Foundation
What to know
Foundation covers the platform's building blocks: environments (development, test, production), objects and their types (process models, record types, interfaces, groups, constants), security roles and groups, and deployment between environments. A candidate must understand that objects live in an application and are promoted via deployment packages, and that groups govern access while roles (like process model or record type security) define what a group can do. Know the difference between design-time security (who can edit an object) and runtime security (who can see or act on data).
Traps
A classic trap is assuming a user sees an object because they belong to a group with access - runtime visibility also depends on the object's own security and any record-level rules. Another trap: confusing application (a container of objects) with environment (an instance of the platform). Deployment questions often hinge on dependencies - promoting an object without its referenced constants or groups fails or breaks. Also watch for questions about system groups vs custom groups; system groups have fixed membership semantics.
Rule of thumb
Separate the two questions: Who can build it? (design-time) and Who can use it? (runtime). Most foundation questions are really asking one of these two.
Worked example
A developer builds a process model in the development environment, adds it to an application, and deploys a package to test. If the model references a constant not included in the package, the deployment reports a missing dependency - include the constant to resolve it.