C-ACYFSW common mistakes
C-ACYFSW · Understand the traps and how to avoid them.
Treating cyber resilience as a purely technical control set, so governance questions are answered with tooling (EDR, backups, SIEM) instead of accountability structures such as board oversight, risk appetite statements, and defined decision rights.
Candidates with hands-on security backgrounds default to solutions they have personally deployed and conflate 'resilience' with 'redundancy', missing that the domain tests how resilience is directed, funded, and owned at the executive level.
What to do instead
Before answering, ask whether the stem is about who decides, who is accountable, or how priorities are set. If yes, select the answer that establishes ownership, documented risk appetite, or escalation authority, and reserve tool-based options for architecture and operations domains.
Selecting the most aggressive risk treatment (avoid the activity, or add layered controls) instead of matching treatment to the assessed likelihood and impact, and to the organisation's stated risk tolerance.
Exam stems often describe a scary threat, which triggers a reflexive 'mitigate everything' response; candidates skip the step of checking whether the residual risk already sits inside tolerance.
What to do instead
Compute the qualitative rating from the stated likelihood and impact, compare it with the tolerance described in the stem, and only then choose accept, mitigate, transfer, or avoid. Where the stem says risk is within appetite, the correct answer is usually documented acceptance with monitoring.
Choosing a control that is conceptually strong but placed at the wrong layer, for example recommending application-level input validation when the described failure is a flat network allowing lateral movement between segments.
Candidates pattern-match on keywords in the stem ('injection', 'ransomware') rather than mapping the described failure to the layer where it occurs, so the control does not actually interrupt the attack path described.
What to do instead
Restate the stem as an attack path with a source, a movement step, and a target. Then pick the control that breaks that specific step, and eliminate options that harden a component the attacker never touches in the scenario.
Answering access-control questions with the strongest available mechanism (always MFA, always least privilege, always deny) without checking whether the stem's constraint is usability, legacy compatibility, or availability of a break-glass path.
Least privilege and MFA are taught as universal goods, so candidates stop reading once they see a familiar control and ignore the operational constraint the stem deliberately plants.
What to do instead
Read the constraint clause in the stem before the options. If a constraint is present, prefer the answer that preserves the security objective while satisfying it, such as scoped privileged access with session recording rather than blanket denial.
Confusing detection with prevention, or monitoring with response, when selecting the primary purpose of a described capability such as NetFlow analysis, honeytokens, or endpoint isolation.
Many controls do several things, and candidates pick the function they associate most strongly with the tool name rather than the function the stem asks about.
What to do instead
Identify the verb in the question ('detect', 'prevent', 'contain', 'recover') and choose the option whose primary mechanism matches that verb. Where two options both fit, prefer the one that operates earliest in the kill chain only if the stem asks for prevention.
Jumping to eradication or recovery steps during an incident scenario, skipping containment and evidence preservation, or recommending full reimage before forensic capture is considered.
Real-world pressure and the intuitive desire to 'fix it fast' push candidates toward remediation, and the exam's ordering logic (contain, preserve, eradicate, recover, learn) is not always the intuitive sequence.
What to do instead
Apply a fixed sequence to every incident stem: safety and containment first, then evidence preservation, then eradication, then restoration, then lessons learned. Eliminate any option that destroys state or restores service before the scope is understood.
Treating vendor risk as a one-time procurement gate, so questions about ongoing oversight, fourth-party exposure, or contractual right-to-audit are answered with 'obtain a SOC 2 report before onboarding'.
Candidates reduce third-party risk to questionnaire collection and forget the continuous-monitoring and concentration-risk dimensions the domain is built around.
What to do instead
Classify the question as pre-contract, ongoing, or exit. For ongoing questions, choose answers involving periodic reassessment, contractual audit rights, notification obligations, and mapping of subcontractors and data flows.
Answering audit and awareness questions with the control that would be nice to have rather than the evidence that would actually satisfy an auditor, such as citing a policy's existence instead of proof it is enforced and reviewed.
Candidates conflate having a document with operating an effective control, and underweight the distinction between design effectiveness and operating effectiveness.
What to do instead
Ask what artefact an auditor would sample. Prefer options producing dated, attributable evidence of operation (review logs, training completion records, tested exceptions) over options that only create or update documentation.
Treating emerging-technology questions as pure novelty questions, picking the newest-sounding control instead of applying existing risk, privacy, and governance principles to the new context.
The unfamiliar vocabulary (model poisoning, shadow AI use, quantum migration) unsettles candidates, and they reach for the option that sounds most advanced rather than the one that extends a familiar control objective.
What to do instead
Translate the new technology into a familiar triad: what asset is exposed, what trust boundary is crossed, what existing control objective applies. Then choose the answer that applies that objective, such as data classification and acceptable-use rules for generative tooling.
Reading the stem once, selecting the first plausible option, and moving on without eliminating the remaining choices, particularly on 'BEST' or 'MOST likely' questions where two answers are defensible.
Time pressure and overconfidence after recognising a familiar topic cause candidates to stop at the first satisfying answer rather than comparing all options against the exact wording of the question.
What to do instead
Force a two-pass method: predict the answer before looking at options, then read every option and articulate a one-line reason to reject each distractor. If two survive, re-read the qualifier ('first', 'BEST', 'primary') and choose the one that satisfies it most directly.