Applied Information Technology Engineer Examination — knowledge map
The 152 core concepts of Applied Information Technology Engineer Examination and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.
Concepts (152)
Sprint
A fixed-length timebox in Scrum (typically one to four weeks) during which planning, implementation, review, and retrospective all occur, producing a potentially releasable increment. The length is not extended mid-sprint; unfinished items roll over to the next sprint.
Time complexity and Big-O notation
An indicator of how an algorithm's running time or memory usage grows as a function of input size n. Expressed as O(1), O(log n), O(n), O(n log n), O(n^2), and so on, it is used to compare the efficiency of algorithms.
Development Team (Scrum)
The people who build the increment in Scrum, self-organizing to do the work needed for the sprint goal. The 2020 Scrum Guide removed the separate "Development Team" sub-team and redefined them as the "Developers" who, together with the Product Owner and Scrum Master, form the single Scrum Team. They are not assigned work from outside; the Developers themselves plan and divide how to realize the sprint backlog. They are cross-functional, spanning design, implementation, and testing.
Prerequisites: Product Owner and Scrum Master、Sprint
Related: Product backlog and sprint backlog
Balanced Tree and Heap
A balanced tree keeps the height difference between left and right subtrees bounded, guaranteeing O(log n) search, insertion, and deletion (e.g., AVL tree, red-black tree). A heap is a complete binary tree satisfying a parent-child ordering property, used to implement priority queues and quickly retrieve the max or min element. Both exploit tree balance to bound worst-case complexity, but a balanced tree targets ordered search while a heap targets extremum extraction.
Prerequisites: Time complexity and Big-O notation、Tree structures and binary search trees、Binary search
Data Modeling
A design technique that abstracts the structure of business information as entities and relationships, organized through conceptual, logical, and physical stages. It uses E-R diagrams to clarify cardinality and attributes between entities, forming the basis for subsequent database design.
Prerequisites: Entity-relationship diagram
Product backlog and sprint backlog
The product backlog is a prioritized, continuously refined list of everything needed for the product, owned by the Product Owner. The sprint backlog is the subset selected for the current sprint plus the Development Team's plan for delivering it. They differ in scope (whole product vs. one sprint) and in who owns them.
Prerequisites: Sprint
Related: Development Team (Scrum)、Product Owner and Scrum Master
Binary search
A search method for a sorted list of data that compares the target value with the value at the midpoint of the search range and repeatedly narrows the range by half. It requires the data to already be sorted, and it finds the target faster than a linear search.
Related: Linear search
Heapsort and Heap Property
The heap property states that in a complete binary tree, each parent node's value is always greater than or equal to (max-heap) or less than or equal to (min-heap) its children's values. Heapsort exploits this property by building an array into a heap and repeatedly extracting the root (the maximum or minimum), producing a sorted array; it guarantees O(n log n) worst-case complexity and needs almost no extra memory, unlike quicksort.
Prerequisites: Balanced Tree and Heap、Time complexity and Big-O notation、Sorting algorithms (bubble, quick, merge sort)
Huffman coding
A variable-length coding scheme that minimizes the average code length of a data set by assigning shorter codewords to frequently occurring symbols and longer codewords to rare ones. Because no codeword is a prefix of another (a prefix code), boundaries between codewords can be uniquely determined during decoding. It is a representative entropy coding method used for lossless compression.
Prerequisites: Information content (entropy)、Sampling and encoding、Lossless and lossy compression
Product Owner and Scrum Master
Two of the three accountabilities that make up a Scrum Team. The Product Owner is accountable for managing the product backlog and maximizing value — deciding "what" to build. The Scrum Master is a facilitator who establishes Scrum and removes impediments. The remaining accountability, the Developers, decides "how" to build (the implementation). The exam point is that no single manager issues top-down orders.
Prerequisites: Accountability
Related: Product backlog and sprint backlog
Skewed Tree
A binary tree in which every node has only one child (either left or right), effectively degenerating into a linear list. This commonly arises when already-sorted data is inserted sequentially into a plain binary search tree, degrading search, insertion, and deletion complexity from the intended O(log n) to O(n). Self-balancing structures such as AVL trees or red-black trees exist specifically to prevent this degeneration.
Prerequisites: Time complexity and Big-O notation、Tree structures and binary search trees、Binary search
Sprint review and sprint retrospective
Both occur at sprint end but serve different purposes. The sprint review shows the completed increment to stakeholders to gather feedback and adjust the product backlog. The sprint retrospective is an internal team session where the team examines its own process, tools, and collaboration to identify improvements for the next sprint. The key distinction is external feedback on the product versus internal process improvement.
Prerequisites: Development Team (Scrum)、Product backlog and sprint backlog、Sprint
Tree structures and binary search trees
A hierarchical data structure made up of nodes and edges. A binary search tree is organized so that a node's left subtree holds smaller values and its right subtree holds larger values, enabling search, insertion, and deletion in average O(log n) time.
Prerequisites: Binary search
Sorting algorithms (bubble, quick, merge sort)
A family of algorithms for rearranging data into a defined order. Bubble sort repeatedly swaps adjacent elements — simple but O(n^2); quick sort partitions around a pivot for an average O(n log n); merge sort uses divide-and-conquer to reliably guarantee O(n log n) while remaining stable.
Related: Recursion and Divide-and-Conquer
Copyright
A right that arises automatically the moment a work such as a novel, music, or a program is created; unlike a patent right, no registration procedure is required. Copyright in a program generally belongs to the person who created it, except in the case of a work made for hire.
