCP/IP model: Network Access, Internet, Transport, Application.

TCP is connection-oriented, reliable, ordered, with flow control and congestion control (three-way handshake SYN, SYN-ACK, ACK). UDP is connectionless, unreliable, low-latency; used for DNS, VoIP, streaming.

IPv4 addresses are 32-bit; IPv6 are 128-bit. Private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. Loopback is 127.0.0.1. Subnet mask /24 = 255.255.255.0 = 256 addresses (254 hosts).

Well-known ports: 20/21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 110 POP3, 143 IMAP, 443 HTTPS, 3306 MySQL, 3389 RDP.

Symmetric encryption (AES, DES) uses one shared key - fast, used for bulk data. Asymmetric encryption (RSA, ECC) uses a public/private key pair - slower, used for key exchange and digital signatures. TLS combines both.

Hashing (SHA-256, bcrypt) is one-way and used for integrity and password storage; it is not encryption. A digital signature encrypts a hash with the sender's private key, providing authentication, integrity, and non-repudiation.

CIA triad: Confidentiality (encryption, access control), Integrity (hashing, checksums), Availability (redundancy, backups, DDoS protection). Common attacks: phishing, SQL injection, XSS, MITM, DoS.

Firewall types: packet-filtering (inspects headers), stateful (tracks connections), application-layer/proxy (inspects payload). IDS detects and alerts; IPS detects and blocks. VPN creates an encrypted tunnel over an untrusted network.

Process vs. thread: a process has its own address space and resources; threads within a process share the address space and resources but have separate stacks and registers. Context switching between threads is cheaper.

Process states: new → ready → running → waiting (blocked) → ready → terminated. The scheduler moves processes between ready and running; I/O moves a process to waiting.

CPU scheduling algorithms: FCFS (non-preemptive, convoy effect), SJF (optimal average waiting time but needs burst prediction), Round Robin (time quantum, fair, preemptive), Priority (starvation risk; aging fixes it).

Deadlock four necessary conditions (Coffman): mutual exclusion, hold and wait, no preemption, circular wait. Break any one to prevent deadlock. Banker's algorithm avoids deadlock by checking safe states.

Paging divides memory into fixed-size frames/pages and eliminates external fragmentation but can cause internal fragmentation. Segmentation uses variable-size logical segments and can cause external fragmentation. Virtual memory uses demand paging; a page fault loads a missing page from disk.

Page replacement algorithms: FIFO (Belady's anomaly possible), LRU (approximates optimal), Optimal (theoretical minimum). Thrashing occurs when the working set exceeds physical memory and the system spends most time paging.

File systems: FAT, NTFS, ext4. Inodes store metadata (permissions, size, block pointers) but not the filename. Journaling file systems log metadata changes to recover quickly after a crash.

Synchronization primitives: mutex (binary lock), semaphore (counting, P/wait and V/signal), monitor. Critical section requirements: mutual exclusion, progress, bounded waiting.

SDLC phases: requirements gathering, analysis, design, implementation, testing, deployment, maintenance. Waterfall is sequential and rigid; Agile is iterative with short sprints and continuous feedback.

Requirements types: functional (what the system does) vs. non-functional (performance, security, usability, reliability). A use case describes actor-system interaction toward a goal.

UML diagrams: use case (actors and goals), class (classes, attributes, relationships), sequence (message order over time), activity (workflow), state (state transitions), component and deployment (architecture).

Coupling and cohesion: aim for low coupling (few dependencies between modules) and high cohesion (each module has one focused responsibility).

Testing levels: unit (single component), integration (interfaces between components), system (whole system), acceptance (user validation). Black-box tests behavior without internals; white-box tests internal paths and branches.

Verification asks 'Are we building the product right?' (conforms to spec); validation asks 'Are we building the right product?' (meets user needs).

Version control: Git commits are snapshots; branches isolate work; merge combines histories; pull requests enable code review. Semantic versioning: MAJOR.MINOR.PATCH.

Estimation and planning: function points measure functional size; COCOMO estimates effort from size; Gantt charts show schedule; PERT/CPM identify the critical path.

