Computer Fundamentals

Why computer fundamentals matter

A surprising number of problems that appear to be "network issues", "application issues", or even "security incidents" are ultimately caused by something much more fundamental:

• A disk has run out of space.
• A computer does not have enough RAM.
• A process is consuming all available CPU.
• A service failed to start.
• The operating system cannot access a file.
• A disk has failed.
• The boot configuration has changed.
• Virtual machine resources have been exhausted.
• File permissions are incorrect.

This module gives you the practical computer knowledge expected from someone working in IT support, infrastructure, cloud, or cybersecurity.

You do not need to become an electrical engineer or understand how every transistor inside a processor works. You do need to understand what the major components do, how the operating system interacts with them, and how to diagnose problems when something goes wrong.

Learning Objectives

By the end of this module, you should be able to:

• Identify the major components inside a computer.
• Explain what a CPU does, and how RAM is used by an operating system.
• Explain the difference between memory and storage, and compare HDDs, SATA SSDs, and NVMe SSDs.
• Understand the purpose of a motherboard, and the difference between BIOS and UEFI.
• Understand the basic computer boot process.
• Explain what virtualisation is, and create and configure a virtual machine.
• Understand basic Windows architecture and navigate a Linux system using the command line.
• Understand common file systems.
• Install Windows and Linux inside virtual machines.
• Perform basic operating system troubleshooting.

1🧠 CPUs

What is a CPU?

The Central Processing Unit, or CPU, is the main processor inside a computer. It executes instructions provided by the operating system and applications. Almost everything a computer does eventually requires instructions to be processed by the CPU.

For example, when you open a web browser, extract a ZIP file, encrypt a file, run PowerShell, start Microsoft Word, query a database, scan a computer for malware, or run a virtual machine — the CPU is performing calculations and executing instructions.

A CPU can be thought of as the general-purpose "brain" of the computer.

CPU Cores

Modern CPUs normally contain multiple cores — effectively individual processing units inside the processor. A CPU may contain 2, 4, 8, 16, 32, or 64+ cores. Having more cores allows the computer to perform more work simultaneously. A workstation might have an 8-core CPU while a large enterprise virtualisation server could contain dozens of physical CPU cores.

Threads

Many processors also support multiple threads per core. For example: 8 physical cores × 2 threads per core = 16 logical processors. In Windows Task Manager, these may appear as Logical Processors.

Threads allow the CPU to use available resources more efficiently. They are not identical to having twice as many physical CPU cores, but they can increase overall performance.

Clock Speed

CPU speed is often measured in GHz — Gigahertz, for example 3.5 GHz. A simplified interpretation is that the CPU is capable of billions of clock cycles per second.

However, clock speed alone does not determine CPU performance. Architecture, cache size, number of cores, power limits, and workload all matter. A newer 3 GHz processor may significantly outperform an older 4 GHz processor.

CPU Cache

Processors contain extremely fast memory called cache — you may see L1, L2, and L3 cache. The CPU uses cache to store frequently accessed information close to the processor. Accessing CPU cache is much faster than retrieving the same information from RAM.

CPU Usage

On a Windows computer you can view CPU usage using Task Manager → Performance → CPU. You might see CPU: 7% or CPU: 100%.

High CPU utilisation is not automatically a problem — video encoding, for example, may legitimately use 100% of the processor. However, if a user's computer constantly operates at 100% CPU while doing normal office work, you should investigate. Common causes include:

• Malware
• Antivirus scans
• Windows Updates
• Faulty software
• Runaway processes
• Too many applications
• Software bugs
• Insufficient hardware resources

Practical Example

Imagine a user reports:

"My computer is extremely slow."

Instead of immediately reinstalling Windows, an IT engineer should investigate. Open Task Manager. Suppose you see CPU: 98%. You then sort processes by CPU usage and discover someapplication.exe — 85% CPU. You now have something specific to investigate. This is the beginning of structured troubleshooting.

Useful Windows Commands

Get-Process

To sort processes by CPU usage:

Get-Process | Sort-Object CPU -Descending

To display processor information:

Get-CimInstance Win32_Processor

Cybersecurity Relevance

Security analysts regularly investigate processes consuming CPU. Examples include cryptojacking malware, cryptocurrency miners, malicious PowerShell, ransomware encrypting files, and malware scanning large numbers of files. Unusual CPU activity can therefore sometimes be an indicator of compromise.

2💾 RAM

What is RAM?