Malware
A collective term for malicious software created to harm users, including viruses, worms, trojan horses, and ransomware. Infection routes are varied, including email attachments, visiting malicious sites, and USB drives.
Related: Ransomware
Act on the Protection of Personal Information
A law that requires businesses handling information that can identify a specific individual, such as name and date of birth, to specify the purpose of use, acquire data appropriately, implement safety-management measures, and restrict third-party disclosure without the individual's consent.
Queue (FIFO)
A data structure in which the first item stored is the first one retrieved (FIFO: First In First Out). Items enter at one end (the rear) and leave from the other end (the front). It is often likened to a line of people waiting at a counter.
Prerequisites: Queueing theory (M/M/1)
Requirements definition
An upstream software development process step that clarifies the functions and performance the users or client require and fixes the scope of what will be built. Misunderstandings here directly translate into costly rework in later stages.
Risk assessment
The process of identifying, analyzing, and evaluating risk by surveying the threats and vulnerabilities affecting information assets. It quantifies risk magnitude (likelihood times impact) as the basis for subsequent risk treatment decisions, forming the core of the Plan phase in the ISMS PDCA cycle.
Prerequisites: PDCA cycle
Related: Risk treatment (reduction, avoidance, transfer, acceptance)、Information asset
ACID Properties
The collective term for the four properties a transaction must satisfy: Atomicity, Consistency, Isolation, and Durability. These principles guarantee database integrity even under failures or concurrent execution, and are implemented by the DBMS's transaction management mechanism.
Break-even sales
The sales level at which profit is exactly zero. It is computed as break-even sales = fixed cost ÷ (1 − variable cost ratio), where variable cost ratio = variable cost ÷ sales. Actual sales above this level yield a profit and below it a loss; the gap is also used as a measure of a business's margin of safety.
Prerequisites: Fixed cost and variable cost、Break-even point
Business Modeling
An analysis process that visualizes and organizes the flow and structure of the business operations targeted for systemization. Alongside structured techniques such as DFDs (data flow diagrams), flowcharts, and business-flow diagrams, it uses E-R diagrams for data structure and, in object-oriented approaches, UML activity and use-case diagrams. It clarifies business requirements and feeds subsequent data modeling and system design.
Prerequisites: Data Modeling、Entity-relationship diagram
Daily Scrum
A 15-minute timeboxed meeting the Developers hold each day to inspect progress toward the sprint goal and adjust the day's plan; it is not status reporting to a manager but a way for the Developers to self-organize. The 2020 Scrum Guide changed the responsible party from the 'Development Team' to the 'Developers' and makes the same-time/same-place practice recommended rather than mandatory. Colloquially called a daily standup.
Prerequisites: Development Team (Scrum)、Sprint
Dynamic programming
An algorithm design technique that divides a problem into subproblems and stores (memoizes) each subproblem's result for reuse, avoiding redundant recomputation of the same subproblem and reducing overall computational cost. It is especially effective for problems with heavy subproblem overlap, such as computing Fibonacci numbers, shortest-path problems, and the knapsack problem.
Prerequisites: Shortest Path Problem、Time complexity and Big-O notation
Entity
In data modeling, an abstracted unit representing an object to be managed in business (such as a person, item, or event). Represented as a rectangle in E-R diagrams, an entity is identified by a primary key among a set of attributes, and corresponds to a table in a relational database.
Prerequisites: Data Modeling、Entity-relationship diagram
Information content (entropy)
A measure that quantifies how unlikely an event is. The information content of an event with probability p is -log2 p bits, so rarer (lower-probability) events carry more information. Average information content (entropy) is the expected value of information content weighted by each event's probability, indicating the overall uncertainty of an information source.
Prerequisites: Expected value
Entity-relationship diagram
A conceptual modeling technique used in database design to diagram entities and the relationships between them. It explicitly shows the cardinality between entities (one-to-one, one-to-many, many-to-many) and is used as a precursor to logical database design and normalization.
Expected value
The sum of each possible value of a random variable multiplied by its probability of occurrence: E(X) = Σ(x_i × p_i). It represents the average outcome expected over many repeated trials, and is used widely — from comparing expected payoffs in decision-making to quality control and insurance premium calculation.
Fixed cost and variable cost
Two categories obtained by breaking down total cost by its relationship to sales (or production volume). A fixed cost, such as rent or fixed salaries, is incurred at a constant amount regardless of sales, while a variable cost, such as raw material cost or piece-rate wages, rises and falls in proportion to sales. This split underlies break-even and CVP analysis.
Related: Break-even point
Graph and Graph Search
A graph is a data structure of vertices (nodes) and edges representing many-to-many relationships such as networks or dependencies. Graph search systematically visits vertices or paths: breadth-first search (BFS) uses a queue to explore layer by layer from the nearest vertices, while depth-first search (DFS) uses a stack or recursion to explore paths deeply before backtracking. BFS suits shortest-path problems with uniform edge weights, while DFS suits connectivity checks and cycle detection.
Prerequisites: Recursion
Related: Shortest Path Problem
Sensors and actuators
A sensor converts a physical quantity (temperature, light, acceleration, etc.) into an electrical signal as input. An actuator does the reverse: it receives a signal and drives a motor, valve, or similar to produce physical action as output. IoT systems pair the two—sensing state, deciding/controlling, then acting on the environment via actuators.
Isolation
One of the ACID properties, ensuring that concurrently executed transactions produce results as if each ran independently without interference from others. The isolation level setting controls how much anomalous behavior, such as dirty reads, is permitted.
