NISP Level 1 - Security Awareness common mistakes
NISP Level 1 - Security Awareness · Understand the traps and how to avoid them.
Treating 'information security' as a synonym for IT or antivirus, so questions asking which element of the CIA triad is affected get answered by naming a technology instead of the property (confidentiality, integrity, availability) that is harmed.
Candidates study tools and products because those feel concrete, and never build the habit of mapping a scenario to the property being damaged. The question looks like a technology question, so they answer with a technology.
What to do instead
Before answering any scenario question in this domain, write one word: which of confidentiality, integrity, or availability is broken. A leaked customer list is confidentiality; altered payment details are integrity; a downed ordering system is availability. Practice with ten short scenarios until the mapping is automatic, then choose the answer that names the property or the control protecting it.
Judging password strength by whether the password looks complicated (mixed case, symbols, substitutions like 'P@ssw0rd') rather than by length and uniqueness, and picking the 'complex-looking' option as the strongest.
Decades of legacy advice and forced-complexity policies trained people to equate symbol substitution with strength. Substituted dictionary words are still dictionary words and fall to rule-based cracking immediately.
What to do instead
Rank options by length first, then by whether the string is a predictable word or pattern. A long multi-word passphrase beats a short cryptic string. Reject any option derived from a dictionary word, a name, a date, or a keyboard pattern, regardless of how many symbols it contains, and prefer the option that also states it is unique to one account and paired with multi-factor authentication.
Reading a phishing scenario for spelling errors and obvious urgency only, then declaring a well-written message legitimate, instead of checking sender domain, link destination, and whether the request matches normal process.
Awareness training often emphasises typos and bad grammar, so candidates use those as the sole test. Modern phishing is well written, and the exam deliberately includes polished messages to catch this shortcut.
What to do instead
Apply a fixed checklist to every email scenario: actual sender address (not display name), the real destination of any link, whether the request bypasses a normal approval or verification step, and whether it asks for credentials, payment, or secrecy. If any one of those is off, treat it as suspicious even when the language is flawless. The correct answer is usually the one that says verify through a separate known channel.
Confusing the safe response to a suspicious link or attachment with the safe response to already having clicked: candidates say 'just delete it' after a credential has been entered, or say 'report it' when the scenario asks what to do before interacting.
The exam tests behaviour at different points in an incident timeline, and candidates memorise one 'right answer' (report, or delete) without checking where in the sequence the scenario sits.
What to do instead
Anchor on the timeline: before interaction, do not click and report the message; after clicking but before entering data, disconnect if instructed and report immediately; after entering credentials, change the password from a known-clean device, enable MFA, and report to security so the account can be monitored. Read the scenario for what has already happened and answer for that stage only.
Assuming a padlock or HTTPS indicator means a website is trustworthy, and choosing 'the site is safe because it uses HTTPS' in questions about malicious or spoofed sites.
The padlock was marketed for years as a safety signal. It only confirms the connection is encrypted, not who operates the site or whether the content is honest.
What to do instead
Separate transport security from identity and intent. HTTPS protects data in transit; it says nothing about whether the operator is legitimate. For site-legitimacy questions, look instead at the exact domain (including subdomain tricks and lookalike spellings), whether the site asks for credentials it should not need, and whether the user arrived via an unsolicited link. Choose answers that verify the domain independently rather than trusting the padlock.
Answering malware questions with 'run a full antivirus scan and continue working', treating signature-based scanning as sufficient against ransomware and fileless or novel malware.
Antivirus is the most familiar control, so it becomes the default answer for every malware scenario. Candidates underestimate polymorphic malware and the speed of ransomware encryption.
What to do instead
Match the control to the threat stage. For prevention, emphasise patching, least privilege, disabling macros and unverified attachments, and email filtering. For suspected active ransomware, the priority is isolating the device from the network immediately, preserving evidence, and reporting, not scanning while files continue to encrypt. For unknown malware, note that signature scanning alone is insufficient and behaviour-based detection plus isolation is required.
Treating data classification and handling as one step, so candidates label data 'confidential' and then answer that any storage location or any recipient is acceptable, or conversely refuse to share data that policy permits.
Classification labels feel like the end of the task, and the handling rules attached to each label (storage, transmission, sharing, retention, destruction) are the part candidates skip.
What to do instead
Learn classification as label plus rules. For each level, know the minimum handling: approved storage, encryption in transit and at rest for sensitive data, need-to-know sharing, and secure destruction. In scenarios, first classify the data, then apply the handling rule for that class, and choose the option that satisfies both. Also check privacy principles such as collecting only what is needed and keeping it only as long as required.
Answering physical security and emergency scenarios with the most dramatic action (tackle the intruder, evacuate immediately, confront the person) instead of the prescribed safe behaviour such as not confronting, moving to safety, and notifying the right authority.
Candidates reason from instinct and heroism rather than from organisational procedure, and the exam rewards procedure and personal safety over intervention.
What to do instead
Adopt a standing rule: employees do not confront or detain; they observe, note details safely, and report to security or emergency services. For fire or evacuation, follow designated routes and marshals, do not use lifts, and do not re-enter. For tailgating, verify and challenge politely or report. For lost devices or badges, report immediately so access can be revoked. Choose the option that protects people first and escalates through the correct channel.
Delaying incident reporting to investigate personally or to confirm the problem first, and selecting 'try to fix it yourself before telling anyone' as the correct response.
Candidates want to avoid false alarms and feel responsible for resolving issues, so they undervalue speed of reporting and the evidence-preservation requirement.
What to do instead
Treat early reporting as the default correct action in incident scenarios. Report suspected incidents immediately to the designated contact, do not attempt independent remediation on shared systems, and preserve logs and state rather than deleting or rebooting to 'clean up' unless instructed. When an option combines prompt reporting with preserving evidence and following the responder's instructions, that is almost always the intended answer.
Mixing up the roles of backup, business continuity, and disaster recovery, and choosing 'we have backups' as a complete answer for continuity, or assuming a backup is valid without ever testing restoration.
The three terms are used loosely in everyday speech, and candidates treat a backup as proof of resilience. Backups restore data; continuity keeps critical functions running; recovery returns to normal operation, and an untested backup is unproven.
What to do instead
Learn the one-line distinction and apply it: backup equals copies of data; business continuity equals keeping essential services running during disruption; disaster recovery equals restoring systems afterwards. For any scenario, ask which objective is stated. Also remember that recovery time and recovery point objectives set the requirement, and that restoration must be tested regularly, stored offline or immutably against ransomware, and kept separate from the production environment.