Professional Practices, Ethics, and Communication
Scope
This domain tests conduct: how you handle data, communicate with users, and behave under pressure. Questions often present a tempting shortcut and reward the ethical, documented path.
Concepts to master
Understand confidentiality (do not access data beyond need), integrity (accurate records, no falsified logs), and accountability. Know least privilege as an ethical as well as technical principle. Understand conflict of interest, gift policies, chain of custody for devices, and incident reporting. For communication, know active listening, plain language, managing expectations, empathy, and escalation etiquette.
Traps
- Accessing a colleague's files "to help" without authorization - a confidentiality breach even with good intent.
- Promising a fix time you cannot guarantee; better to state a next update time.
- Arguing with a frustrated user instead of acknowledging and refocusing.
- Sharing incident details on social media or with unauthorized parties.
- Bypassing policy because "it's faster."
Rule of thumb - the need-to-know test
Before opening a file, mailbox, or record, ask: "Does resolving this ticket require it, and am I authorized?" If either answer is no, stop and escalate.
Communication formula
Acknowledge → explain in plain language → state the next step and time → confirm understanding. Avoid blame and jargon; do not speculate about causes you have not verified.
Worked example
A manager asks you to reset an employee's password and read their email to "check for a problem." Reset only through the approved identity process with the user present or verified; refuse the email review without proper authorization and route the request to HR/security.