ExamFinch.com My Study

Study guide

2.3 Bitwise Operations & Two's Complement

Practice this exam

U.S. Air Force Cyber Test CSAT/ICTL

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Cyber AFSCs & Qualification Pipeline 1.3 How to Use This Guide & Study Plan

2 Number Systems & Encoding

2.1 Binary & Decimal Conversion 2.2 Hexadecimal & ASCII 2.3 Bitwise Operations & Two's Complement

3 Computing Architecture

3.1 Memory Hierarchy 3.2 CPU, Components & Data Path 3.3 Core Data Structures

4 Boolean Logic & Storage

4.1 Boolean Algebra & Logic Gates 4.2 Encoding, Files & Storage Concepts

5 Networking Models

5.1 OSI Model 5.2 TCP/IP Model & Encapsulation 5.3 Topologies & Transmission Media

6 Addressing & Subnetting

6.1 IPv4 Addressing 6.2 Subnetting & CIDR 6.3 IPv6 Fundamentals

7 Protocols & Network Services

7.1 TCP, UDP & Well-Known Ports 7.2 DNS & DHCP 7.3 Routing & Switching Basics

8 Cybersecurity Foundations

8.1 CIA Triad & Security Goals 8.2 Threats, Vulnerabilities & Malware 8.3 Social Engineering & Human Factors

9 Defensive Controls

9.1 Access Control & Authentication 9.2 Firewalls, IDS & IPS 9.3 SIEM & Defense in Depth

10 Programming Fundamentals

10.1 Variables, Types & Operators 10.2 Control Flow 10.3 Functions & Recursion

11 Languages & Debugging

11.1 Python Essentials for the Cyber Test 11.2 C++ Basics & Debugging Concepts

12 Operating Systems

12.1 Linux Fundamentals & Commands 12.2 Windows Fundamentals 12.3 Processes, Permissions & File Systems

13 Cryptography

13.1 Symmetric Encryption (AES) 13.2 Asymmetric Crypto & PKI 13.3 Hashing, MACs & Integrity

14 ICTL-Style Logic Reasoning

14.1 Deductive Logic & Syllogisms 14.2 Sequences & Pattern Recognition 14.3 Arrangement & Conditional Puzzles

15 Test Strategy & Mixed Review

15.1 Pacing, Elimination & AF Testing Day 15.2 Mixed Domain Review & Next Steps

2.3 Bitwise Operations & Two's Complement

Key Takeaways Explain This Topic AI

AND, OR, XOR, and NOT operate bit-by-bit: AND clears bits, OR sets bits, XOR toggles where masks are 1, NOT flips all bits

Left shift multiplies by 2 per position (within width); right shift divides by 2 conceptually for unsigned values

Unsigned N-bit range is 0 to 2^N−1; signed two's complement uses the MSB as the sign bit

Two's complement negate recipe: invert all bits (NOT), then add 1 — same width

Networking masks and crypto bit patterns rely on AND/OR; signed overflow and sign-bit traps appear on aptitude-style items

Last updated: July 2026

Once you can read binary and hex, the next Cyber Test skill is operating on bits. Firewalls, permission flags, subnet masks, and many crypto constructions are bitmasks: they keep, clear, or flip selected bits. Signed integers add another layer — the same bit pattern can mean different magnitudes depending on whether the value is unsigned or two's complement signed.

Bitwise Operations

Operate column by column on equally wide bit strings. Write the operands stacked; compute each column independently.

AND ( & )

Result bit is 1 only if both inputs are 1. Use AND to clear bits (mask with 0) or to extract fields (mask with 1s where you care).

  • A B A AND B
  • 0 0 0
  • 0 1 0
  • 1 0 0
  • 1 1 1

Worked example: 10110110 AND 11110000 = 10110000 . The lower nibble was cleared — the classic "keep high bits" mask pattern. Networking parallel: applying a subnet mask is conceptually AND between address and mask.

OR ( | )

Result bit is 1 if either input is 1. Use OR to set bits.

  • A B A OR B
  • 0 0 0
  • 0 1 1
  • 1 0 1
  • 1 1 1

Worked example: 10000000 OR 00001111 = 10001111 . You turned on the low four bits without touching the high bit.

XOR ( ^ )

Result bit is 1 if inputs differ . Use XOR to toggle bits where the mask is 1; XOR with all zeros leaves a value unchanged; XOR a value with itself yields zero.

