All sheets · Use your browser Print dialog (Ctrl P) and Save as PDF.
Z+
Final-minute contrasts
One line per lesson from the study pack. Use this in the last minutes — not as a substitute for the worked questions.
| Topic | Remember |
|---|---|
| L01 Ports, protocols, clients and servers | Address = building; port = service door; protocol = conversation rules. |
| L02 TLS, SSL and cipher suites | TLS: trust the endpoint identity, lock the journey, spot tampering. |
| L03 Certificates, public/private keys and trust | Public = publishable; private = protected; certificate = identity/key binding. |
| L04 NTP and why clocks affect authentication | 123: one-two-three, synchronize me. Lower stratum = fewer timing steps from the reference. |
| L05 Web, file, print and storage services | Web serves pages; file service serves files; print service queues jobs; NAS is the storage appliance. |
| L06 FTP, SFTP and FTPS without the confusion | Warehouse 21 takes orders; bay 20 sends active deliveries. Door 22 has two secure keys. SFTP rides SSH; FTPS wraps FTP. |
| L07 Database services and their ports | PostgreSQL 5432 is a countdown: five-four-three-two. MySQL's cabinet is 3306; SQL Server's shelf is 1433; Oracle's desk is 1521. |
| L08 VoIP: call setup, speech and quality | SIP rings; RTP talks; RTCP reports. 5060 says hello, 5061 locks the call setup. |
| L09 Disaster recovery planning and testing | DRP restores technology; BCP keeps work going; BIA decides impact and priority; ITCP prepares IT alternatives. |
| L10 Recovery metrics and hot/warm/cold sites | T = time to return; P = point to return to; WRT = work catch-up; MTD = maximum business limit. |
| L11 Load balancing, redundancy and clusters | Balance = share work; failover = take over; backup = go back. |
| L12 CDN compared with a load balancer | CDN = copies closer; load balancer = distribute back-end work. |
| L13 Nmap and interpreting port scans | Open = listener; closed = no listener observed; filtered = view obstructed. |
| L14 SNMP: manager, agent, MIB, OID and security | 161: ask one question. 162: receive two notification types, traps/informs. MIB = menu; OID = item number. |
| L15 Syslog, event severity and SIEM | Logs are the diary; Syslog delivers it; SIEM compares many diaries. 514 = five events, one timeline, four clues. |
| L16 Wireshark and packet analysis from zero | Request, reply, timing: find the conversation before guessing the cause. |
| L17 Capture placement, tcpdump and flow tools | Wireshark = conversation detail; flow = phone-bill summary; iperf = timed capacity trial. |
| L18 Common performance problems: pages 71-74 | Latency = late; jitter = jumpy arrival; loss = missing; throughput = what got through. |
| L19 QoS, shaping and policing | Shaping waits; policing enforces the limit. QoS chooses who goes first, not how many lanes exist. |
| L20 CIA triad, vulnerability, threat, exploit and risk | Confidentiality = secret; integrity = correct; availability = usable. Weakness → exploit → harm is a possible chain, not an inevitable result. |
| L21 Compliance: PII, GDPR, locality and PCI DSS | PII = person; PCI = payment cards; locality = location; sovereignty = governing jurisdiction. |
| L22 PHI and PUE: scope additions, not located slides | PHI = health information; PUE = power use; PII = identifying a person. |
| L23 Encryption, hashing and data states | Encryption = locked box you can unlock; hash = fingerprint to compare; signature = verifiable signer-bound evidence. |
| L24 Honeypots and internal/external threats | Honeypot = bait with an alarm; internal does not mean innocent or malicious by default. |
| L25 DoS, DDoS, reflection and amplification | Reflection = bounce toward the victim; amplification = make it bigger; distributed = many sources. |
| L26 Botnets, C2 and malware categories | Virus rides; worm walks itself; Trojan disguises; C2 directs the group. |
| L27 Spoofing, on-path attacks and ARP | ARP poisoning changes the address book; MAC spoofing changes the name badge; on-path changes who stands between the speakers. |
| L28 DHCP, rogue DHCP, starvation and snooping | DORA finds your address. Landlord 67 gives tenant 68 a home. Rogue = wrong landlord; starvation = no homes left. |
| L29 VLANs, VLAN hopping and MAC flooding | VLAN = separate rooms; hopping = crossing rooms; MAC flooding = stuffing the switch's directory. |
| L30 Social engineering and password attacks | Pressure + secret request = pause and verify. Look over shoulder, follow through door, search the bin: three physical information/access paths. |
| L31 Authentication, authorization, accounting and factors | Who are you? What may you do? What did you do? RADIUS 1812 checks in; 1813 records the visit. |
| L32 SSO and Kerberos step by step | Gate 88 has two ticket-shaped eights: entry ticket, then service ticket. The master ticket is not your password. |
| L33 Federated identity and SAML | IdP identifies; SP serves; SAML carries the assertion. |
| L34 RBAC, least privilege and privileged accounts | RBAC = role gets rights; least privilege = enough, no extras; separation of duties = independent checks. |
| L35 LDAP, directories and secure binds | LDAP = ask the directory. Shelf 389 is the ordinary entrance; two six-shaped locks guard shelf 3 at 636. |
| L36 Defense in depth and hardening | Lock the building, verify the person, limit the route, protect the data, watch activity, prepare recovery. |
| L37 802.1X, EAP and switch access | Supplicant asks; authenticator guards; authentication server decides. 802.1X is a standard, not port 8021. |
| L38 Access-control rules and stateful firewalls | Who from, where to, which protocol/port, which direction, what action, in what order? |
| L39 Forward proxies, reverse proxies and filtering | Forward = for the clients; reverse = reception for the servers. |
| L40 Zone-based security and screened subnets | Public service in the middle; private data behind another controlled boundary. |
| L41 IDS versus IPS and detection mistakes | IDS detects; IPS prevents. Positive = alarm raised, not necessarily a true attack. |
| L42 IoT and industrial systems: ICS, DCS and SCADA | ICS is the umbrella; DCS runs the plant; SCADA watches and supervises the spread-out sites. |
| L43 Physical security, cameras and geofencing | Lock the room, lock the rack, record entry, watch the space. |
| L44 Wireless controllers: the limited wireless scope | Autonomous = manages itself; lightweight = relies on a controller; controller = one management desk for many APs. |
| L45 FTTC, FTTP, OLT and ONT | Curb = near the building; premises = at the building. OLT = provider end; ONT = customer termination. |
| L46 VPNs, tunneling and remote-access policy | Tunnel wraps; encryption protects; policy limits. |
| L47 IPsec, ESP, AH, modes and IKE | IKE agrees; ESP protects; tunnel wraps the whole original packet. 500 talks; 4500 traverses NAT; 50/51 are protocol IDs. |
| L48 Client-to-site, site-to-site and split/full tunnels | Client-to-site = one person enters; site-to-site = two offices connect. Split/full = which traffic uses the path. |
| L49 SSH versus Telnet and server identity | Door 22 has two keys; door 23 has an open window. |