Prerequisites: ACID Properties、Transaction isolation level
Recursion and Divide-and-Conquer
Recursion is a technique where a function calls itself, repeatedly reducing a problem to smaller instances of the same problem until a base case is reached. Divide-and-conquer is an algorithm design strategy that splits a problem into independent subproblems, solves each recursively, and then combines the results; it underlies quicksort, merge sort, and the fast Fourier transform. Recursion is the implementation mechanism, while divide-and-conquer is the higher-level algorithmic design strategy.
Prerequisites: Recursion
Relationship
In data modeling, a concept representing the association between entities, expressed through cardinality such as one-to-one, one-to-many, or many-to-many. Shown as diamonds or lines in E-R diagrams, many-to-many relationships are decomposed into associative entities (junction tables) during implementation.
Prerequisites: Data Modeling、Entity-relationship diagram
Risk analysis
A step within risk management that evaluates the likelihood and impact of identified risks to prioritize responses. It can be qualitative (ranking impact by severity level) or quantitative (expressing impact in monetary terms).
Related: Risk management
Sampling and encoding
Digitizing an analog signal (A/D conversion) has three stages: sampling → quantization → encoding. Sampling extracts values at fixed intervals (the sampling period); by the sampling theorem the sampling frequency must be at least twice the signal's highest frequency to avoid aliasing. Quantization rounds each sampled value to a discrete level. Encoding then maps each quantized value to a binary bit pattern.
Prerequisites: Binary number
Shortest Path Problem
The problem of finding, in a weighted graph, the path from a start vertex to a destination vertex that minimizes the total sum of edge weights. It is solved with algorithms such as Dijkstra's algorithm (non-negative weights) or the Bellman-Ford algorithm (allows negative weights), and is applied in route planning, navigation systems, and network routing. Unlike plain breadth-first search, which only finds shortest paths in unweighted graphs, these algorithms account for edge weights.
Related: Graph and Graph Search
Availability rate
The proportion of time a system operates correctly. Availability = MTBF ÷ (MTBF + MTTR); it rises as time-between-failures grows and repair time shrinks. A core availability metric, also used as an agreed SLA target (e.g., 99.9%).
Prerequisites: MTBF (mean time between failures)
CSIRT
An organizational team dedicated to responding to computer security incidents. It handles detection, analysis, response, and prevention of recurrence, and often coordinates with external CSIRTs and related agencies.
Linear search
A search method that examines elements one by one from the beginning of an array or list until the target value is found. It works on unsorted data, but has O(n) time complexity, making it slower than binary search.
Prerequisites: Time complexity and Big-O notation
Related: Binary search
Recursion
A technique in which a function calls itself, used to break a problem down into smaller instances of the same problem (e.g., factorial calculation, tree traversal). Without a terminating condition (base case), the calls continue indefinitely.
Industrial property rights
A collective term for four rights: patent, utility model, design, and trademark rights. Unlike copyright, obtaining these rights requires application to and registration with the patent office.
Prerequisites: Copyright
Intellectual property rights
A collective term for rights that protect creative outcomes such as inventions, works of authorship, designs, and trademarks. It is broadly divided into copyright and industrial property rights (patent, utility model, design, and trademark rights).
Prerequisites: Copyright、Industrial property rights
ISMS (Information Security Management System)
A systematic management framework an organization operates to appropriately protect its information assets, spanning policy formulation, risk assessment, implementing countermeasures, and review (PDCA). A certification scheme based on the international standard ISO/IEC 27001 exists.
Prerequisites: Information asset、Risk assessment
Lossless and lossy compression
Lossless compression can fully restore the original data. Lossy compression achieves a higher compression ratio by discarding information that is hard for humans to perceive, but the original data cannot be perfectly restored — image or audio quality degrades slightly.
Phishing
A fraud technique that lures victims to fake emails or websites impersonating real companies or financial institutions, in order to steal IDs, passwords, or credit card information. Carefully checking the URL and domain is a basic countermeasure.
Targeted attack
An attack that aims at a specific organization or individual, for example through a targeted attack email disguised as being related to the recipient's work, in order to steal confidential information or damage systems — unlike scattershot attacks aimed at an unspecified large number of targets.
Business email compromise (BEC)
A scam technique in which an attacker impersonates a business partner or executive by email to trick the target into wiring money to a fraudulent account or disclosing confidential information. Unlike malware-based attacks, it exploits gaps in business processes and manufactured urgency, similar to phishing but narrowly targeted. Requiring multi-person approval and phone verification when changing payment details is a common countermeasure.
Risk treatment (reduction, avoidance, transfer, acceptance)
Four response strategies chosen based on risk assessment results. Reduction lowers likelihood or impact through controls; avoidance stops the activity causing the risk; transfer shifts the risk to a third party via insurance or outsourcing; acceptance tolerates the risk without further action when it falls within an acceptable range. The choice balances cost against effect.
Related: Risk assessment
Accountability
An extended information-security element denoting the ability to trace and identify after the fact who performed which operation and when. It is achieved through logging and preserving audit trails, supporting root-cause investigation of unauthorized access or errors and enforcing responsibility.
Amdahl's law
Amdahl's law states that the maximum speedup from parallelizing a program is bounded by its non-parallelizable (sequential) fraction. With parallel fraction p, speedup asymptotically approaches 1/(1-p) as processor count grows, regardless of how many cores are added. A frequent basis for speedup-estimation calculation questions.
Audit plan
A plan prepared before conducting a system audit, defining the audit's objectives, scope, timing, procedures, and organization. To allocate audit resources effectively, it is often split into a medium/long-term basic plan that prioritizes higher-risk areas and a detailed individual audit plan for each specific audit.
