Ruankao Information System Operations Administrator (Junior) common mistakes
Ruankao Information System Operations Administrator (Junior) · Understand the traps and how to avoid them.
When a question describes a server that is slow or unreachable, the candidate immediately picks a single remedy (for example 'restart the service' or 'replace the hard disk') instead of first locating the faulty layer using a structured order such as hardware, operating system, network, application.
The exam wording often lists several plausible symptoms, and the candidate answers from personal experience with a similar past incident rather than from the evidence in the question. This leads to skipping the isolation step that the examiner is testing.
What to do instead
Before reading the answer options, write down the symptom, the affected scope (one host, one subnet, all users), and the most recent change. Then eliminate options that cannot explain the stated scope. Choose the option that is a diagnostic step or that addresses the confirmed layer, not the option that is merely a familiar repair action.
The candidate confuses backup types: they treat a differential backup as if it captured only changes since the last differential, or they assume an incremental backup can be restored alone without the full backup and the earlier incrementals.
The terms sound similar and the difference is one word ('since the last full' versus 'since the last backup of any type'). Under time pressure the candidate pattern-matches on the word 'incremental' and ignores the restore chain.
What to do instead
Memorise the restore chain as a picture: full, then each incremental in order, versus full plus the latest differential. For every backup question, first identify what the scenario needs (fastest restore, least storage, smallest backup window), then map that requirement to the backup type. Practise tracing a restore sequence for a given schedule.
The candidate answers permission and access-control questions using the highest privilege they know (grant administrator or root) rather than the least privilege that satisfies the stated job function, and they forget that group membership and inherited permissions change the effective result.
In real work, granting broad rights is the quickest way to unblock a user, so the habit carries into the exam. Questions about shared folders and role changes are also designed so that the obvious answer grants too much.
What to do instead
For every permission scenario, state the user's task in one sentence, then select the minimum right that allows exactly that task. Check the effective permission by combining direct assignment, group membership, inheritance, and explicit deny (deny usually wins). Reject any option that grants more than the task requires, even if it would work.
The candidate mixes up incident, problem, and change management, for example logging a recurring root-cause investigation as an incident, or treating an urgent fix as needing no change record at all.
The three processes overlap in daily practice and the exam uses short scenarios where the same event can be described from several angles. Candidates answer by what they would do first rather than by which process owns the record.
What to do instead
Anchor each process to its goal and output: incident restores service quickly (output: service restored, incident record), problem removes the root cause (output: known error, permanent fix), change controls risk of modification (output: approved, tested, scheduled change with rollback). Read the question for the words 'restore', 'root cause', or 'modify', and pick the process that matches that goal. Remember that emergency changes still require retrospective authorisation and a record.
The candidate calculates RAID capacity, availability, or fault tolerance incorrectly, for example assuming RAID 5 survives two simultaneous disk failures, or confusing RAID 1 mirroring with RAID 0 striping when asked about performance and redundancy trade-offs.
RAID levels are learned as a table of numbers and candidates memorise labels without the underlying rule of parity versus mirroring. Exam questions then test a failure scenario rather than a definition.
What to do instead
Learn three facts per level: minimum disks, how data and redundancy are stored, and how many disk failures it tolerates. RAID 0 tolerates none, RAID 1 and RAID 10 tolerate one per mirror, RAID 5 tolerates one, RAID 6 tolerates two. Practise computing usable capacity for a given disk count and size, and always state the rebuild risk after a single failure in RAID 5.
The candidate answers security-incident questions by jumping to containment or reinstallation before preserving evidence, or by notifying all staff and the public before the scope is confirmed, and they omit the reporting and review steps after recovery.
The instinct to stop the damage immediately feels correct, and the exam deliberately offers 'shut down the server' or 'format and rebuild' as attractive first options. Candidates also forget that legal and regulatory reporting may be time-bound.
What to do instead
Use a fixed order for incident handling: detect and confirm, contain while preserving logs and disk images, eradicate, recover from clean backups, then review and report. Eliminate any option that destroys evidence or that discloses details before containment. Check whether the scenario mentions personal data, because that triggers notification duties under the relevant law.
The candidate treats a backup as proven once the job reports success, and answers disaster-recovery questions without distinguishing recovery point objective from recovery time objective or without checking that the restore was actually tested.
Job-success messages are visible and reassuring, while restore testing is slow and rarely done. Exam items exploit this by describing a successful nightly backup that turns out to be unusable.
What to do instead
For any backup or DR question, ask three questions: what data loss is acceptable (RPO), how long may the service be down (RTO), and when was the last successful test restore. Prefer options that include periodic restore drills, offsite or offline copies, and verification of backup integrity. Reject options that rely only on the backup log.
The candidate answers cabling, power, and environment questions from vague memory, for example confusing twisted-pair categories and distance limits, mixing up single-mode and multimode fibre, or ignoring UPS load, grounding, and temperature and humidity limits in a server room.
These topics look like simple facts, so candidates skim them during revision, and the numbers (100 m, categories, humidity ranges) blur together under exam pressure.
What to do instead
Build a small reference card: copper twisted pair limited to about 100 m per run with category determining speed, fibre for longer distances and electromagnetic interference, UPS sized to actual load with runtime tested, server room kept cool and within the humidity range that avoids static and condensation. For each environment scenario, identify which physical factor changed and choose the option that addresses it.
The candidate ignores the documentation, standards, and legal dimension, choosing a technically effective action that breaches record-keeping, change approval, or personal-data protection requirements, or that fails to produce the operations log the question implies.
Technical candidates focus on the system and treat paperwork as optional. Exam items often add one line about an audit, a regulation, or a handover, and the candidate skips it while reading the scenario.
What to do instead
Scan each scenario for words such as audit, regulation, personal data, handover, or record, and treat them as constraints on the answer. Prefer options that keep an accurate operations record, follow the approved procedure, and limit collection and disclosure of personal data. When two options are technically equal, choose the one that is documented and authorised.
The candidate spends too long on calculation-heavy or unfamiliar items and leaves case-based comprehensive questions unanswered, or changes correct first answers on a whim without new evidence from the question.
The comprehensive items at the end combine several domains and read as long, so they are deferred, and time runs out. Anxiety near the end also prompts second-guessing.
What to do instead
Do a first pass answering every item you can settle quickly, flag the rest, and return to them. For long case questions, extract the facts into a short list before reading the options, and change an answer only when you can point to a specific phrase in the question that contradicts your first choice. Reserve the final minutes for flagged items rather than re-reading settled ones.