CSAT (USAF Cyber Test) common mistakes
CSAT (USAF Cyber Test) · Understand the traps and how to avoid them.
Computing usable hosts in a subnet as 2^n (e.g., answering 32 for a /27) and placing the broadcast address inside the usable range instead of one below the next subnet boundary.
Candidates memorize '2^n minus 2' as a phrase but never convert it into a written procedure, so under time pressure the subtraction and the address arithmetic silently drop out of the mental shortcut.
What to do instead
Before answering, write the block-size table for the mask (256 - mask octet), list network / first host / last host / broadcast on paper, and only then read the answer choices. Count usable = block size - 2 as a separate, explicit step.
Assigning devices and protocols to the wrong OSI layer - placing TLS at Layer 4, a switch at Layer 3, or ARP at Layer 3 - when the question asks for the layer of a named technology.
Layer names are learned as a rhyme rather than as an encapsulation model, so candidates classify by 'feels like transport' instead of asking what header the item lives in.
What to do instead
Classify by header/PDU: if it is encapsulated inside TCP/UDP payload it is Layer 5-7; if it is an address-and-forwarding decision it is Layer 3; if it is a frame with MAC addresses it is Layer 2. Write the header chain for the specific item before selecting.
Translating a permission string such as -rw-r--r-- into the wrong octal value, or reversing owner/group/other positions, so 644 is reported as 664 or 755.
Candidates read the string left to right quickly and treat the file-type character as part of the first triad, shifting every position by one.
What to do instead
Cross out the leading type character first, then chunk the remaining nine characters into three groups and score each group 4-2-1 out loud (read=4, write=2, execute=1) before converting to octal.
Choosing a command from the wrong operating system family - answering ipconfig for a Linux question, or ls -l for a Windows question - because only the tool's purpose was memorized, not its platform.
Study lists group commands by function ('show IP configuration') rather than by shell, so the platform label is never encoded with the command.
What to do instead
Maintain a two-column flashcard per function (Linux | Windows PowerShell/cmd) and, during the exam, say the platform name in the question stem out loud before choosing. Treat any command not yet matched to a platform as unknown rather than guessing.
Tracing a loop or recursive call from memory and reporting the value after the loop ends, producing an off-by-one answer (e.g., counting iterations as n instead of n+1).
The code is read like prose; the brain predicts the outcome from the pattern instead of executing each pass, so boundary conditions that only appear on the first or last iteration are never evaluated.
What to do instead
Build a trace table with one column per variable and one row per iteration, including the iteration that fails the loop test. Do not write the final answer until the table shows the exit condition being evaluated.
Treating 1111 1111 as -127 in 8-bit signed notation, or negating a two's complement value by flipping bits without adding one.
The sign bit is noticed but the 'invert and add one' procedure is half-remembered, and range symmetry (-128 to +127) is assumed to be symmetric around zero.
What to do instead
For every negative value, perform the documented operation explicitly: write the magnitude in binary, invert all bits, add 1, then read the result. Memorize the asymmetric endpoints -128 and +127 and use them to sanity-check the answer.
Converting a size or rate between bits and bytes with the wrong multiplier - treating a 100 Mbps link as 100 MB/s, or a 'MB' as 1000 bytes when the question uses binary prefixes.
The words 'mega' and 'byte' are read as synonyms of 'megabit' under time pressure, and the decimal/binary prefix distinction is treated as trivia rather than as part of the unit.
What to do instead
Rewrite every quantity into base units before computing: expand Mbps to bits per second, expand MB to bytes, insert the x8 or /8 conversion as its own labelled line, then do the division. State which prefix convention (1000 vs 1024) the question implies.
Answering 'authentication' for a scenario about permission levels, or swapping vulnerability, threat, and risk when asked to classify a described situation.
The terms are absorbed as a vocabulary cluster rather than as distinct questions, so the closest-sounding word wins instead of the one matching the scenario's actual subject.
What to do instead
Before selecting, restate the scenario in one sentence using the test questions: 'Who are you?' (authentication), 'What may you do?' (authorization), 'What weakness exists?' (vulnerability), 'Who could act on it?' (threat), 'What is the combined likelihood and impact?' (risk).
Claiming a hash provides confidentiality, or stating that asymmetric cryptography is used to encrypt bulk data, when the question tests what each primitive does.
Hashing, encoding, and encryption are all taught as 'scrambling data', so candidates map them by surface similarity rather than by purpose, reversibility, and key count.
What to do instead
Run each option through three questions: is it reversible? how many keys, and are they the same? does it provide confidentiality, integrity, or both? Only the primitive passing all three tests matching the scenario may be selected.
Ordering or labelling cyberspace operations incorrectly - placing a phase such as weaponization or command-and-control after exploitation, or calling a defensive hunt operation 'offensive' because it uses attacker tools.
The doctrine is memorized as an unordered list of impressive-sounding phases, and offensive/defensive is judged by the tool used rather than by authorization and objective.
What to do instead
Write the phase sequence from memory in order before evaluating options, and classify an operation by its authorized objective and the network it acts upon, not by the technique employed. Any option that breaks the memorized order is eliminated first.
Filtering aggregated results with WHERE instead of HAVING, or assuming a join returns one row per left-side row when it actually fans out on a one-to-many relationship.
SQL is read in execution order (as written) rather than logical order, and row-count questions are answered from the table's primary key instead of from the join's cardinality.
What to do instead
Annotate each query with its logical execution order (FROM, WHERE, GROUP BY, HAVING, SELECT) and mark whether the filter applies to rows or to groups. For join questions, write the cardinality of the relationship (1:1, 1:N, N:M) beside each table pair before counting rows.
Treating 'some A are B' as 'all A are B', or affirming the consequent by concluding the antecedent from a true conditional's consequent.
Everyday reading habits import quantity assumptions that formal logic forbids, and the conditional is evaluated by matching keywords rather than by checking the contrapositive.
What to do instead
Rewrite each conditional in contrapositive form (if not Q then not P) and test whether the conclusion still follows; draw the 'some' statements as overlapping but non-contained regions. Reject any option that requires a quantity word stronger than the one given.