Prerequisites: System audit
Auditor independence
The principle that a system auditor must remain free of interests in the audited department or the system under audit, in order to judge fairly and objectively. It requires both independence in appearance (a position free of any perceived bias to third parties) and independence in mind (a mindset that keeps one's professional judgment free from external influence).
Prerequisites: System audit
Authenticity
An extended element of information security ensuring that a user, piece of information, or process is genuinely what it claims to be, free of impersonation or forgery. Digital signatures and multi-factor authentication substantiate authenticity. It supplements the core CIA triad (confidentiality, integrity, availability) and appears in exam questions distinguishing the seven security elements.
Prerequisites: The CIA triad (confidentiality, integrity, availability)
Commissioning business and small/medium subcontracted business
The names for the parties to a transaction under the Act on Ensuring the Proper Handling of Subcontracting Transactions (formerly the Subcontract Act): the ordering party is the commissioning business, and the receiving small/medium enterprise is the small/medium subcontracted business — terms that replaced the former 'parent enterprise' and 'subcontracted enterprise' following the January 2026 revision. Commissioning businesses are obligated to avoid abusing their superior position, such as by delaying payment.
Related: Act on Proportionate Transactions for Small and Medium Sized Subcontractors
Consistency
One of the ACID properties, guaranteeing that a database always satisfies its defined constraints, such as uniqueness or referential integrity, both before and after a transaction. It prevents transitions to contradictory data states and maintains the correctness of business data.
Prerequisites: ACID Properties
Convolutional layer and pooling layer
Representative layers that make up a convolutional neural network (CNN). A convolutional layer slides a filter (kernel) over the image to detect local features (such as edges), producing a feature map. A pooling layer downsamples the feature map by aggregating each local region (e.g., max pooling takes the maximum value), reducing its size while adding robustness to positional shifts and cutting computational cost.
Prerequisites: Neural network、Time complexity and Big-O notation
Related: CNN (convolutional neural network)
Coupling and cohesion (module design metrics)
Two metrics for evaluating module decomposition quality. Coupling measures inter-module dependency strength (content coupling worst to data coupling best); cohesion measures how tightly elements within a module relate (coincidental cohesion worst to functional cohesion best). Low coupling with high cohesion yields the most maintainable design.
Prerequisites: Module decomposition techniques and information hiding
Decision tree (decision analysis)
A management science technique that represents multiple options and their outcomes as a tree diagram, computing the expected value of each branch from its probability and payoff to guide optimal decisions. Used to evaluate investment decisions and project choices under uncertainty by comparing the expected value (sum of probability times payoff) of each branch.
Prerequisites: Expected value
Devil's river, valley of death, and Darwinian sea
A metaphor in management of technology (MOT) for three barriers a basic research result must clear to succeed as a business. The 'devil's river' is the gate from basic research to product development; the 'valley of death' is the wall of funding and organization needed to commercialize the developed product; the 'Darwinian sea' is the stage where the launched product faces competitive and market selection.
Prerequisites: MOT (Management of Technology)
Digitization and digitalization
Terms describing stages on the path to DX. Digitization is the stage of converting existing operations and information into digital form as-is, such as scanning paper documents. Digitalization is the stage of using digital technology to transform the business processes or customer touchpoints themselves — going beyond mere digital conversion, unlike digitization.
Equivalence partitioning and boundary value analysis
Core black-box test-design techniques. Equivalence partitioning groups inputs into classes expected to behave alike and samples a representative value from each; boundary value analysis targets values at and adjacent to class boundaries, where defects concentrate. Combining both reduces test-case count while raising defect-detection rates.
Related: Black-box testing
Flynn's taxonomy
A framework classifying computer architectures by the number of instruction and data streams: SISD, SIMD, MISD, and MIMD. SIMD applies one instruction to multiple data items at once (vector processing, GPUs); MIMD has multiple processors independently executing different instructions on different data (multicore, distributed systems).
Prerequisites: Parallelization and multicore
Functional dependency
A relationship in which the value of attribute A uniquely determines the value of attribute B (A→B). It is the theoretical basis of normalization: eliminating partial functional dependency (dependency on only part of the primary key) yields second normal form, and eliminating transitive functional dependency (indirect dependency via a non-key attribute) yields third normal form.
Related: Normal forms (1NF to 3NF)
Hamming code
An error-correcting code that adds several check bits to data so a single-bit error can be automatically corrected. The combination of each check bit's parity result (match/mismatch) — the syndrome — locates and corrects the erroneous bit. Basic Hamming corrects one bit only; adding a single overall parity bit gives extended Hamming (SECDED), which corrects one bit and detects two, unlike plain parity checking (detection only).
Prerequisites: Parity bit
Kanban method
A development/production management method that visualizes work items as cards moving through columns such as 'to do,' 'in progress,' and 'done,' capping the number of items per column (WIP limits) to manage flow. Unlike Scrum, it does not require fixed timeboxes (sprints); instead, completed items are pulled to the next stage continuously.
Prerequisites: Sprint
Module decomposition techniques and information hiding
Design techniques for decomposing a program into independent modules (e.g., STS decomposition, common-function decomposition) combined with information hiding—concealing a module internal implementation and exposing only its public interface. Together they localize the impact of change and improve maintainability.
Parallelization and multicore
Parallelization splits work across multiple execution units to run concurrently for speedup. Multicore is the hardware implementation integrating multiple processing cores on one CPU chip, the main platform enabling parallelization. Achievable speedup is bounded by the sequential fraction (Amdahl's law) and inter-core communication overhead.