RAM stands for Random Access Memory — temporary high-speed storage used by applications and the operating system while the computer is running.

When you open an application, parts of that application are loaded from storage into RAM. For example: you start Google Chrome. Chrome is stored on your SSD. When Chrome starts, the operating system loads the required code and data into RAM so that the CPU can access it quickly.

RAM vs Storage

This distinction is extremely important.

RAM is temporary, very fast, used while applications are running, and its contents normally disappear when power is removed.

Storage is long-term, slower than RAM, stores files and applications, and data remains after shutdown.

For example, your laptop might have 16 GB RAM and 512 GB SSD storage — these are completely different resources.

What Happens When RAM Runs Out?

Imagine a computer has 8 GB RAM. The user opens Microsoft Teams, Chrome with 30 tabs, Outlook, Excel, and Photoshop. The computer may run out of available physical memory.

The operating system can then move some information from RAM onto the storage device. On Windows this involves the page file. Because SSD storage is significantly slower than RAM, excessive paging can make the computer feel very slow.

Windows Memory Usage

Open Task Manager → Performance → Memory. You can see total RAM, memory currently in use, available memory, memory speed, and number of memory slots.

Practical Example

A user reports:

"My laptop becomes very slow when I join Teams meetings."

You investigate Task Manager and discover RAM: 7.8 GB / 8 GB. The machine is effectively out of available physical memory. The issue may not be the network, Teams, or Windows — the machine may simply need more memory or fewer applications running.

Linux Memory

On Linux you can check memory using:

free -h

You might see:

              total        used        free
Mem:           15Gi        6Gi         4Gi
Swap:           2Gi        0Gi         2Gi

Another useful command is top, or htop if installed.

Cybersecurity Relevance

Memory becomes very important in cybersecurity. Passwords, encryption keys, malware code, authentication tokens, and running processes may temporarily exist in RAM. Advanced incident response teams sometimes capture a complete copy of computer memory called a memory dump, which memory forensic tools can then analyse.

3🗃️ Storage

Storage is where computers permanently store information — Windows, Linux, applications, documents, databases, photos, logs, virtual machines, and configuration files. Unlike RAM, storage retains information when the computer is powered off.

Storage Capacity

Storage is normally measured using KB (Kilobyte), MB (Megabyte), GB (Gigabyte), TB (Terabyte), and PB (Petabyte). Typical laptops may contain 512 GB or 1 TB SSDs. Enterprise storage systems can contain hundreds of terabytes or even petabytes of storage.

Partitions

A physical disk can be divided into logical sections called partitions. For example, one 1 TB disk could contain:

EFI Partition
Windows Recovery Partition
C: Drive
Data Partition

Linux systems commonly have partitions such as:

/
/boot
/home
swap

Disk Space Problems

One of the most common IT problems is a full disk, for example C:\ = 99% full. When this happens, applications may crash, logs may stop writing, Windows Updates may fail, databases may fail, temporary files cannot be created, and services may stop working. On servers, running out of disk space can cause serious outages.

Windows Storage Commands

Check disk information:

Get-Disk

Check volumes:

Get-Volume

Check free space:

Get-PSDrive -PSProvider FileSystem

Linux Storage Commands

Check disks:

lsblk

Check available disk space:

df -h

Check directory size:

du -sh /var/log

These commands are extremely useful when troubleshooting Linux servers.

Putting it together: the speed vs capacity trade-off

CPU cache, RAM, and storage are really one continuum. As data moves further from the CPU, you gain capacity but lose speed:

4💽 SSD vs HDD

Two common types of computer storage are HDD — Hard Disk Drive and SSD — Solid State Drive.

Hard Disk Drives

Traditional hard drives contain physical spinning disks. A mechanical arm moves across the disk to read and write data. Because physical movement is involved, HDDs are relatively slow.

Advantages: cheap per terabyte, large capacity, useful for backups and archive storage.

Disadvantages: slower, mechanical components, more vulnerable to physical shock, higher latency, often noisier.

Solid State Drives

SSDs use flash memory rather than spinning disks. There are no moving mechanical parts.

Advantages: significantly faster, lower latency, quiet operation, lower power consumption, more resistant to physical shock. Most modern laptops and workstations use SSDs.

SATA SSD vs NVMe SSD

Not all SSDs offer the same performance. A common SATA SSD might achieve approximately 500 MB/s sequential transfer speeds. NVMe SSDs communicate over PCI Express and can achieve several gigabytes per second depending on the drive and platform.

