CIP C11 common mistakes
CIP C11 · Understand the traps and how to avoid them.
Reading 'shall' and 'should' in a clause as interchangeable and answering as if the weaker provision were binding.
Candidates skim for keywords and carry over habits from standards where the two words are used loosely; the exam tests the deliberate distinction between mandatory and recommended practice.
What to do instead
Before answering, underline the modal verb in the stem. Treat 'shall' as a requirement that must be met and 'should' as a recommendation where an alternative can be justified; eliminate options that only satisfy a 'should' when the stem asks for a 'shall'.
Treating every listed requirement as applying to all organizations regardless of size or scope, and choosing the most comprehensive option by default.
The most thorough-sounding answer feels safest, so candidates pick it without checking whether the stem's scenario (small organization, limited scope) actually triggers that requirement.
What to do instead
Identify the organization's size, sector and scope from the stem first, then ask which requirements are conditional. Where the stem describes a limited scope, prefer the option that applies the requirement proportionately rather than the maximal one.
Confusing a policy with a procedure and selecting the option that describes day-to-day steps when the question asks about management direction.
Both documents are described loosely in everyday workplace language, and candidates answer from memory of their own organization rather than the defined usage.
What to do instead
Memorize the hierarchy: policy states intent and direction, standards set measurable criteria, procedures describe who does what and when, and records provide evidence. Map the stem's verb ('establish direction', 'describe steps', 'provide evidence') to the right layer.
Choosing an answer that stops at 'identify the risk' when the stem describes an ongoing process, omitting treatment, monitoring and review.
Candidates recall the early steps of a process more strongly than the later ones and accept a partially correct option because it is not obviously wrong.
What to do instead
Recite the full cycle before looking at the options: establish context, identify, analyse, evaluate, treat, communicate, monitor and review. Reject any option that halts mid-cycle when the stem describes a continuous or iterative activity.
Assuming risk treatment means 'avoid the risk' and selecting avoidance whenever a threat is described as serious.
Avoidance is the most intuitive response to danger, so it wins by default even when the stem describes a risk that must be retained or transferred.
What to do instead
List the treatment options explicitly (avoid, reduce or mitigate, transfer or share, accept) and test each against the stem's constraints on cost, legal obligation and business continuity. Choose the option the scenario's constraints allow, not the one that feels safest.
Selecting the first plausible option without eliminating the others, especially in 'which is BEST' or 'MOST likely' items.
Time pressure and the presence of a defensible-sounding distractor create a stopping rule that fires too early.
What to do instead
For superlative stems, read all four options and write a one-line reason each is wrong. Eliminate on a specific criterion (scope, authority, sequence, mandatory versus optional). Answer only when one option survives; if two survive, re-read the stem for the qualifier that breaks the tie.
Applying a control or requirement to the data owner when the stem assigns the activity to the data custodian, or vice versa.
Role names sound similar and candidates map them to their own job title rather than to the defined responsibilities of accountability versus day-to-day handling.
What to do instead
Fix the roles in memory: the owner is accountable for classification and access decisions; the custodian implements and operates the controls. When a stem names a role, ask whether the activity is a decision (owner) or an execution (custodian) before choosing.
Answering incident-response questions with containment or eradication when the stem is still at the detection and reporting stage.
Candidates jump to the dramatic, action-oriented phase and pick it because it sounds decisive.
What to do instead
Order the phases and match the stem to the earliest incomplete one: preparation, detection and reporting, assessment and triage, containment, eradication, recovery, lessons learned. The correct answer is the next step the scenario has not yet completed, not the most dramatic one.
Treating a business continuity plan and a disaster recovery plan as the same document and choosing an IT-focused answer for a business-focused stem.
The terms are used interchangeably in many workplaces, so candidates import that looseness into the exam.
What to do instead
Separate them by object and timescale: continuity addresses keeping critical business functions running during disruption; recovery addresses restoring technology and facilities afterwards. Read the stem for whether the subject is a business function or a system, and answer at that level.
Ignoring the qualifier in the stem ('EXCEPT', 'LEAST likely', 'FIRST') and answering the question that was expected rather than the one written.
Pattern-matching on the topic overrides careful reading, and negative stems are read as positive ones under time pressure.
What to do instead
Circle or mentally capitalize the qualifier before evaluating options, and restate the stem to yourself in one sentence containing that qualifier. For 'EXCEPT' items, confirm three options are true statements before selecting the fourth.