Ruankao Information System Management Engineer (Intermediate) common mistakes
Ruankao Information System Management Engineer (Intermediate) · Understand the traps and how to avoid them.
Declaring a problem permanently eliminated because a temporary workaround restored service.
A local observation or language feature does not establish the wider state, timing or end-to-end guarantee required by the scenario.
What to do instead
Record restoration separately from the underlying cause, retain configuration/change evidence and assign follow-up ownership with a checked improvement.
Answering incident response questions with the containment step when the stem describes detection, triage, or evidence preservation, and skipping the ordering of the response phases.
Containment feels like the most decisive action, and candidates have not internalised that the phases are sequential and that premature containment can destroy forensic evidence.
What to do instead
Identify the action and the framework specified in the scenario. Detection, analysis, containment, evidence collection and recovery can overlap under urgency; preserve safety and authority while following the applicable playbook. Do not infer one universally correct action solely from the presence of a word such as logs.
Equating every TLB miss with a disk-backed page fault.
The shortcut substitutes a label for the actual mapping, system state or measurable requirement, so it can select a technically inappropriate remedy.
What to do instead
Track translation-cache lookup separately from page-table residency and protection. A TLB miss can resolve to a valid resident page, while a fault may indicate permission rather than a missing disk page.
When a subnetting question gives a host address and prefix (e.g., 192.168.10.130/26), the candidate computes the network address by copying the first three octets and zeroing the last, ignoring that the /26 boundary falls inside the last octet.
Most practice happens on /24 boundaries, so the habit of 'first three octets = network' becomes automatic. Under exam time pressure the candidate does not convert the prefix to a mask or find the block size, and never verifies the result by checking that the network address is a multiple of the block size.
What to do instead
For a stated ordinary /25 through /30 subnet within one last octet, calculate block size as2^(32−prefix), find the containing boundary and derive network, host range and broadcast. For other prefixes operate on the full32-bit address; do not reuse an octet shortcut outside its assumptions.
The candidate answers routing questions by naming a protocol (RIP, OSPF, BGP) without stating whether it is distance-vector or link-state, what metric it uses, whether it is interior or exterior, and which transport/port it runs over, so answers are too vague to earn marks.
Study is done by memorizing protocol names and default administrative distances rather than building a comparison table. The candidate recognizes the term in the stem and stops reading, missing the qualifier such as 'converges fastest' or 'used between autonomous systems'.
What to do instead
Build a one-page comparison table with columns: type, metric, algorithm, transport/port, multicast address, convergence, scope, max hop count. Fill it from first principles (RIP = hop count, 15 max, UDP 520; OSPF = cost, IP protocol 89, 224.0.0.5/6; BGP = path attributes, TCP 179). Rehearse explaining each row aloud in one sentence.
The candidate spends too long on calculation-heavy items (subnetting, throughput, error-detection or encoding arithmetic) and leaves later items unanswered, or changes correct answers during a rushed final review.
Calculation items feel productive, so the candidate keeps reworking them to be sure. There is no time budget per item and no rule for when to abandon a question and mark it for return.
What to do instead
Set a per-item budget in advance (for example, one minute average, two minutes maximum on calculations), mark and skip anything exceeding it, and reserve the last ten minutes for unanswered items only. During review, change an answer only when you can name the specific error in the original reasoning.
Answering an impacts-of-computing prompt with a slogan, such as 'automation causes job loss' or 'algorithms are biased', without naming the mechanism, the affected group, or a plausible mitigation, and confusing patents, copyrights, and trademarks in intellectual-property items.
These questions read as opinion rather than analysis, so candidates write the first socially acceptable claim instead of constructing a cause-and-effect chain, and the three IP regimes blur together as 'legal protection'.
What to do instead
Use a fixed three-part structure: mechanism (what the system does), affected party (who bears the cost or benefit), and mitigation (policy, design, or access remedy). For IP, key on the object protected (invention, expression, brand identifier) rather than on the duration.
Using 'encryption' and 'hashing' as synonyms, calling a salted hash reversible, or treating authentication and authorization as the same check, so a question about password storage or access control is answered with the wrong primitive.
Both techniques transform data into an unreadable-looking string, and the candidate has memorized the word 'secure' instead of the direction of the mapping: encryption is reversible with a key, hashing is one-way.
What to do instead
Sort every scenario into a table with columns for reversible, key required, and purpose. Passwords are salted and hashed slowly; stored files are encrypted symmetrically; keys are exchanged asymmetrically. Then separate the two access questions: who are you (authentication) versus what may you do (authorization).
Treating the CIA triad as three interchangeable words and answering 'confidentiality' for any control that involves encryption or passwords, even when the scenario is about data being altered in transit or a system being unavailable.
Candidates memorise the acronym but never attach a decision test to each leg, so under time pressure they match on the surface keyword (encryption, password) rather than on the security property the scenario actually describes.
What to do instead
Before answering, write one line: what is the harm in the scenario - someone reading it (confidentiality), someone changing it (integrity), or nobody being able to use it (availability)? Then pick the control that addresses that harm. Practise with mixed scenarios where a hash protects integrity, a backup protects availability, and encryption protects confidentiality.
Classifying every privacy or data-handling question as a compliance question and citing a law, when the question is actually asking which security objective or control class applies.
Law and regulation content is memorable and heavily emphasised in study material, so candidates over-apply it and stop reading the actual stem, which may be about least privilege or data minimisation as a design principle.
What to do instead
Read the stem's final clause first to identify what is being asked (a principle, a control, a legal obligation, or a role). Only invoke a specific law when the stem names a jurisdiction, a data subject right, or a breach notification timeline.
Treating risk appetite, risk tolerance, risk capacity, and risk threshold as interchangeable terms.
The vocabulary is similar in ordinary usage, and many study resources use them loosely. Exam items discriminate precisely: appetite is the amount of risk the organisation is willing to pursue, tolerance is the acceptable variation around a target or limit, capacity is the maximum it could withstand, and thresholds are the concrete trigger points.
What to do instead
Memorise one-line operational definitions and a distinguishing example for each. When two options both sound right, choose the one that matches the specific term used in the stem rather than a neighbouring concept.
Confusing risk treatment ownership with risk ownership: assuming the risk practitioner owns, and is accountable for, the identified risk.
The practitioner facilitates the process; the business process or asset owner owns the risk and the treatment decision. Candidates with a controls or compliance background default to the practitioner being accountable, which leads to wrong answers about who accepts residual risk.
What to do instead
On any ownership or sign-off question, map roles explicitly: risk practitioner advises, monitors, and reports; the business owner owns and accepts; senior management sets appetite; the board provides oversight. Choose the option that places accountability with the business owner unless the stem says otherwise.