HDD        → ~100–200 MB/s
SATA SSD   → ~500 MB/s
NVMe SSD   → several thousand MB/s

These figures vary considerably between devices.

Why IT Engineers Care

Storage performance affects operating system startup, application launch times, database performance, virtual machines, file servers, log processing, and security analytics. Running multiple virtual machines from an old HDD, for example, can feel dramatically slower than running them from an NVMe SSD.

5🔧 BIOS

BIOS stands for Basic Input/Output System. The BIOS is firmware stored on the computer's motherboard — firmware is software stored directly on hardware. The BIOS runs before Windows or Linux starts.

Its job includes initialising hardware, checking system components, finding a bootable device, and starting the operating system boot process.

What Happens When You Turn on a Computer?

POST means Power-On Self-Test — the computer checks whether essential hardware is available, as part of this simplified boot sequence:

Accessing BIOS

Manufacturers use different keys, commonly F2, F10, F12, Delete, or Esc. The key normally needs to be pressed shortly after powering on the computer.

Settings You Might Find

BIOS settings can include boot order, CPU configuration, memory information, SATA configuration, virtualisation support, Secure Boot settings, TPM configuration, and system date and time.

IT Support Example

Suppose you want to run virtual machines but your hypervisor reports:

Hardware virtualisation is unavailable.

The CPU may support virtualisation, but it could be disabled in firmware. You may need to enable something such as Intel VT-x or AMD-V in the BIOS or UEFI configuration.

6🛡️ UEFI

UEFI stands for Unified Extensible Firmware Interface — the modern replacement for traditional BIOS firmware. People still commonly say "go into the BIOS" even when the computer actually uses UEFI.

Why UEFI Exists

Traditional BIOS technology had several limitations. UEFI introduced capabilities such as support for modern large disks, faster boot processes, better firmware interfaces, GPT partition support, and Secure Boot.

Secure Boot

Secure Boot is an important security feature available with UEFI. Its purpose is to help prevent unauthorised boot software from running before the operating system starts.

Without protections at this stage, malware could theoretically compromise the computer before Windows security controls are fully loaded — this type of malware is sometimes associated with bootkits and rootkits. Secure Boot helps verify that trusted boot components are being used.

TPM

Modern computers commonly contain a Trusted Platform Module, or TPM. A TPM can securely store cryptographic material and help protect operations involving encryption and system integrity.

Windows features such as BitLocker can use the TPM. For example, BitLocker can protect a laptop's disk so that someone cannot simply remove the disk and read the files from another computer.

BIOS vs UEFI

7🔌 Motherboards

The motherboard is the main circuit board inside a computer. Most major computer components connect to it, including the CPU, RAM, storage, network interfaces, GPU, USB devices, and expansion cards. The motherboard allows these components to communicate.

CPU Socket

The processor is installed into the CPU socket. Different processor families use different sockets — you cannot simply install any CPU into any motherboard.

RAM Slots

Desktop motherboards normally contain multiple RAM slots, for example:

DIMM A1
DIMM A2
DIMM B1
DIMM B2

Correct slot configuration can be important for memory performance.

PCI Express

PCI Express, commonly written as PCIe, allows expansion devices to connect to the computer — graphics cards, network cards, storage controllers, NVMe devices, and Fibre Channel cards.

Storage Connections

Motherboards may provide SATA connectors, M.2 slots, and PCIe storage.

Network Interface

Many motherboards contain integrated Ethernet or Wi-Fi hardware. The Ethernet interface is commonly referred to as a NIC — Network Interface Card.

8🖥️ Virtualisation

Virtualisation is one of the most important technologies in modern IT. It allows multiple virtual computers — virtual machines, or VMs — to run on one physical computer.

Physical Computer

Imagine you have a powerful server containing 32 CPU cores, 128 GB RAM, and 4 TB storage. Instead of installing one operating system directly on the server, you could create multiple virtual servers — for example a Domain Controller (4 CPU / 8 GB RAM), a Web Server (4 CPU / 16 GB RAM), a Database Server (8 CPU / 32 GB RAM), and a Linux Server (2 CPU / 4 GB RAM) — all running on the same physical hardware.

Hypervisors

Software used to run virtual machines is called a hypervisor. Examples include Microsoft Hyper-V, VMware ESXi, VMware Workstation, Oracle VirtualBox, KVM, and Proxmox VE.

Type 1 Hypervisors

A Type 1 hypervisor runs directly on physical hardware:

Examples include VMware ESXi, Microsoft Hyper-V Server environments, KVM-based platforms, and Proxmox VE. These are common in enterprise environments.

