DSTC common mistakes
DSTC · Understand the traps and how to avoid them.
When asked which control best mitigates a given threat, the candidate picks the strongest-sounding control (e.g., full-disk encryption) rather than the control that actually addresses the described attack path.
Candidates pattern-match on impressive security terminology instead of first identifying the threat's attack vector and the asset being protected, so they choose a control that protects confidentiality at rest against a threat that is really about lateral movement or credential theft.
What to do instead
Before reading the answer options, restate the scenario in one line: what asset, what attacker action, what is the failure point. Then eliminate any option that does not interrupt that specific action, even if it is a valuable control in general.
Treats defense in depth as 'list every possible control' and selects an answer that stacks multiple controls when the question asks for the single most effective or first control to implement.
The phrase 'defense in depth' primes candidates to favor comprehensive answers, but many items test prioritization and ask for the control with the greatest marginal risk reduction given the stated constraints.
What to do instead
Watch for qualifiers like 'best', 'most effective', 'first', or 'primary'. When present, rank options by risk reduction for the stated scenario and reject 'everything at once' answers unless the item explicitly asks for a layered strategy.
Places a security device (firewall, IDS, WAF) at the wrong point in a described topology, such as putting an inline IPS outside the DMZ or a host firewall in front of a network appliance.
Candidates memorize device functions but do not mentally trace the traffic path in the given network diagram description, so they misjudge where inspection or enforcement must occur.
What to do instead
Sketch the traffic flow from source to destination in the order given. Mark where each option would sit and ask whether traffic actually passes through that point and whether the device can see the relevant layer (packets vs. application payload).
Recommends a flat internal network or VLAN-only segmentation as sufficient isolation for sensitive systems, ignoring that VLANs without ACLs or a stateful enforcement point do not restrict traffic.
Candidates equate logical separation (separate subnets/VLANs) with access control, but segmentation only provides security when routing and filtering rules actually deny unauthorized flows.
What to do instead
Whenever segmentation appears, verify the answer includes an enforcement mechanism (inter-VLAN ACLs, security groups, a firewall) and that the rule direction matches the threat. Reject answers that only create a new subnet.
Selects application allowlisting, EDR, or patching as interchangeable answers without matching the control to the described endpoint threat (e.g., choosing patching for an unknown zero-day or allowlisting for a known vulnerable app).
All three are 'endpoint security' topics, so candidates pick the most familiar term rather than reasoning about whether the threat is known-bad execution, unknown malware behavior, or a missing vendor fix.
What to do instead
Classify the endpoint threat first: known malicious binary, anomalous behavior, or unpatched vulnerability. Map allowlisting to the first, behavioral EDR to the second, and patch management to the third, then select accordingly.
Confuses authentication factors with authentication attributes, labeling a password plus a security question as MFA or counting two knowledge-based challenges as two factors.
Candidates count the number of prompts rather than the number of distinct factor categories (something you know, have, are), and knowledge-based questions feel like a separate step.
What to do instead
For any MFA item, tag each element with its factor category. If two elements share a category, it is single-factor regardless of how many screens the user sees.
Applies least privilege only to human users and overlooks service accounts, machine identities, or overly broad roles when the scenario centers on those.
Candidates associate IAM with user provisioning and forget that non-human identities frequently hold standing administrative rights and are the actual subject of the question.
What to do instead
When reading an IAM scenario, list every identity present (users, service accounts, roles, tokens) and check whether the proposed control addresses the identity the question is actually about.
Jumps from an alert to containment (isolate host, block IP) before confirming scope and preserving evidence, or conversely insists on full forensic imaging before any containment in an active compromise.
Candidates treat the incident response phases as a strict checklist and forget they can overlap; they either skip validation or freeze during an active threat waiting for perfect evidence.
What to do instead
Use the decision rule: if active harm is ongoing, contain first while preserving volatile evidence; if the alert is unconfirmed, validate and scope before disruptive action. Match the answer to whether the scenario says harm is ongoing.
Misreads log and alert evidence, such as treating a single failed login as an attack, ignoring a success-after-many-failures pattern, or missing that an outbound beacon indicates command-and-control rather than inbound scanning.
Candidates evaluate individual events in isolation instead of correlating them into a sequence and direction of traffic, which is where the actual signal lives.
What to do instead
For any detection item, build a short timeline from the evidence and note direction (inbound vs. outbound), volume, and success/failure. The answer should explain the pattern, not a single line.
Confuses governance artifacts, picking a policy when the question asks for a standard, procedure, or guideline, or citing a framework as if it were a certification or legal requirement.
Candidates treat policy, standard, procedure, and guideline as synonyms and treat frameworks like ISO 27001 or NIST CSF as mandatory law, so they select the wrong artifact or overstate obligation.
What to do instead
Memorize the ladder: policy = management intent, standard = mandatory specific requirement, procedure = step-by-step execution, guideline = recommended practice. Separately classify frameworks as voluntary guidance unless a regulation or contract is named.