Prerequisites: Amdahl's law
Parity bit
A single check bit appended so the total count of 1-bits is even (even parity) or odd (odd parity). It can detect an odd number of bit errors but cannot locate or correct them, and it fails to detect an even number of simultaneous errors.
Pipeline hazards and forwarding
In pipelined execution, a hazard is a dependency between instructions that prevents correct execution; there are data, control, and structural hazards, resolved by inserting stalls when necessary. Forwarding (data bypassing) routes a computed result directly to a dependent instruction before write-back to cut data-hazard stalls, but a load-use hazard (using the result of an immediately preceding load) still needs a one-cycle stall even with forwarding.
Prerequisites: Pipeline processing
Queueing theory (M/M/1)
A theory that models arrivals and service events as random processes to analyze waiting time and queue length probabilistically. In the M/M/1 model, the utilization ρ=λ/μ is derived from the arrival rate λ and service rate μ; as ρ approaches 1, the average wait time and queue length increase sharply. Used to design counter counts and service capacity.
Risk management
The overall management process by which an organization identifies, analyzes, and evaluates the risks it faces, selects and implements responses, and continuously reviews them. Risk analysis is the step within this process that assesses the likelihood and impact of each risk, making it a subset of risk management.
Related: Risk analysis
Schedule performance index (SPI)
An earned value management (EVM) metric that evaluates schedule performance. SPI = EV (earned value) ÷ PV (planned value); 1.0 means on schedule, below 1 indicates a schedule delay, and above 1 indicates ahead of schedule.
Prerequisites: EVM (earned value management)
Spiral model
A development process model that repeats cycles of requirements, design, implementation, and evaluation—interleaved with risk analysis—to incrementally raise product maturity. It blends waterfall rigor with iterative flexibility: each loop produces a prototype and reduces risk before proceeding to the next cycle.
Prerequisites: Risk analysis
System planning
In the Common Frame (SLCP), the planning process consists of drafting the systemization concept and drafting the systemization plan; this term refers to the latter. Taking business strategy and operational issues as input, it concretizes the scope, objectives, cost-effectiveness, project organization, and schedule, feeding the subsequent requirements-definition process — the most upstream phase of development.
Prerequisites: Requirements definition
Coverage criteria and multiple condition coverage
Criteria for how thoroughly white-box tests exercise the control structure. Statement coverage (execute every statement at least once) ⊂ branch/decision coverage (exercise each branch true and false) grows stricter, but condition coverage (each condition true and false) does not necessarily subsume branch coverage. Multiple-condition coverage, the strictest, exercises every combination of the truth values of all conditions in a decision and subsumes both branch and condition coverage. It quantifies test adequacy.
Related: White-box testing
CI/CD
CI (continuous integration) automatically builds and tests code on every change to catch defects early. CD has two meanings: continuous delivery automates everything up to a release-ready state but keeps a manual approval for the production release, while continuous deployment automates all the way to production.
Normal forms (1NF to 3NF)
A staged technique for reducing redundancy and update anomalies in relational database design. First normal form removes repeating groups, second normal form separates attributes that depend on only part of the primary key, and third normal form separates attributes that depend on non-key attributes (transitive dependency).
Related: Functional dependency
Pipeline processing
A technique that divides instruction execution into stages such as fetch, decode, execute, and write-back, processing the stages of multiple instructions concurrently to increase CPU throughput. Branch instructions and similar cases can cause pipeline hazards.
Pseudocode (Subject B)
A language-independent notation used in Subject B of the FE exam. It expresses variable declarations, branching, loops, and function calls in a common syntax, and is used to test tracing algorithms and filling in blanks.
Stack and queue (abstract data structures)
Fundamental data structures that impose an order on inserting and removing data. A stack manages elements last-in-first-out (LIFO), and a queue manages them first-in-first-out (FIFO); both frequently appear as building blocks in pseudocode programs.
Prerequisites: Pseudocode (Subject B)、Queue (FIFO)、Stack (LIFO)
Agile development and Scrum
Agile development is an umbrella term for development approaches that repeat short cycles (iterations) of planning, design, implementation, and testing to respond flexibly to changing requirements. Scrum is a representative agile method that repeats short cycles called sprints.
Prerequisites: Sprint
Arrow diagram
A diagram (PERT chart) that represents the sequencing of tasks and their durations using arrows and nodes. Summing the durations along each path allows the critical path and the earliest/latest start and finish dates to be calculated.
Prerequisites: Critical path
Binary number
A way of representing numbers using only the two digits 0 and 1. Because a computer's internals correspond to the on/off states of electrical signals, binary is the basic representation used internally; converting between binary and decimal is a fundamental skill tested.
Black-box testing
A testing technique that verifies from the outside whether a program produces the output specified by its requirements for a given input, without regard to internal structure, using test-case design techniques such as equivalence partitioning and boundary value analysis.
Related: Equivalence partitioning and boundary value analysis
Critical path
Among all the paths from a project's start to its finish, the one with the longest duration. If any task on this path slips by even one day, the overall project completion date slips as well.
DevOps
A philosophy and culture in which development and operations collaborate closely, using automation and CI/CD to deliver software faster and continuously.
Prerequisites: CI/CD
Internal control
The mechanisms and structures a company builds into its own business processes so that operations are carried out appropriately and efficiently. It aims to prevent fraud and ensure reliable financial reporting, and responsibility for establishing and operating it rests with management.