Type 2 Hypervisors

A Type 2 hypervisor runs on top of an existing operating system:

This type is useful for learning.

Why Virtualisation Matters

Virtualisation is used everywhere — enterprise datacentres, cybersecurity laboratories, cloud platforms, software testing, malware analysis, server environments, and development environments. Cloud services are heavily built around virtualisation and containerisation technologies.

Snapshots

A useful virtualisation feature is the snapshot — it records the state of a virtual machine at a particular point:

This makes virtual machines excellent for laboratories.

Cybersecurity Example

Later in this course you might create a lab containing a Windows Server, a Windows Client, a Linux Server, and Kali Linux. You can then safely practise Active Directory, networking, authentication, logging, security monitoring, PowerShell, and incident investigation — without requiring four physical computers.

9🫚 Windows Architecture

Understanding Windows architecture helps you understand what you are actually troubleshooting. A Windows system is much more than the desktop interface. Behind the graphical interface are processes, services, drivers, the registry, file systems, security components, user accounts, memory management, networking, and the Windows kernel.

Kernel Mode and User Mode

Windows separates software into different levels of privilege: user mode and kernel mode.

User Mode

Normal applications generally operate in user mode — for example Chrome, Microsoft Word, Teams, Notepad, and PowerShell. User-mode applications have restricted access to hardware and system memory. This isolation improves stability and security.

Kernel Mode

The Windows kernel and many device drivers operate in kernel mode, which has much greater access to the computer. A failure in a normal application may simply crash that application; a serious failure in kernel-level software can crash the entire operating system. This is one reason faulty drivers can sometimes cause Windows blue-screen errors.

Processes

A process is a running instance of a program — for example notepad.exe, chrome.exe, powershell.exe, explorer.exe. You can view processes using Task Manager, or PowerShell:

Get-Process

Process IDs

Every running process receives a PID — Process Identifier, for example chrome.exe / PID: 6248. PIDs are extremely useful when analysing logs or troubleshooting applications.

Services

Windows services are programs designed to run in the background — responsible for things like Windows Update, DNS, printing, authentication, antivirus, and networking. Open the Windows Services console with services.msc, or use PowerShell:

Get-Service

Practical Support Example

A user reports:

"The application cannot connect."

You discover that the application's background Windows service has stopped. Instead of reinstalling the entire application, you restart the service. This is why understanding operating system architecture saves enormous amounts of troubleshooting time.

Windows Registry

The Windows Registry is a hierarchical database used to store configuration information. Major sections include:

HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
HKEY_USERS

You can view it using regedit. Be careful when modifying the registry — incorrect modifications can break applications or Windows itself.

Environment Variables

Operating systems use environment variables to store values used by applications — for example PATH, TEMP, USERNAME, USERPROFILE. In PowerShell:

$env:PATH

The PATH variable is particularly important because it tells Windows where to search for executable programs.

Windows File Locations

Students should become familiar with these locations, which appear constantly in IT troubleshooting:

C:\Windows
C:\Windows\System32
C:\Program Files
C:\Program Files (x86)
C:\Users
C:\Users\<username>\AppData
C:\ProgramData

Event Viewer

Windows records enormous amounts of diagnostic information in Event Viewer. Open it using eventvwr.msc. Important log categories include Application, Security, and System. Later in the course, logs will become extremely important for cybersecurity investigations.

10🐧 Linux Basics

Linux is one of the most important operating systems in IT. A huge percentage of web servers, cloud infrastructure, containers, security appliances, network appliances, and development platforms run Linux. Many cybersecurity tools also run primarily on Linux.

Linux Distributions

Linux comes in many different distributions — common examples include Ubuntu, Debian, Red Hat Enterprise Linux, Rocky Linux, AlmaLinux, Fedora, and Kali Linux. The Linux kernel is the core operating system, while distributions package it together with applications and management tools.

Linux Terminal

While Linux can have graphical interfaces, system administrators frequently work through the command line. For example, to show your current location:

pwd

Navigating Directories

pwd                 # show current directory
ls                   # list files
ls -la               # detailed list
cd /var/log          # change directory
cd ~                 # go to your home directory
cd ..                # move one directory upward

Creating Files and Directories

mkdir training                     # create a directory
touch notes.txt                    # create an empty file
cp notes.txt notes-backup.txt      # copy a file
mv notes.txt notes-old.txt         # move or rename a file
rm notes-old.txt                   # delete a file
rm -r training                     # delete a directory

Be extremely careful with recursive delete commands.

