CCIS common mistakes
CCIS · Understand the traps and how to avoid them.
Treating governance documents as interchangeable - picking 'policy' when the stem describes a mandatory high-level statement of intent, or 'standard' when it describes a measurable minimum configuration.
Candidates memorize the four document types (policy, standard, procedure, guideline) as a list but never anchor them to who approves them and whether they are mandatory. Exam stems deliberately describe the artifact's function rather than naming it, so surface keyword matching fails.
What to do instead
Build a one-line decision rule for each: policy = management intent, mandatory, approved by senior leadership; standard = mandatory measurable requirement (e.g., 'TLS 1.2 minimum'); procedure = step-by-step how-to; guideline = recommended, optional. Practice by classifying 20 short scenarios and justifying each with the approval authority and the word 'mandatory'.
Answering data-classification and retention questions with the storage location or the encryption state instead of the data's sensitivity and the legal/regulatory obligation attached to it.
Cloud and storage terminology dominates study material, so candidates reach for 'encrypted at rest' or 'in the cloud' as if those were classification labels. Classification is about impact if disclosed, not about where the bytes live.
What to do instead
Before answering, ask two questions: what happens if this is disclosed (impact), and what obligation applies (contract, regulation, retention period). Eliminate any option that describes a control or a location rather than a sensitivity level or a retention rule.
Choosing 'block all traffic' or 'deny everything' as the fix for a segmentation or firewall question, rather than the least-privilege rule that permits the required business flow.
Security instinct pushes toward maximum restriction, and 'deny all' sounds like the safest answer. Exams test least privilege and business enablement, so the correct option usually allows a narrow, specific flow and denies the rest.
What to do instead
For every firewall/segmentation item, first identify the required business flow (source, destination, port, protocol). Then pick the option that permits exactly that and denies everything else. Treat any option that breaks the stated business function as wrong regardless of how secure it sounds.
Confusing the security function of a network device with its position - e.g., selecting a WAF as the control for outbound data loss, or an IDS as the control that blocks an attack.
Device names overlap in study guides and candidates remember 'WAF = web security' without remembering that a WAF inspects inbound HTTP requests, not outbound exfiltration, and that an IDS detects while an IPS prevents.
What to do instead
Make a two-column table: device, and the single sentence 'it inspects X in direction Y and can/cannot block'. Drill the detect-vs-prevent distinction until it is automatic; any stem containing 'blocked' or 'prevented' should eliminate IDS and passive monitoring options immediately.
Defaulting to MFA as the answer for every identity question, including authorization, session-management, and privileged-access scenarios where the actual gap is role design or session control.
MFA is the most repeated control in security training, so it becomes a reflex. Stems about 'user can see another department's records' or 'admin session left open' are authorization and session problems that MFA does not solve.
What to do instead
Classify the stem first: authentication (who are you), authorization (what may you do), or accounting (what did you do). Only authentication stems should surface MFA. For authorization stems, look for role-based access control, least privilege, or segregation-of-duties options.
Mixing up authentication factors by category - counting a password plus a security question as MFA, or a password plus a PIN as MFA.
Candidates count 'things the user does' as separate factors. Factors are knowledge, possession, and inherence; two knowledge items are still single-factor, and this is exactly the trap the exam sets.
What to do instead
Label every credential in the stem as knowledge, possession, or inherence before reading the options. MFA requires at least two different categories. Any option combining two knowledge items (password + security question, password + PIN) is single-factor and therefore wrong.
Answering endpoint questions with network controls (firewalls, IDS, segmentation) when the stem asks how to stop execution of malicious code on a host.
Controls overlap in real environments, so candidates pick the control they know best rather than the one scoped to the host. Endpoint questions test host-resident controls: application allowlisting, EDR, patching, and host hardening.
What to do instead
Ask 'where does this control run?' If the answer is not on the endpoint itself, eliminate it for endpoint-scoped stems. Memorize the host-resident set: allowlisting/denylisting, EDR/AV, patch management, host firewall, disk encryption, and configuration hardening.
Treating hashing and encryption as interchangeable - selecting a hash to protect data confidentiality, or selecting encryption to verify integrity.
Both transform data, and both appear in every cryptography primer, so candidates remember the mechanism but not the goal. The exam tests the goal: confidentiality versus integrity versus authenticity.
What to do instead
Attach one purpose to each primitive: symmetric encryption = confidentiality at scale; asymmetric = key exchange and signatures; hash = integrity fingerprint; HMAC = integrity plus authenticity with a shared key; digital signature = authenticity and non-repudiation. Read the stem for the goal word before evaluating options.
Jumping to eradication or recovery steps during an incident question before containment and evidence preservation are addressed.
Candidates want to 'fix it' and pick the remediation option because it feels productive. Incident-response questions score the ordered lifecycle, and the earliest correct action in most stems is containment or evidence capture.
What to do instead
Recite the lifecycle in order: preparation, detection/analysis, containment, eradication, recovery, lessons learned. For any 'what should be done FIRST' stem, scan for containment or preservation options before remediation options, and choose the earliest lifecycle phase that is still unmet.
Confusing qualitative and quantitative risk terms - using likelihood/impact ratings where the stem asks for a monetary value, or reporting ALE when the stem asks for the value of a single loss event.
The formulas look simple (SLE = asset value x exposure factor; ALE = SLE x annualized rate of occurrence), so candidates skim and substitute the wrong output. The trap is the unit: dollars per event versus dollars per year.
What to do instead
Write the units next to each term before computing: SLE is dollars per event, ARO is events per year, ALE is dollars per year. Check the stem's requested unit against your computed unit; if they differ, you used the wrong formula.