Act on Proportionate Transactions for Small and Medium Sized Subcontractors
A law ensuring fair dealing when a commissioning business (formerly a parent enterprise) places orders with a small/medium subcontracted business (in force January 2026; formerly the Subcontract Act, renamed in Syllabus Ver.6.5). It prohibits practices such as delayed payment, unjust price reductions, and beating down prices, and regulates payment methods such as paying by bills that are hard to discount (e.g., bills with excessively long terms).
Related: Commissioning business and small/medium subcontracted business
System audit
An activity in which an independent auditor verifies and evaluates, from a third-party standpoint, whether an information system is operated safely and efficiently, and advises on improvements. Independence from the audited department is a precondition for the audit's credibility.
MTBF (mean time between failures)
For a repairable system, the average operating time from one failure to the next. A larger value means fewer failures and higher reliability. Computed as total operating time ÷ number of failures.
Transaction isolation level
A setting that determines to what extent concurrently executing transactions can see each other's uncommitted changes. From lowest to highest: READ UNCOMMITTED (allows dirty reads), READ COMMITTED, REPEATABLE READ, and SERIALIZABLE (the strictest level, equivalent to serial execution). Raising the level improves consistency but reduces concurrency (throughput) — a fundamental trade-off.
Neural network
A computational model inspired by biological neurons, built by connecting multiple layers of units that take a weighted sum of inputs and pass it through an activation function to produce an output. During training, the output error is propagated backward (backpropagation) to update the weights of each layer so the network approximates the relationship between inputs and outputs.
Page Replacement Algorithm
An algorithm that decides which page to evict from main memory when it is full, in virtual memory management. Common examples are LRU (evicts the least recently used page), FIFO (evicts the oldest loaded page), and LFU (evicts the least frequently used page).
Prerequisites: Virtual memory and paging、Queue (FIFO)
Routing
The process of determining the path packets take from source to destination across a network. Routers use a routing table that can be set statically or updated dynamically through routing protocols such as RIP or OSPF.
CNN (convolutional neural network)
A deep learning model that combines convolutional layers and pooling layers to progressively extract spatial features such as those in images. It is a leading architecture for high-performance image recognition and object detection.
Prerequisites: Neural network
Break-even point
The sales amount (or unit volume) at which total sales exactly equal total cost (fixed cost plus variable cost), producing neither profit nor loss. A lower break-even ratio means a business can turn a profit even with relatively little sales.
Related: Fixed cost and variable cost
Digital signature
A technology that uses public-key cryptography to prove both that an electronic document was created by the claimed author (authenticity) and that the document has not been tampered with (integrity).
Prerequisites: Authenticity
DX (Digital Transformation)
Transforming products, services, business models, organizations, and corporate culture through the use of data and digital technology to establish a competitive advantage — a different goal from simple digitization.
Prerequisites: Digitization and digitalization
MOT (Management of Technology)
A management approach used by technology-based businesses to continuously translate the outcomes of technological development into business results and increased corporate value.
Non-functional requirements
Requirements concerning the quality aspects of a system — such as performance, availability, security, and maintainability — rather than the functions themselves. They must be clarified alongside functional requirements during requirements definition.
Prerequisites: Requirements definition
SLA and SLM
An SLA (service level agreement) is a document agreed between a service provider and its users specifying quality targets such as uptime and response time. SLM (service level management) is the ongoing activity of monitoring and reviewing that agreement.
Prerequisites: Availability rate
Stack (LIFO)
A data structure in which the last item stored is the first one retrieved (LIFO: Last In First Out). Items are added and removed only from one end (the top). It is often likened to a browser's "back" history.
White-box testing
A testing technique that focuses on a program's internal structure (logic), verifying that every branch and path executes as intended, using coverage criteria such as statement coverage and branch coverage.
MTTR (mean time to repair)
The average time from a failure until recovery. A smaller value means faster recovery and better maintainability. Computed as total repair time ÷ number of failures; it is part of the denominator in availability = MTBF ÷ (MTBF + MTTR), assessed together with MTBF (mean time between failures) for reliability and maintainability.
Prerequisites: Availability rate、MTBF (mean time between failures)
Information security education and training
An ongoing effort that goes beyond drafting rules and regulations, using periodic group training, e-learning, and targeted-attack email drills to instill security awareness and behavior across all employees. It is central to the effectiveness of personnel-based controls, and keeping records of participation and measuring comprehension are key to preventing the program from becoming a formality.
Prerequisites: Targeted attack、Targeted-attack email drill
Information asset
Information that has value to an organization and is subject to risk assessment, together with the systems that handle it. It covers not only the data itself — such as customer records or design documents — but also the equipment (servers, PCs) that stores or processes it, and related business processes. Building an inventory and rating importance (confidentiality, integrity, availability) is the starting point of asset management.
Related: Risk assessment
JPCERT/CC
A general incorporated association that accepts incident reports, supports response, and issues alerts for computer security incidents in Japan. As a neutral coordinating body independent of any specific government agency or company, it also serves as a hub for information sharing among CSIRTs at home and abroad.
Prerequisites: CSIRT
Ransomware
Malware that encrypts files on an infected PC or server, rendering them unusable, and demands payment in exchange for decryption. In recent years, the dominant tactic is "double extortion" — threatening to leak exfiltrated data in addition to withholding the decryption key. Taking backups and keeping them isolated (offline) is an effective countermeasure.
Related: Malware
Supply chain attack
An attack technique that infiltrates a target not directly but via a business partner, subcontractor, or the supplier of software/libraries it uses, where security is weaker. Typical examples include unauthorized access through a subcontractor or malware inserted into a software update. Assuring subcontractors' security levels through contracts and audits is a key countermeasure.
