CCST Cybersecurity common mistakes
CCST Cybersecurity · Understand the traps and how to avoid them.
When a scenario describes a user being denied access to a folder or a role being granted permission to a resource, the candidate selects 'authentication' as the control being described.
Authentication, authorization, and accounting are taught as one AAA block, so the three terms blur together under exam pressure and the candidate reaches for the first one learned.
What to do instead
Before answering, apply a two-word test: does the scenario prove who someone is (authentication) or decide what they may do (authorization)? If a username plus password, token, or certificate is being validated, it is authentication; if a policy, group membership, or role is being evaluated, it is authorization.
The candidate treats hashing and encryption as interchangeable, choosing 'hash the database' when the requirement is confidentiality of stored records, or choosing 'encrypt the file' when the requirement is detecting whether it was altered.
Both are described as 'scrambling data' in introductory material, and both produce output that looks random, so the candidate never builds a rule for which property each one provides.
What to do instead
Anchor each term to one property: hashing gives integrity and is one-way (no key recovery), encryption gives confidentiality and is reversible with a key. If the question mentions tampering, comparison, or a digest, the answer is hashing; if it mentions secrecy, disclosure, or unauthorized reading, the answer is encryption.
The candidate picks an intrusion prevention system for a scenario that explicitly says the device must only alert and must not alter traffic, or picks a passive tap/IDS for a scenario requiring the device to sit inline and block.
IDS and IPS share detection engines and rule sets, so the candidate focuses on what the device detects and skips the sentence describing where it is deployed and whether it can drop traffic.
What to do instead
Scan the stem for placement and action verbs first: 'monitors a copy of traffic', 'sends alerts', 'span port' means IDS (passive); 'inline', 'blocks', 'drops', 'resets the connection' means IPS. Decide passive versus inline before considering any other detail.
The candidate answers a name-resolution or local-delivery question with the wrong protocol, for example choosing DNS when the scenario is about mapping an IP address to a MAC address on the local segment, or choosing ARP when the scenario is about resolving a hostname.
ARP, DNS, and DHCP are all 'support protocols that make addressing work', so their distinct jobs collapse into a single vague memory of 'address stuff'.
What to do instead
Memorize one job per protocol: DNS maps names to IP addresses, ARP maps IP addresses to MAC addresses on the local link, DHCP hands out IP configuration. Read the two things being connected in the stem and match them to that list before looking at the options.
The candidate selects a traditional signature-based antivirus as the answer for a scenario describing detection of never-before-seen behavior, lateral movement, or a suspicious process chain on a host.
Antivirus and endpoint detection and response are both 'endpoint security software', so the candidate answers with the more familiar product category and ignores the words in the stem that describe behavior rather than known files.
What to do instead
Use a keyword split: 'known malware', 'signature', 'file scan', 'quarantine on match' points to signature-based antivirus; 'behavior', 'anomaly', 'unknown threat', 'process tree', 'lateral movement', 'response actions' points to EDR. Circle the descriptor in the stem before choosing.
The candidate recommends application allowlisting to solve a problem that allowlisting cannot solve as described, or confuses allowlisting with blocklisting when the scenario requires that only approved software may run.
Both are 'lists of software', and the candidate remembers the mechanics of maintaining a list without remembering which default state each one enforces.
What to do instead
State the default out loud: allowlisting blocks everything not explicitly permitted; blocklisting permits everything not explicitly banned. If the requirement is 'only approved applications may execute' or defense against unknown malicious software, the answer is allowlisting, and the candidate should also expect the maintenance-burden tradeoff as a distractor.
The candidate uses 'vulnerability', 'threat', 'risk', and 'exploit' as if they were synonyms, for example answering 'the vulnerability' when the question asks what a piece of malicious code that takes advantage of a flaw is called.
Everyday speech uses these words loosely, and the exam uses them as precise, separate terms, so the candidate's intuition overrides the definitions.
What to do instead
Fix the four definitions in one sentence each: a vulnerability is a weakness, a threat is a potential actor or event that could exploit it, an exploit is the technique or code that does so, and risk is the combination of likelihood and impact. Match the stem's noun to that list before reading options.
The candidate miscomputes single loss expectancy, annualized loss expectancy, or annualized rate of occurrence, typically by multiplying when it should divide or by substituting the asset value for the exposure factor.
The formulas are short enough that candidates memorize only the acronym expansion and then assemble the terms wrong under time pressure, especially when the stem gives a percentage exposure factor.
What to do instead
Write the two formulas before doing arithmetic: SLE = asset value x exposure factor, and ALE = SLE x ARO. Convert any percentage exposure factor to a decimal first, compute SLE as a separate step, then multiply by ARO, and sanity-check that ALE cannot exceed SLE x 1 unless ARO is greater than one event per year.
When asked what the team should do next after detecting an active intrusion, the candidate chooses eradication, recovery, or a full investigation before containment, or orders the incident response phases incorrectly.
Candidates reason about the most satisfying outcome (removing the malware, restoring service) rather than the safe sequence, and the phase names sound interchangeable because several overlap in practice.
What to do instead
Memorize the order as a chain that must not be broken: preparation, detection and analysis, containment, eradication, recovery, lessons learned. For any 'what next' question during an active incident, the default answer is containment (isolate, segment, disable the account) unless the stem explicitly says the threat is already fully stopped.
The candidate collects or analyzes evidence in the wrong order, for example powering off a machine to preserve it, or answering that a hard drive image should be captured before volatile memory and running process data.
Physical preservation feels intuitively safer than capturing transient state, and the phrase 'preserve the evidence' is remembered without the qualifier that volatile data disappears first.
What to do instead
Apply the order of volatility from most to least transient: CPU and cache, memory and running processes and network connections, then swap and temporary files, then disk, then remote logs and backups. Pair it with chain of custody: document who handled the evidence, when, and where at every transfer, and never power down a live system before capturing memory.