TS-C (NCCT) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

OSI model

A seven-layer reference model - Physical, Data Link, Network, Transport, Session, Presentation, Application - where each layer provides services to the layer above and hides its own implementation details.

TCP versus UDP

TCP is connection-oriented with a handshake, sequencing, acknowledgements, and retransmission. UDP is connectionless with no delivery guarantee and is used for DNS, DHCP, VoIP, and streaming.

Private IPv4 ranges

RFC 1918 address space: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. These addresses are not routable on the public internet and require NAT for external communication.

CAP theorem

A distributed data store can guarantee only two of consistency, availability, and partition tolerance at once. When a partition occurs, the system must choose between consistency and availability.

RAID 5

Block-level striping with distributed single parity. It survives one drive failure, delivers usable capacity of n−1 drives, and incurs extra write cost for parity calculation.

Idempotent operation

An operation that reaches the same end state when repeated. HTTP GET, PUT, and DELETE are idempotent; POST is not, so safe retries require an idempotency key.

Recovery point objective

RPO is the maximum acceptable data loss measured in time. It determines backup and replication frequency; a 15-minute RPO requires replication at least every 15 minutes.

Recovery time objective

RTO is the maximum acceptable elapsed time to restore a service after a disruption. It drives architecture choices such as standby sites, clustering, and automated failover.

99.9 percent availability

Permits about 8.77 hours of unplanned downtime per year, roughly 43 minutes per month. Each additional nine reduces the allowed downtime by a factor of ten.

SLA SLO and SLI

An SLI is a measured metric such as request success rate, an SLO is the internal target for that metric, and an SLA is the contract specifying consequences when targets are missed.

Three-two-one backup rule

Maintain at least three copies of data, on two different media types, with one copy stored offsite or offline. It protects against device failure, site loss, and ransomware encryption.

DHCP DORA process

The four-step lease exchange: Discover broadcast from the client, Offer from the server, Request from the client, and Acknowledgement from the server. Leases are time-limited and renewed before expiry.

IEEE 802.1Q trunking

Inserts a four-byte tag identifying the VLAN into frames carried on a trunk link. Access ports remain untagged and belong to a single VLAN.

DNS A and CNAME records

An A record maps a hostname to an IPv4 address (AAAA for IPv6). A CNAME maps a hostname to another canonical name and cannot coexist with other records at the same name.

Canary deployment

Routes a small percentage of live traffic to a new version, compares error and latency signals against the baseline, then progressively expands traffic or rolls back automatically when thresholds are breached.

Ports 443 and 22

TCP 443 carries HTTPS, HTTP over TLS, and TCP 22 carries SSH for encrypted remote administration. Both are frequently targeted and should be restricted by firewall policy.

Four golden signals

Latency, traffic, errors, and saturation are the core service monitoring metrics. Saturation measures how full a constrained resource such as CPU, memory, or a queue is.

Mean time to repair

MTTR is the average time required to restore a failed component to service. Combined availability equals MTBF divided by the sum of MTBF and MTTR.

Incremental versus differential backup

Incremental backups capture changes since the last backup of any kind and require the full plus every increment to restore. Differential backups capture changes since the last full, needing only the latest differential.

Syslog severity levels

Eight levels run from 0 emergency to 7 debug; 3 is error and 4 is warning. Lower numbers are more severe, so filters and alerts should respect that ordering.

SNMP trap

An unsolicited notification an agent sends to a management station on UDP port 162 when a threshold or state change occurs. Routine polling uses UDP port 161.

CIA triad

Confidentiality, integrity, and availability are the three security objectives a control set must balance. Encryption supports confidentiality while hashing and checksums support integrity.

Multi-factor authentication

Requires two or more authentication factors of different types: something you know, something you have, or something you are. Two passwords or two PINs do not qualify.

Principle of least privilege

Every user, service, and process receives only the permissions required for its task, and only for as long as required, reducing the blast radius of compromise or human error.

Risk formula

Risk equals likelihood multiplied by impact. Treatments are mitigate, transfer, avoid, and accept, with residual risk documented and approved by an accountable business owner.

Symmetric versus asymmetric encryption

Symmetric algorithms such as AES use one shared key and are fast for bulk data. Asymmetric algorithms such as RSA or ECC use a key pair and serve key exchange and signatures in TLS.

Password salting

A unique random value stored alongside each password hash and combined before hashing. It defeats precomputed rainbow tables and ensures identical passwords produce different hash outputs.

Bottom-up OSI troubleshooting

Start at the physical layer, verifying cabling and link state, then work upward through switching, addressing, routing, and application checks until the fault is isolated to a layer.

Divide-and-conquer troubleshooting

Test at a midpoint of the path or protocol stack to determine which half contains the fault, then repeat inside that half so each test roughly halves the remaining search space.

Ping and traceroute

Ping sends ICMP echo requests to test reachability and round-trip time. Traceroute increments the TTL value to reveal each router hop along the path to the destination.

Problem versus incident

An incident is an unplanned interruption or degradation restored through a workaround. A problem is the underlying cause, managed to closure using root cause analysis and known-error records.

Packet capture span port

A switch port configured to mirror traffic from selected ports or VLANs so a capture tool can record frames without being inline. Accurate timestamps are required for cross-device log correlation.