Reading Files

cat file.txt              # display a file
less file.txt             # read a file page by page
tail file.txt             # view the last lines
tail -f application.log   # monitor a log file live

The tail -f command is extremely useful for troubleshooting.

Searching Files

grep "error" application.log
grep -i "error" application.log
grep -R "authentication failed" /var/log/

This type of command is regularly used by support engineers and SOC analysts.

Linux Processes

ps                     # view processes
ps aux                 # more detailed
top                    # real-time view
ps aux | grep nginx    # find a specific process

Linux Services

Many modern Linux systems use systemd.

systemctl status ssh
sudo systemctl start ssh
sudo systemctl restart ssh
sudo systemctl enable ssh

Linux Logs

Logs are often stored under /var/log, for example:

/var/log/syslog
/var/log/auth.log
/var/log/messages

The exact files depend on the Linux distribution. Modern systems may also use the systemd journal:

journalctl
journalctl -u ssh

Linux Permissions

ls -l

You may see:

-rwxr-xr-- 1 user staff script.sh

Linux permissions are based around Read, Write, and Execute, and commonly apply to Owner, Group, and Others. This becomes extremely important when troubleshooting applications and securing servers.

sudo

Linux administrators often use sudo to execute commands with elevated privileges, for example:

sudo systemctl restart nginx

You should not automatically run everything as root. The principle of using only the permissions required for a task is fundamental to cybersecurity.

11📁 File Systems

A file system defines how information is organised and stored on a disk. Without a file system, the operating system would have no practical structure for organising files and directories.

NTFS

NTFS is commonly used by Windows. It supports file permissions, large files, encryption capabilities, journaling, compression, and Access Control Lists. NTFS permissions are extremely important in Windows environments.

FAT32

FAT32 is an older file system. Advantages include excellent compatibility. However, it has important limitations, including a maximum individual file size of approximately 4 GB. It is commonly encountered on USB drives, memory cards, and firmware-related storage.

exFAT

exFAT was designed for flash storage and removable media. It supports files larger than the FAT32 4 GB limit and is widely compatible across operating systems.

Linux File Systems

Common Linux file systems include ext4, XFS, and Btrfs. For an entry-level course, understand that different operating systems may use different file systems and that file system selection affects capabilities such as permissions, reliability, maximum file sizes, snapshots, journaling, and performance.

Windows Drive Letters

Windows commonly identifies volumes using letters (C:, D:, E:). The operating system is normally installed on C:, although this is not technically mandatory.

Linux Mount Points

Linux approaches storage differently. Instead of relying on drive letters, file systems are mounted into a single directory hierarchy, rooted at /.

Permissions and Security

File systems are directly connected to cybersecurity. Incorrect permissions can expose sensitive information — payroll spreadsheets, password files, database backups, private SSH keys, configuration files, API credentials. If everyone has access to these files, that is a security problem.

One of the fundamental concepts you will repeatedly see throughout cybersecurity is least privilege: users and applications should only receive the access they actually require.

Lab🦡 Hands-On Lab 1 — Build a Virtual Machine

CPU:
Physical cores:
Logical processors:
RAM:
Disk capacity:
Disk type:

CPU: Intel Core i7
Cores: 8
Logical processors: 16
RAM: 16 GB
Storage: 1 TB NVMe SSD

Name: Windows-Lab-01
CPU: 2 virtual CPUs
RAM: 4 GB
Disk: 60 GB
Network: NAT

No bootable device found

Lab🫚 Hands-On Lab 2 — Install Windows

hostname
whoami
ipconfig
Get-Process
Get-Service
Get-Disk
Get-Volume

C:\Windows
C:\Windows\System32
C:\Program Files
C:\Users
C:\Users\<username>\AppData

eventvwr.msc

Lab🐧 Hands-On Lab 3 — Install Linux

Name: Linux-Lab-01
Operating System: Ubuntu Linux
CPU: 2 virtual CPUs
RAM: 2–4 GB
Disk: 30 GB
Network: NAT

whoami

pwd

ls
ls -la

mkdir cybersecurity-course
cd cybersecurity-course

touch notes.txt
ls -l

echo "Cyber Security Cafe Linux Lab" > notes.txt
cat notes.txt

lscpu       # CPU information
free -h     # memory
lsblk       # storage
df -h       # disk usage

ip addr
ip route
ping 8.8.8.8
ping google.com

ps aux
top
ps aux | grep ssh

systemctl
systemctl status ssh

cd /var/log
ls -la
journalctl
journalctl -n 20

Lab🧩 Lab Challenge — Troubleshoot the Computer

You should now be able to answer the following questions without being told exactly where to look.

