ASIS APP common mistakes
ASIS APP · Understand the traps and how to avoid them.
Choosing the most operationally satisfying answer (locking down the site, firing the guard, adding cameras) instead of the answer that starts with a documented, programmatic step such as an assessment, policy, or plan.
Candidates with hands-on security backgrounds reason from their day job where action is rewarded, and the exam instead rewards the management-process step that logically comes first.
What to do instead
Before selecting, ask 'what is the first or most fundamental step a security manager would take?' and prefer assess/plan/policy/document over act/deploy/enforce unless the stem already establishes those are done.
Treating the four domains as isolated and answering a physical security question purely with hardware knowledge, ignoring the business, risk, and policy framing the exam expects.
Studying is usually done domain by domain, so candidates silo knowledge and miss that many stems are really asking about governance or risk acceptance rather than equipment.
What to do instead
After reading each stem, explicitly label which domain the decision sits in and check whether the answer must satisfy a business or risk constraint before it can be technically correct.
Picking the control that eliminates a risk entirely rather than the control that reduces risk to an acceptable level within cost and operational constraints.
Candidates equate 'best' with 'most secure', but the exam frames security as balancing protection against business enablement and budget.
What to do instead
Evaluate each option for cost, operational impact, and residual risk; prefer proportionate, layered mitigation over absolute or disruptive measures.
Confusing risk assessment steps with risk treatment steps, for example jumping to mitigation when the scenario calls for identifying, analyzing, or evaluating risk first.
The risk process is learned as a list rather than a sequence, so candidates match keywords instead of the stage the scenario is actually in.
What to do instead
Memorize the order identify, analyze, evaluate, treat, monitor, and locate the stem's decision point before looking at options.
Answering with the asset-protection measure when the stem asks about people, or vice versa, because the candidate latches onto the most prominent noun in the question.
Long scenario stems bury the actual question at the end, and candidates answer the situation they pictured rather than the question asked.
What to do instead
Read the last sentence first to identify the actual ask, then reread the stem to confirm which asset or objective it concerns.
Selecting a specific technology or product category when the stem describes a need for defense in depth, deterrence, or detection layered with other controls.
Product knowledge is concrete and memorable, so candidates over-select single solutions and under-select integrated or layered strategies.
What to do instead
When an option names a single device, check whether another option describes a layered or programmatic approach that better fits the stated objective.
Ignoring the organizational context in the stem, such as a stated budget limit, union agreement, regulatory obligation, or corporate culture, and choosing a textbook-ideal answer.
Candidates skim for security keywords and treat contextual details as filler, when those details are usually what disqualify the tempting answer.
What to do instead
Underline every constraint in the stem (money, law, policy, culture, time) and eliminate any option that violates one before comparing the rest.
Misreading absolute qualifiers such as 'first', 'primary', 'most important', 'best', and 'except' and choosing a true statement that does not answer the question.
Under time pressure, candidates recognize a correct-sounding statement and stop reading, missing the qualifier that changes which answer is right.
What to do instead
Circle qualifier words during the first read and, for 'except' or 'least' items, restate the question in your own words before evaluating options.
Applying a control from the wrong layer of the security model, for example proposing an administrative policy where the scenario requires a physical barrier, or CCTV where access control is needed.
Controls are memorized by name but not by category, so candidates cannot map a described gap to the correct control type.
What to do instead
Practice classifying controls as physical, technical, or administrative and as preventive, detective, or corrective, then match the gap's nature to the control class.
Rushing the final review and changing correct answers based on a single recalled fact or gut feeling rather than re-reading the stem.
Fatigue and time pressure near the end of the exam prompt second-guessing, and candidates revise toward familiar-sounding options instead of the scenario's logic.
What to do instead
Use remaining time to reread the stem and your chosen answer together; only change an answer if you can point to specific stem language that contradicts it.