  • A B A XOR B
  • 0 0 0
  • 0 1 1
  • 1 0 1
  • 1 1 0

Worked example: 11001100 XOR 00111100 = 11110000 . Crypto cameo: XOR appears in stream-cipher-style constructions and in simple one-time-pad teaching examples — ciphertext bit = plaintext bit XOR key bit. Knowing XOR's truth table is enough at CT depth; you do not need full cipher design.

NOT ( ~ )

Flips every bit: 0→1, 1→0. Width matters: NOT of an 8-bit 00001111 is 11110000 , not an infinite string of leading ones unless the type is wider.

Worked example: NOT 10101010 (8-bit) = 01010101 .

  • Shifts (Conceptual)
  • Left shift

Move every bit toward the MSB; vacate LSBs with zeros; bits shifted out of the high end are discarded (for fixed width). Each left shift by 1 multiplies by 2 (when no overflow out of the field).

  • 00000101 (5) left shift 1 → 00001010 (10)
  • Left shift 2 → 00010100 (20)
  • Right shift

Move bits toward the LSB; bits shifted out the low end are lost. For unsigned values, vacated MSBs fill with 0 — each step divides by 2 (floor).

00010100 (20) right shift 1 → 00001010 (10)

Signed arithmetic right shifts may sign-extend (fill with the old MSB). At Cyber Test depth, know the unsigned story and that signed shifts can preserve the sign bit — do not assume every right shift zeros the MSB.

Signed vs Unsigned

For an N-bit unsigned integer, values run from 0 to 2ᴺ − 1 .

  • 8-bit unsigned: 0 … 255
  • 4-bit unsigned: 0 … 15

For two's complement signed N-bit integers, the MSB is the sign bit . The range is roughly −2ᴺ⁻¹ … 2ᴺ⁻¹ − 1 .

  • 8-bit signed: −128 … +127
  • Same bit pattern 11111111 : unsigned 255 ; signed −1
  • Pattern 10000000 : unsigned 128 ; signed −128

Exam trap: Interpreting a high bit as "just another 128" when the stem says signed negative encoding.

Two's Complement Negate Recipe

To negate a value in two's complement (fixed width):

Invert all bits (bitwise NOT).

Add 1 (with carry in the same bit width; discard overflow beyond the width).

  • Worked example: Negate +6 in 8-bit two's complement
  • +6 = 00000110
  • NOT → 11111001
  • Add 1 → 11111010 → this represents −6
  • Worked example: Negate −6 back to +6
  • Start 11111010
  • NOT → 00000101
  • Add 1 → 00000110 → +6
  • Worked example: Find the decimal of signed 11111100 (8-bit)

Option A — recipe: MSB is 1, so negative. Negate to find magnitude: NOT 11111100 → 00000011 ; add 1 → 00000100 = 4; therefore value = −4 .

Option B — place values with sign: −128 + 64 + 32 + 16 + 8 + 4 = −128 + 124 = −4 . Same answer.

Special case: −128 in 8-bit

10000000 negated: NOT → 01111111 ; add 1 → 10000000 again. There is no +128 in 8-bit signed; −128 is the asymmetric edge of the range.

Putting It Together for Cyber

Subnet / ACL style thinking: address AND mask → network portion (clear host bits).

Flag registers: OR to enable options; AND with inverted mask to disable; XOR to toggle a feature bit.

ASCII case bit: difference of 32 between 'A' and 'a' is one bit — OR/AND/XOR with 0x20 can force case in ASCII-only contexts.

Crypto intuition: XOR mixes keystream bits; understanding that XOR is its own inverse (apply twice → original) explains simple recovery demos without needing AES internals yet.

Exam Traps

Confusing AND and OR: AND with 0 clears; OR with 1 sets. Mixing them reverses the intended mask effect.

XOR vs OR: OR never turns a 1 into 0; XOR can. If both bits are 1, OR stays 1 and XOR becomes 0.

Width after NOT: Always NOT within the stated bit width.

Signed high bit: 1xxxxxxx is not automatically "128 + …" when signed — use two's complement interpretation.

Shift multiply overflow: Left-shifting until bits fall off the MSB is not a pure ×2 in a fixed-width register.

  • Mini checklist
  • Stack bits; compute AND/OR/XOR/NOT per column
  • Left shift ≈ ×2; unsigned right shift ≈ ÷2
  • Unsigned max = all 1s; signed uses MSB as sign
  • Negate = NOT then +1
  • Masking in networks is AND; toggles often XOR

Master these operations with 8-bit scratch work. The Cyber Test rewards clean bit hygiene more than memorizing tool names.