TS-C (NCCT) cheat sheet

OSI layers from layer 7 down: Application, Presentation, Session, Transport, Network, Data Link, Physical. TCP/IP collapses these into Application, Transport, Internet, and Link.

Usable IPv4 hosts = 2^(32 − prefix length) − 2. A /24 provides 254 hosts; a /30 provides 2 usable addresses for point-to-point links.

RFC 1918 private ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. 169.254.0.0/16 is link-local (APIPA) and 127.0.0.0/8 is loopback.

TCP connection setup is SYN, SYN-ACK, ACK; teardown uses FIN/ACK or RST. UDP provides no handshake, ordering, or retransmission.

RAID levels: 0 = striping with no redundancy; 1 = mirroring; 5 = striping plus single distributed parity (survives one drive failure); 6 = dual parity (survives two); 10 = mirrored stripes.

CAP theorem: during a network partition a distributed system must sacrifice either consistency or availability; partition tolerance is not optional on real networks.

Idempotent HTTP methods are GET, HEAD, PUT, and DELETE; POST and PATCH are not, so retried POSTs require an idempotency key to avoid duplicate side effects.

Type 1 hypervisors run directly on hardware (ESXi, Hyper-V); type 2 hypervisors run as an application on a host operating system (VirtualBox, Workstation).

RTO is the maximum tolerable downtime; RPO is the maximum tolerable data loss expressed as time. RPO drives replication and backup frequency, RTO drives recovery architecture.

Allowed downtime per year: 99% = 87.6 h, 99.9% = 8.77 h, 99.95% = 4.38 h, 99.99% = 52.6 min, 99.999% = 5.26 min.

3-2-1 rule: at least 3 copies of data, on 2 different media types, with 1 copy offsite or offline/immutable.

Functional requirements state what a system does; non-functional requirements state quality attributes such as performance, availability, scalability, security, and compliance.

Redundancy models: N+1 tolerates a single component failure; 2N duplicates full capacity; 2N+1 provides full duplication plus one additional spare.

SLI is the measured metric, SLO is the internal target for that metric, and SLA is the external contract with remedies; the SLA threshold should be looser than the SLO.

TCO = acquisition + implementation + licensing or subscription + operations + decommissioning; capex is upfront capital, opex is recurring operational spend.

A component whose failure alone breaches a stated SLO is a single point of failure and must be removed, continuously monitored, or formally accepted in writing.

DHCP lease sequence (DORA): Discover broadcast, Offer, Request, Acknowledgement. Renewal is unicast to the original server at 50% of the lease time.

Well-known ports: 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 123 NTP/UDP, 161-162 SNMP, 389/636 LDAP/LDAPS, 443 HTTPS, 3389 RDP, 3306 MySQL, 5432 PostgreSQL.

IEEE 802.1Q inserts a 4-byte tag identifying the VLAN on trunk frames; access ports are untagged and belong to exactly one VLAN.

DNS record types: A maps to IPv4, AAAA to IPv6, CNAME to an alias, MX to a mail exchanger, TXT to verification/SPF/DKIM, PTR to reverse lookup; TTL sets cache lifetime.

A TLS handshake negotiates a cipher suite, authenticates the server with a certificate chained to a trusted CA, and derives a shared symmetric session key.

Kerberos rejects tickets when client and server clocks differ by more than 5 minutes by default, so NTP synchronization is mandatory on domain members.

Configuration as code: stored in version control, applied by idempotent automation, peer reviewed via pull request, and promoted through environments in the same artifact form.

Deployment decision rule: blue/green gives instant full rollback at double infrastructure cost; canary limits blast radius with a traffic percentage; rolling updates avoid extra infrastructure but roll back slowly.

Golden signals: latency, traffic, errors, saturation. The USE method checks utilization, saturation, and errors for every constrained resource.

Availability = MTBF / (MTBF + MTTR); cutting MTTR raises availability by the same mechanism as raising MTBF.

Full backup copies all data; incremental copies changes since the last backup of any type (restore needs the full plus every incremental); differential copies changes since the last full (restore needs the full plus the latest differential).

Syslog severity: 0 emerg, 1 alert, 2 crit, 3 err, 4 warning, 5 notice, 6 info, 7 debug - the lower the number, the more severe the event.

SNMP polling uses UDP 161 and traps or informs are sent to UDP 162; SNMPv3 adds authentication and encryption (authPriv) while v1/v2c send plaintext community strings.

Alerting rule: page only on symptoms that threaten an SLO and attach a runbook link; log everything else for diagnosis. Every page must be actionable.

Change categories: standard (pre-approved, low risk), normal (CAB review required), emergency (expedited implementation with retrospective review).

A backup is unverified until a restore test succeeds; record the date and outcome of the last successful restore test in the operations log.

CIA triad mapping: confidentiality via encryption and access control; integrity via hashing, checksums, and signatures; availability via redundancy, backups, and DDoS protection.

Authentication factors are knowledge, possession, and inherence; MFA requires two or more different factor types. Two passwords are single-factor.

Risk = likelihood × impact. Treatments are mitigate, transfer (insurance or contract), avoid, and accept; residual risk is what remains after controls are applied.

Symmetric encryption (AES) uses one shared key, is fast, and handles bulk data; asymmetric encryption (RSA, ECC) uses a public/private key pair for key exchange and signatures; TLS combines both.

Hashing such as SHA-256 is one-way and collision-resistant; a salt is unique random data stored per password; HMAC adds a secret key for message authentication.

Defense in depth layers controls across network (segmentation, firewalls), host (hardening, EDR), identity (MFA, least privilege), and data (encryption at rest and in transit).

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, post-incident lessons learned.

Compliance scope mapping: PCI DSS for cardholder data, HIPAA for protected health information, GDPR for EU personal data, SOC 2 for service-provider control attestation.

Structured method: identify the problem, establish a theory, test the theory, establish a plan of action, implement and verify, document findings.

Layer strategy: bottom-up when physical or link faults are suspected, top-down when a single application fails, divide-and-conquer when the failing layer is unknown.

ping tests ICMP reachability and round-trip time; traceroute/tracert increments TTL to reveal each hop; mtr/pathping combines both views.

DNS diagnostics: dig or nslookup against both the configured resolver and an authoritative server distinguishes cache problems from zone data errors.

HTTP status classes: 4xx indicates a client-side fault (400, 401, 403, 404, 429); 5xx indicates a server-side fault (500, 502, 503, 504).

Packet capture on a switched network requires a SPAN/mirror port or a network TAP; capturing at both endpoints allows request and response comparison.

Support tiers: L1 triage and known-error fixes, L2 deeper diagnostics and configuration changes, L3 engineering or vendor escalation; escalate when the SLA clock or scope threshold is exceeded.

Differential diagnosis compares a working instance against a failing one and checks recent changes first, since most incidents follow a configuration or deployment change.