HTTP methods: GET (retrieve, safe, idempotent), POST (create, not idempotent), PUT (replace, idempotent), PATCH (partial update), DELETE (idempotent). Status codes: 2xx success, 3xx redirect, 4xx client error, 5xx server error.

REST principles: statelessness, client-server separation, uniform interface, cacheability, layered system. Resources are identified by URIs; JSON is the common representation.

Client-side vs. server-side: HTML/CSS/JavaScript run in the browser; server-side code (PHP, Node.js, Python, Java) runs on the server and generates responses. AJAX/Fetch enables asynchronous requests without full page reload.

Responsive design uses fluid grids, flexible images, and CSS media queries. Mobile-first designs start from small screens and scale up.

Mobile platforms: native (Swift/iOS, Kotlin/Android - best performance and device access), cross-platform (Flutter, React Native - one codebase), and hybrid/web (Cordova - web tech in a native shell).

Security basics: validate and sanitize input to prevent SQL injection and XSS; use HTTPS/TLS; store passwords hashed with salt (bcrypt); use parameterized queries; set HttpOnly and Secure cookie flags; implement CSRF tokens.

MVC separates Model (data/business logic), View (UI), and Controller (input handling). MVVM adds a ViewModel that binds data to the view, common in mobile and modern front-end frameworks.

Session vs. token authentication: sessions store state server-side with a session ID cookie; JWT tokens are stateless and carry signed claims, suitable for APIs but harder to revoke.

Information system components: hardware, software, data, people, processes. Types by level: TPS (transaction processing), MIS (management reporting), DSS (decision support), EIS (executive), ERP (integrated enterprise), CRM (customer).

SDLC models: Waterfall (predictable, heavy documentation), Agile/Scrum (iterative, sprints, daily standups, product owner, scrum master), Kanban (continuous flow, WIP limits), Spiral (risk-driven), V-model (verification/validation pairing).

Triple constraint (project management triangle): scope, time, cost - quality is affected when any one changes. A change in one usually requires adjusting the others.

Project management knowledge areas (PMBOK): integration, scope, schedule, cost, quality, resource, communications, risk, procurement, stakeholder. Processes map to initiating, planning, executing, monitoring/controlling, closing.

Critical path method: the longest path through the network determines the minimum project duration; activities on the critical path have zero float (slack).

Risk management steps: identify, analyze (probability × impact), plan response (avoid, mitigate, transfer, accept), monitor. A risk register tracks risks, owners, and responses.

Earned Value Management: PV (planned value), EV (earned value), AC (actual cost). CV = EV − AC; SV = EV − PV; CPI = EV/AC; SPI = EV/PV. CPI or SPI below 1 indicates over budget or behind schedule.

System acquisition options: build in-house, buy COTS, or outsource. Make-or-buy analysis weighs total cost of ownership, strategic fit, and risk.

Professional codes (e.g., ACM/IEEE-CS Software Engineering Code) emphasize public safety, honesty, competence, confidentiality, and avoiding conflicts of interest. Public safety takes precedence over employer interests.

Ethical decision tests: the publicity test (would you be comfortable if the decision were public?), the reversibility test (would you accept the same treatment?), and the harm test (who is affected and how?).

Whistleblowing is justified when there is serious harm, internal channels have been exhausted, and the disclosure is proportionate and evidence-based.

Intellectual property: copyright protects expression (not ideas), patents protect inventions, trademarks protect brand identifiers, trade secrets protect confidential business information. Software is protected by copyright and often by patents.

Data privacy principles (e.g., GDPR): lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity/confidentiality, accountability. Users have rights to access, rectify, and erase their data.

Communication models: sender → encoding → channel → decoding → receiver, with feedback and noise. Active listening involves paraphrasing, clarifying, and confirming understanding.

Team stages (Tuckman): forming, storming, norming, performing, adjourning. Conflict can be functional (task-focused) or dysfunctional (personal); address it early and directly.

Meeting and documentation etiquette: circulate an agenda in advance, record decisions and action items with owners and due dates, and follow up in writing. Use clear, audience-appropriate language and avoid unexplained jargon.