TCTCN flashcards
TCTCN · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- OSI reference model layers
- The OSI model defines seven layers: physical, data link, network, transport, session, presentation, and application. Each layer provides services to the layer above and consumes services from the layer below.
- TCP versus UDP
- TCP is connection-oriented, guarantees ordered delivery, and performs retransmission and flow control. UDP is connectionless, has lower overhead, and does not guarantee delivery, ordering, or duplicate suppression.
- CIDR notation meaning
- The /n suffix states how many leading bits of an IPv4 address form the network portion. Remaining bits identify hosts, so usable host count is 2^(32-n) minus two.
- Private IPv4 address ranges
- RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 for private use. These addresses are not routable on the public internet and need NAT for external access.
- RAID 5 versus RAID 6
- RAID 5 stripes data with single parity, needs at least three disks, and survives one disk failure. RAID 6 uses dual parity, survives two simultaneous failures, and costs more capacity and write performance.
- Type 1 versus Type 2 hypervisor
- A type 1 hypervisor runs directly on the physical hardware with no host operating system beneath it. A type 2 hypervisor runs as an application on top of a general-purpose operating system.
- Availability percentage formula
- Availability equals uptime divided by total elapsed time, expressed as a percentage. 99.9 percent permits roughly 43 minutes of downtime per month; 99.99 percent permits about 4.3 minutes.
- DNS versus DHCP purpose
- DNS resolves human-readable names into IP addresses. DHCP automatically supplies clients with IP addresses, subnet masks, default gateways, and other parameters, typically through the four-message DORA exchange.
- RTO versus RPO
- Recovery time objective is the maximum acceptable time to restore a service after disruption. Recovery point objective is the maximum acceptable data loss, measured backward in time from the incident.
- N+1 redundancy
- N+1 provisions one additional component beyond the minimum required to operate, so a single failure preserves full capacity. N+2 provides two spare components and tolerates two concurrent failures.
- Three-tier application architecture
- Presentation, application logic, and data are separated into distinct tiers. This separation allows independent scaling, tighter security boundaries between layers, and isolated failure domains.
- CAP theorem trade-off
- A distributed data store can guarantee only two of consistency, availability, and partition tolerance simultaneously. Because partitions are unavoidable, systems choose consistency or availability during a partition.
- Round robin load balancing
- Requests are distributed to backend servers in sequential rotation. It suits servers of similar capacity handling similar request cost; weighted variants accommodate servers with unequal capacity.
- Hot, warm, cold DR sites
- A hot site is fully equipped with near-immediate failover. A warm site has partial infrastructure and takes hours to days. A cold site provides only space and power, requiring the longest recovery.
- Capacity planning headroom
- Provisioning capacity above measured peak demand absorbs growth and absorbs the loss of one redundant unit. Typical headroom targets run about 20 to 30 percent above measured peak utilisation.
- Software-defined networking
- SDN separates the control plane, which computes forwarding decisions, from the data plane, which moves packets. A centralized controller programs the forwarding devices through programmatic interfaces.
- DHCP DORA sequence
- The four DHCP messages are Discover, Offer, Request, and Acknowledge. The client broadcasts Discover, a server Offers a lease, the client Requests it, and the server Acknowledges with final parameters.
- Common DNS record types
- A maps a name to an IPv4 address and AAAA to IPv6. CNAME aliases one name to another, MX directs mail delivery, TXT holds verification and policy strings, and PTR supports reverse lookup.
- 802.1Q VLAN trunking
- A trunk carries multiple VLANs between switches by inserting a four-byte tag into each frame. The tag holds a 12-bit VLAN identifier, supporting up to 4094 usable VLANs.
- Idempotent configuration
- An operation is idempotent when applying it repeatedly produces the same result as applying it once. Declarative infrastructure tools rely on this so reruns converge without unintended side effects.
- 3-2-1 backup rule
- Keep three copies of data, on two different media types, with one copy stored offsite. One copy should be offline or immutable so ransomware cannot encrypt it.
- Change rollback plan
- Every change should include a tested way to revert. A rollback plan states the trigger conditions, the exact reversal steps, and who is authorised to execute them.
- Golden signals of monitoring
- Latency, traffic, errors, and saturation. These four measures give a compact view of service health, and alerting on them reflects user impact rather than raw component state.
- Log rotation and retention
- Rotation prevents unbounded log growth by archiving or deleting old files on a schedule. Retention duration is driven by compliance requirements and the needs of forensic investigation.
- CIA triad
- Confidentiality restricts data to authorised readers, integrity ensures data is accurate and unaltered, and availability ensures systems and data remain accessible when needed.
- Least privilege principle
- Identities and processes receive only the permissions required for the current task, and only for as long as needed. This limits damage from compromised accounts and accidental error.
- Multi-factor authentication categories
- Authentication factors fall into something you know, something you have, and something you are. MFA requires two or more different categories, not two instances of the same category.
- Symmetric versus asymmetric encryption
- Symmetric encryption uses one shared key and is fast, suiting bulk data. Asymmetric encryption uses a public-private key pair, solving key distribution but running much slower.
- Risk equals likelihood times impact
- Qualitative risk scoring multiplies the probability that a threat exploits a vulnerability by the resulting business impact. The resulting score is used to prioritise remediation work.
- Incident response phases
- The phases are preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Containment stops the spread before eradication removes the root cause.
- Bottom-up OSI troubleshooting
- Start at the physical layer and work upward, verifying cabling and link status, then IP addressing, then application behaviour. This isolates the lowest failing layer before higher layers are investigated.
- Ping and traceroute diagnostics
- Ping sends ICMP echo requests to test reachability and round-trip latency. Traceroute varies the time-to-live value to reveal each hop along the path to the destination.