TCTCN cheat sheet

The OSI reference model has seven layers, in order: physical, data link, network, transport, session, presentation, application.

Encapsulation order when sending: data, segment (TCP) or datagram (UDP), packet (IP), frame (Ethernet), bits on the medium.

TCP is connection-oriented and opens with a SYN / SYN-ACK / ACK handshake, guaranteeing ordered delivery with retransmission; UDP is connectionless with no delivery or ordering guarantee.

Port ranges: 0-1023 well-known, 1024-49151 registered, 49152-65535 dynamic or ephemeral.

Common ports: 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 3306 MySQL, 3389 RDP.

Usable IPv4 hosts in a /n subnet = 2^(32-n) - 2, subtracting the network and broadcast addresses.

RFC 1918 private ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16; they are not internet-routable and require NAT for external access.

RAID levels: 0 stripe with no redundancy, 1 mirror, 5 single parity with a 3-disk minimum, 6 dual parity with a 4-disk minimum, 10 mirrored stripes.

Availability to downtime: 99.9 percent is about 8.77 hours per year, 99.99 percent about 52.6 minutes per year, 99.999 percent about 5.26 minutes per year.

DR strategies ordered by increasing cost and decreasing RTO: backup and restore, pilot light, warm standby, multi-site active/active.

RTO is the maximum tolerable time to restore service; RPO is the maximum tolerable data loss measured backward from the incident.

Redundancy notation: N+1 tolerates one component failure with no capacity loss, N+2 tolerates two, and 2N fully duplicates the minimum footprint.

Under the CAP theorem, network partitions are unavoidable, so a distributed store must be designed as either CP (consistency over availability) or AP (availability over consistency) during a partition.

Load-balancing algorithms and their fit: round robin for equal servers, weighted for unequal capacity, least connections for variable request cost, IP hash for session affinity.

Synchronous replication lowers RPO to near zero at the cost of higher write latency; asynchronous replication favours latency and throughput at the cost of possible data loss.

Stateless application tiers scale horizontally behind a load balancer; stateful tiers require session affinity or a shared external session store.

Separating presentation, application, and data tiers allows independent scaling and confines the blast radius of a failure or compromise.

Capacity headroom is planned as measured peak multiplied by roughly 1.2 to 1.3, then re-verified with one unit of the redundancy model removed.

DHCP lease allocation follows DORA: Discover broadcast, Offer from server, Request from client, Acknowledge from server.

DNS record types: A maps to IPv4, AAAA maps to IPv6, CNAME aliases one name to another, MX routes mail, TXT carries verification and policy strings, PTR supports reverse lookup.

An 802.1Q trunk inserts a 4-byte tag per frame carrying a 12-bit VLAN ID, yielding 4094 usable VLANs; an access port carries a single untagged VLAN.

An operation is idempotent when repeated application yields the same end state; declarative infrastructure-as-code tools depend on this so reruns converge safely.

The 3-2-1 backup rule: three copies of data, on two different media types, with one copy offsite, plus one offline or immutable copy to resist ransomware.

Every production change record should carry an approval, a scheduled window, a verification step, and a tested rollback that names the trigger conditions and authorised executor.

Monitoring golden signals: latency, traffic, errors, and saturation; alert on user-impacting symptoms rather than raw component metrics alone.

Patch promotion flows through test ring, pilot group, then production, with CVE severity and vendor advisories driving the cadence.

Log rotation bounds file growth on a schedule, while retention duration is set by compliance obligations and forensic investigation needs.

The CIA triad: confidentiality restricts readership, integrity keeps data accurate and unaltered, availability keeps systems and data reachable when needed.

AAA separates authentication (who you are), authorization (what you may do), and accounting (what you did, logged).

Least privilege grants only the permissions needed for the current task, for only as long as needed; separation of duties prevents one identity from completing a sensitive action alone.

MFA requires two or more factors from different categories: something you know, something you have, something you are; two passwords do not satisfy MFA.

Encryption in transit uses TLS 1.2 or 1.3 or IPsec; encryption at rest typically uses AES-256 with keys held in a KMS or HSM.

Risk score = likelihood of a threat exploiting a vulnerability multiplied by business impact; treatments are mitigate, transfer, avoid, and accept.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and lessons learned; containment precedes eradication to stop spread.

Troubleshooting strategies are bottom-up (physical layer first), top-down (application first), and divide-and-conquer (test a middle layer such as network reachability first).

Core diagnostic tooling: ping for ICMP reachability and round-trip time, traceroute for per-hop path, netstat or ss for sockets, packet capture for protocol-level evidence.