🧞 Troubleshooting Scenario

A user reports:

"The server is incredibly slow."

Do not immediately restart it. Start investigating. Check CPU, RAM, disk utilisation, available disk space, running processes, services, logs, and network connectivity.

On Linux you might start with:

top
free -h
df -h
ps aux
journalctl

On Windows:

Get-Process
Get-Service
Get-Volume

and then inspect Task Manager and Event Viewer.

This simple process represents something important. You are no longer randomly guessing — you are collecting evidence. That mindset is one of the biggest differences between someone who merely uses computers and someone who professionally supports them.

🛡️ How This Connects to Cybersecurity

Computer fundamentals may initially seem less exciting than penetration testing, malware analysis, or incident response. In reality, cybersecurity depends heavily on these fundamentals.

Consider an alert showing:

powershell.exe
PID 8432
CPU 87%
User: jsmith
Parent Process: winword.exe

Without understanding processes, CPU, Windows, users, and PowerShell, the alert means very little.

Or imagine a Linux server contains /var/log/auth.log showing thousands of failed SSH authentication attempts. Without understanding Linux, logs, file systems, services, networking, and authentication, you will struggle to investigate it.

Cybersecurity is built on IT fundamentals.

🧠 Real-World IT Support Mindset

When someone reports:

"The server isn't working."

Do not start clicking random buttons. Ask: what specifically isn't working? Then investigate the relevant layer.

For example: if the computer does not power on, investigating Chrome is pointless. If Windows cannot boot, investigating Microsoft Teams is pointless. If the application service has stopped, changing DNS may be pointless. Understanding the different layers allows you to troubleshoot logically.

🏗️ Module 2 Practical Project

At the end of this module, every student should have their own miniature IT laboratory:

Students should understand what resources belong to the physical host, what resources have been allocated to each VM, how the virtual network works, where VM disks are stored, how to start and stop VMs, how to take snapshots, how to restore snapshots, and how to install an operating system.

Do not delete these virtual machines. We will build on them throughout the rest of the course. Later they can become part of a larger laboratory containing a Windows Client, Windows Server, Active Directory, a Linux Server, a Security Workstation, a firewall, and monitoring tools.

By the end of the course, what started as two simple virtual machines can become a miniature enterprise environment.

Module 2 Knowledge Check

Click a question once you're confident you can answer it from memory.

1. 1What does a CPU do?
2. 2What is the difference between a CPU core and a CPU thread?
3. 3What is RAM used for?
4. 4What happens when a computer does not have enough RAM?
5. 5What is the difference between RAM and SSD storage?
6. 6What is the difference between an HDD and SSD?
7. 7Why is an NVMe SSD usually faster than a SATA SSD?
8. 8What happens when a server runs out of disk space?
9. 9What is the purpose of BIOS or UEFI?
10. 10What is Secure Boot?
11. 11What is a TPM?
12. 12What does a motherboard do?
13. 13What is a hypervisor?
14. 14What is a virtual machine?
15. 15What is the difference between a physical CPU and a virtual CPU?
16. 16What is a VM snapshot?
17. 17What is a Windows process?
18. 18What is a Windows service?
19. 19What is the Windows Registry?
20. 20What does a PID identify?
21. 21Where can Windows system logs be viewed?
22. 22What command shows your current Linux directory?
23. 23What Linux command shows disk utilisation?
24. 24What Linux command shows memory utilisation?
25. 25What does systemctl manage?
26. 26What is the purpose of /var/log?
27. 27What is a file system?
28. 28What is NTFS?
29. 29What is the difference between Windows drive letters and Linux mount points?
30. 30Why are file permissions important for cybersecurity?

Module 2 Final Takeaway

You do not need to memorise every CPU architecture, motherboard chipset, Windows component, or Linux command. The important thing is understanding how the pieces fit together.

Once you understand these layers, technologies covered later in the course become much easier to understand. Networking runs on computers. Active Directory runs on computers. Cloud servers are computers. Security monitoring watches computers. Malware attacks computers. Authentication happens between computers. Logs are generated by computers.

Before becoming good at cybersecurity, become comfortable understanding the systems you are trying to secure.