Prerequisites: Malware
Targeted-attack email drill
A training exercise in which employees are sent simulated targeted-attack emails that mimic real attacks, measuring open and click rates to raise awareness and reinforce response procedures. Results are aggregated to provide additional training for employees who opened the email and to reinforce the procedure for reporting suspicious mail.
Prerequisites: Targeted attack
Vendor (outsourcing) management
The practice of confirming and managing, through contracts (NDAs, SLAs), pre-selection evaluation, and periodic audits, that an outsourcing partner maintains a security level equal to or better than the commissioning organization's own, when business operations or system development/operation are outsourced. It aims to prevent information leaks or supply chain attacks originating from the vendor.
Prerequisites: Supply chain attack
Container virtualization
A lightweight virtualization approach in which multiple application runtime environments (containers) share the host OS kernel, with processes and file systems isolated via namespaces. Compared with hypervisor-based virtualization (which runs a full guest OS), it starts faster and has less overhead, but it depends on the host kernel, so it cannot run a kernel of a different OS type. Docker is a representative implementation.
Prerequisites: Virtualization
CISC and RISC
Two philosophies of CPU instruction set design. CISC has complex, multi-function instructions that do a lot per instruction, often taking several clock cycles each. RISC restricts itself to simple instructions executed in roughly one clock cycle each, using pipelining for speed.
Prerequisites: Pipeline processing
EVM (earned value management)
A technique for managing project progress and cost using value-based metrics. From planned value (PV), earned value (EV), and actual cost (AC), it computes cost variance (CV) and schedule variance (SV) to quantify delays and cost overruns.
Hash function (tamper detection)
A function that computes a fixed-length value (a hash value) from data of arbitrary length. The same input always produces the same output, and even a tiny change drastically alters the value, which is why hash functions are used for tamper detection and password storage.
Hashing
A data structure technique that uses the value produced by applying a hash function to a key as the storage position in an array, achieving average O(1) search and insertion. It requires a way to handle collisions, where different keys map to the same position.
Prerequisites: Hash function (tamper detection)
Hybrid cryptography
A scheme that combines the processing speed of symmetric-key cryptography with the secure key distribution of public-key cryptography. The data itself is encrypted with a symmetric key, and that symmetric key is then encrypted with the recipient's public key before being sent. Used in S/MIME, PGP, and TLS 1.2 and earlier (note that current TLS 1.3 uses (EC)DHE key exchange and no longer sends a symmetric key encrypted under a public key).
Prerequisites: Symmetric-key cryptography
Sort stability (stable sort)
The property that, when two elements have equal sort keys, their relative order before sorting is preserved after sorting. Merge sort is a stable sort, whereas quick sort can be unstable depending on the implementation.
Prerequisites: Sorting algorithms (bubble, quick, merge sort)
Virtual memory and paging
A technique that lets programs larger than physical main memory be executed. A program is divided into fixed-size "pages," only the needed pages are loaded into main memory, and pages no longer needed are swapped out to secondary storage (paging).
The CIA triad (confidentiality, integrity, availability)
The three fundamental elements of information security management. Confidentiality means only authorized people can access information; integrity means information is accurate and has not been tampered with; availability means information can be accessed whenever it is needed.
Generative AI
AI capable of generating new content such as text, images, audio, or program code. While useful for improving operational efficiency, care is needed regarding risks such as hallucination — plausibly generating incorrect information — and copyright infringement.
Prerequisites: Copyright
Input/output devices
A collective term for devices that input data into a computer (keyboard, mouse, scanner, etc.) and devices that output the results of processing (display, printer, etc.). In IoT devices, sensors act as input devices and actuators as output devices.
Prerequisites: Sensors and actuators
IoT (Internet of Things)
A mechanism in which various "things" — home appliances, equipment, vehicles, and more — equipped with sensors connect to the internet and exchange information with each other. Analyzing and utilizing the collected data is the source of its value.
Prerequisites: Sensors and actuators
JPEG and MPEG
JPEG is a representative image format that lossily compresses still images such as photographs. MPEG is a representative family of standards for compressing video (image plus audio), reducing data volume by exploiting differences between frames.
Prerequisites: Lossless and lossy compression
PDCA cycle
A method for continuously improving operations or management by repeating Plan, Do, Check, and Act. The key point is not to stop after one cycle: the result of Act feeds into the next Plan.
SCM (Supply Chain Management)
A management approach that shares information across companies along the chain from raw-material procurement through production, distribution, and sales, optimizing the whole to reduce inventory and shorten lead times.
Segregation of duties
A basic internal-control principle that prevents fraud and error by dividing a sequence of duties — such as approval, execution, recording, and custody — among multiple people rather than concentrating them in one person.
Prerequisites: Internal control
Symmetric-key cryptography
An encryption method that uses the same key (a shared secret key) for both encryption and decryption. Processing is fast, but the key must be shared securely with each communication partner, making key management increasingly complex as the number of partners grows.
TCP/IP
A collective term for the standard suite of communication protocols used on the internet. IP handles routing that delivers data to its destination, while TCP ensures reliability through delivery confirmation and retransmission control.
Prerequisites: Routing
Technology roadmap
A time-based visualization of future technology trends and a company's own technology-development plans. It is used in MOT (management of technology) to align R&D investment decisions with business strategy.
Prerequisites: MOT (Management of Technology)
Transactions and ACID properties
A transaction is a unit that treats a series of operations as a single whole; if it fails partway through, the entire transaction is undone (rolled back). The ACID properties — atomicity, consistency, isolation, and durability — are the four qualities a transaction must satisfy.
