CertNexus CET common mistakes
CertNexus CET · Understand the traps and how to avoid them.
Treating the IoT domain as a networking quiz: answering questions about device connectivity by naming protocols (MQTT, CoAP, Zigbee, LoRaWAN) without addressing the constraint that drives the choice, such as bandwidth, power budget, range, or payload size.
Candidates with a networking background default to protocol recall because it feels concrete and testable, while the exam frames IoT decisions around resource-constrained devices and the trade-offs those constraints force.
What to do instead
For every IoT connectivity question, write down the device's power source, data rate, range, and payload size before selecting a protocol. Practice justifying each protocol choice with at least one constraint it satisfies and one it sacrifices.
Classifying an IoT deployment as secure because it uses encryption, while ignoring the device lifecycle: default credentials, missing firmware update paths, unpatched legacy devices, and decommissioning without data wiping.
Encryption is the most visible control and is easy to confirm, so candidates stop there. Lifecycle risks are less intuitive because they involve processes rather than protocols.
What to do instead
Build a checklist covering onboarding (credential provisioning), operation (patching, monitoring), and retirement (data sanitization, key revocation). When a scenario describes a deployment, scan all three phases before choosing an answer.
Answering AI questions with a general definition of machine learning instead of distinguishing supervised, unsupervised, and reinforcement learning by the data and feedback available in the scenario.
Candidates memorize definitions but do not practice mapping scenario clues, such as whether labels exist or whether a reward signal is present, to the correct learning paradigm.
What to do instead
For each practice scenario, identify three things first: is labeled data present, is there an environment with rewards, and is the goal grouping or prediction. Let those answers select the paradigm before reading the options.
Confusing model evaluation metrics: choosing accuracy for an imbalanced classification problem, or mixing up precision and recall when the scenario describes the cost of false positives versus false negatives.
Accuracy is the default metric taught first and feels safe, and precision/recall are easy to swap under time pressure because their definitions sound similar.
What to do instead
Anchor each metric to a business cost. Write 'false positive cost' and 'false negative cost' from the scenario, then pick the metric that penalizes the expensive error. Use a confusion matrix sketch for every metric question.
Treating AI ethics as a compliance checkbox: answering a bias scenario by naming a principle such as fairness or transparency without identifying the specific mitigation, such as rebalancing training data, auditing outcomes across groups, or documenting model limitations.
Ethics content is often studied as vocabulary lists, so candidates recognize the principle name but have not practiced connecting a harm to a concrete technical or procedural remedy.
What to do instead
For each principle (fairness, accountability, transparency, privacy, safety), memorize one data-level, one model-level, and one process-level mitigation. In scenario questions, name the harm, then the mitigation level it requires.
Overlooking privacy regulation fundamentals: failing to distinguish a data controller from a data processor, or misapplying consent and data-subject rights to a described workflow.
Candidates focus on security controls and treat legal roles as background reading, yet role identification determines who is accountable in the scenario.
What to do instead
Practice assigning roles in short scenarios: who determines purpose (controller), who acts on instruction (processor). Then check whether consent was valid, whether a lawful basis exists, and which data-subject right the scenario invokes.
Skipping the data preparation stage in data science questions: jumping to model selection when the scenario describes missing values, outliers, class imbalance, or leakage between training and test sets.
Modeling is the most engaging part of the workflow, so candidates underweight the earlier steps even though most realistic scenarios hinge on data quality problems.
What to do instead
Before evaluating any modeling option, list the data issues stated in the scenario and match each to a remedy (imputation, resampling, stratified splitting, feature removal). Eliminate options that ignore a stated data defect.
Ignoring the distinction between correlation and causation, or accepting a visualization and summary statistic at face value without checking sample size, sampling method, and axis scaling.
Scenarios often present a plausible-sounding conclusion, and candidates evaluate whether the conclusion is believable rather than whether the described evidence supports it.
What to do instead
Apply a fixed critique sequence to every data-interpretation item: sample size, sampling bias, confounders, and chart construction. Reject conclusions that require causal claims from observational data unless a controlled design is described.
Answering cybersecurity questions by naming a control category (preventive, detective, corrective) or a framework name without mapping it to the specific threat and asset in the scenario.
Framework familiarity creates recognition confidence, so candidates select the option containing familiar terminology rather than the option that addresses the stated risk.
What to do instead
Restate the scenario as 'asset, threat, impact' in one line, then test each option against that line. Eliminate any option that does not change the likelihood or impact of that specific threat.
Confusing risk treatment vocabulary: using risk avoidance, transfer, mitigation, and acceptance interchangeably, or treating a vulnerability scan as risk remediation.
The terms sound similar and are often learned as a list, so candidates match on tone rather than on the actual decision described.
What to do instead
Memorize each treatment with a one-line example (avoid: stop the activity; transfer: insurance or contract; mitigate: add a control; accept: document and proceed). For each scenario, identify which decision the organization actually made.