Prerequisites: ACID Properties
Virtualization
Technology that uses software to create multiple virtual computers (virtual machines) on a single physical computer (server virtualization); storage, network, and desktop resources can likewise be virtualized. It allows hardware resources to be used efficiently and enables consolidation and flexible reconfiguration.
Waterfall model
A development approach that proceeds through phases — requirements definition, design, implementation, testing — in sequence, on the premise that, in principle, work does not return to a previous phase. It is easy to plan but not well suited to mid-project requirement changes.
Prerequisites: Requirements definition
Pseudonymized information and anonymized information
Both are processing categories under the Act on the Protection of Personal Information, but they serve different purposes. Pseudonymized information is processed so the individual cannot be identified unless cross-referenced with other data; it is intended for internal analytical use, with some relaxed restrictions on using it for other purposes without consent, but third-party provision is generally prohibited. Anonymized information is processed so the individual cannot be identified and the data cannot be restored, allowing it to be provided to third parties without consent.
Prerequisites: Act on the Protection of Personal Information
CSIRT operations and SOC
While the CSIRT is the command center for incident response, the SOC (Security Operation Center) is the operational team that monitors logs and alerts around the clock to detect threats and perform initial analysis. Smaller organizations often outsource this monitoring to an MSSP (managed security service provider) rather than building it in-house.
Prerequisites: CSIRT
DLP (Data Loss Prevention)
A mechanism that monitors channels such as email, copying to USB drives, and uploads to cloud storage, detecting, warning about, or blocking the outbound movement of data matching patterns for confidential or personal information. It is used to prevent information leaks caused by insider misconduct or operator error.
Prerequisites: Insider threat
EDR (Endpoint Detection and Response)
A mechanism that continuously monitors and records behavior on endpoints such as PCs and servers, detecting suspicious post-intrusion activity (process launches, network connections, file changes) and enabling isolation or investigation. Whereas antivirus is an entry-point control that detects known patterns, EDR assumes intrusion will happen and provides after-the-fact response and visibility.
Prerequisites: Layered defense (entry, internal, and exit controls)
Act on Electronic Signatures and Certification Business
A law providing that an electronic record bearing an electronic signature meeting certain requirements (able to be created only by the signer, allowing detection of alteration, etc.) is presumed to have been created authentically. It is the legal basis for electronic contracts carrying the same legal effect as paper contracts.
Prerequisites: Digital signature
Insider threat
Deliberate misconduct by someone inside the organization — an employee or contractor — who abuses legitimate access to exfiltrate or tamper with information or disrupt systems. It is harder to detect than external attacks and is often explained by the fraud triangle: motive (grievance, money), opportunity (excessive privilege), and rationalization. Access-log monitoring and separation of duties are the main countermeasures.
JVN (Japan Vulnerability Notes)
A portal jointly operated by JPCERT/CC and IPA that publishes vulnerability information and countermeasures for software used in Japan. Entries note the corresponding CVE ID and severity (CVSS) and serve as a primary reference for vulnerability response.
Prerequisites: JPCERT/CC
Layered defense (entry, internal, and exit controls)
A design philosophy premised on the idea that intrusion can never be prevented with 100% certainty, combining entry controls (firewalls/WAF to block intrusion itself), internal controls (privilege management and EDR to contain damage after intrusion), and exit controls (DLP and proxies to stop data exfiltration) in multiple layers, avoiding over-reliance on any single measure.
Penetration testing
A test that attempts to break into a system using the same techniques and perspective as a real attacker, demonstrating that a discovered vulnerability is actually exploitable and how far the resulting damage could spread. Unlike vulnerability assessment, which exhaustively lists weaknesses, it digs deep into a specific attack path.
Related: Vulnerability assessment
Residual risk
The risk that remains after risk treatment (reduction, avoidance, transfer) has been applied. Because risk can never be reduced to zero, management must judge whether the remaining level is acceptable and formally approve accepting it.
Prerequisites: Risk treatment (reduction, avoidance, transfer, acceptance)
Special care-required personal information
A category under the Act on the Protection of Personal Information covering data such as race, creed, medical history, and criminal record, which requires especially careful handling to prevent unjust discrimination or prejudice against the individual. Acquiring it generally requires the individual's consent, and it is subject to stricter protection than ordinary personal information.
Prerequisites: Act on the Protection of Personal Information
Statement of Applicability (SoA)
A document that specifies, for each control listed in Annex A of ISO/IEC 27001, whether it is applied or excluded in the organization and the rationale for that decision. It is drawn up based on risk assessment results and is a central artifact examined during ISMS certification audits.
Prerequisites: Risk assessment
Supply chain management (security perspective)
An effort to make the entire supply network for a product or service visible — component suppliers, the software/OSS libraries used, even sub-subcontractors — and to assess and manage security risk at each stage. Maintaining a software bill of materials (SBOM) has recently gained attention as an effective tool for this.
Prerequisites: SCM (Supply Chain Management)
Unfair Competition Prevention Act (trade secrets)
A law prohibiting the wrongful acquisition, use, or disclosure of a "trade secret" — information that meets three requirements: it is managed as confidential (secrecy management), it is useful business information (usefulness), and it is not publicly known (non-public). It is the legal basis for remedies against an employee who takes a customer list or technical information and uses it at a new employer.
Vulnerability assessment
A service or activity in which tools or specialists inspect web applications, network devices, or servers for known vulnerabilities. Its purpose differs from penetration testing — which tries to actually break in — in that vulnerability assessment aims to exhaustively list known weaknesses.
Related: Penetration testing