DSST MIS common mistakes
DSST MIS · Understand the traps and how to avoid them.
Treating bandwidth and latency as the same constraint, so the candidate picks the option with the highest throughput when the scenario describes an interactive application that feels slow.
Both are described as 'speed' in casual usage, and study guides often list them side by side without separating capacity from delay. The candidate then maps 'faster network' to 'more bandwidth' reflexively.
What to do instead
Before answering any performance question, write two columns: capacity (bits per second, total volume) and delay (per-packet latency, round-trip time, jitter). Ask which symptom the scenario reports. A page that loads but responds sluggishly to each keystroke is a latency problem; a large file transfer that takes hours is a bandwidth problem. Choose the remedy that matches the symptom, and reject options that add capacity to fix delay.
Confusing the OSI layers when locating a device or protocol, for example placing a switch at Layer 3, a router at Layer 2, or a firewall only at Layer 7.
The layers are memorized as a list rather than as a model of what each layer's data unit and addressing scheme are. Candidates also conflate 'works at a layer' with 'reads headers from that layer'.
What to do instead
Anchor each layer to its address or data unit: Layer 2 uses MAC addresses and frames, Layer 3 uses IP addresses and packets, Layer 4 uses port numbers and segments. Then classify devices by the header they use to forward: a switch forwards on MAC, a router on IP, a Layer 4 load balancer on port. When an option names a device, ask which header it must read to do its job.
Choosing symmetric encryption for a scenario that requires non-repudiation or key exchange between strangers, or choosing asymmetric encryption for bulk data transfer.
Candidates learn 'symmetric is fast, asymmetric is slow' as trivia but do not connect it to the properties each provides. Non-repudiation and digital signatures are properties of asymmetric keys, and that link is often missed under time pressure.
What to do instead
Build a two-row decision table: symmetric gives confidentiality and speed but cannot prove origin; asymmetric gives key exchange, signatures, and non-repudiation but is slow. For any scenario, ask (a) is the data volume large, and (b) must the receiver prove who sent it. Large volume implies symmetric for the payload; proof of origin implies asymmetric for the signature or key exchange. Most real designs combine both, so prefer the hybrid answer when offered.
Treating authentication and authorization as interchangeable, so the candidate selects 'require a password' or 'add multifactor login' for a question about limiting what a logged-in user can access.
Both are abbreviated as 'auth' in notes, and access-control questions often mention login as background detail, which pulls attention toward authentication.
What to do instead
Translate the question into a sentence: 'Who are you?' is authentication; 'What may you do?' is authorization. If the scenario describes an insider seeing records outside their department, the fix is role-based access control, least privilege, or segregation of duties, not stronger login. Only choose authentication controls when the scenario describes impersonation, stolen credentials, or unverified identity.
Drawing or reading a data flow diagram with control logic, decision diamonds, or timing on it, or mixing context-level and level-1 processes in one diagram.
Flowcharts are taught earlier and are more familiar, so candidates default to them. Diagram-leveling rules are also easy to state but rarely practiced, so the candidate does not notice the inconsistency.
What to do instead
Memorize the three DFD primitives: external entity, process, and data store, plus data flows between them. There are no decision symbols, no loops, and no sequence in a DFD. For leveling, check that every flow crossing the context boundary reappears at level 1 and that each parent process's inputs and outputs are conserved by its children. If an option contains a diamond or a branch, eliminate it immediately.
Skipping requirements validation and moving straight from elicitation to design, then choosing 'build a prototype' as the answer to a question about ambiguous or conflicting stakeholder requirements.
Prototyping is the most memorable technique and sounds concrete. Candidates also assume that gathering more requirements is always the fix, even when the problem is that existing requirements were never confirmed with stakeholders.
What to do instead
Separate the requirements activities: elicitation (gather), analysis (model and reconcile conflicts), validation (confirm with stakeholders that the requirement is correct and complete), and verification (confirm the design meets it). Read the scenario for the word 'conflict' or 'disagreement' - that signals analysis and negotiation, not more data collection. Reserve prototyping for unclear or unstable requirements where users cannot articulate needs.
Answering cost-benefit questions by picking the option with the highest total benefit or the lowest total cost, ignoring the time value of money and the payback period.
Candidates without finance background read 'benefit' as a single number and do not convert future cash flows to present value. The discount rate and the year of each cash flow are easy to skim past.
What to do instead
For every investment option, list the cash flow by year, then discount each year's amount before comparing. Higher nominal benefit spread over many years can lose to a smaller near-term benefit. Also check payback period and break-even year separately, since a project can have the best net present value and still be rejected for exceeding a required payback horizon. When the question supplies a discount rate, you must use it.
Treating explicit knowledge and tacit knowledge as synonyms, so the candidate proposes a document repository as the fix for a problem about expertise that lives only in experienced employees' heads.
Both are called 'knowledge' and most workplace systems store documents, so the default answer is a database. The distinction between codified and personal knowledge is stated once in most texts and then dropped.
What to do instead
Classify the asset first: if it can be written down and reused (procedures, manuals, records), it is explicit and a repository or wiki fits. If it is judgment, skill, or context held by a person, it is tacit and requires transfer mechanisms such as mentoring, communities of practice, apprenticeships, or after-action reviews. Choose the mechanism that matches the knowledge type, not the one that sounds most technical.
Confusing a data warehouse with a transaction system, or confusing a data mart with a warehouse, when answering architecture questions about subject orientation, integration, and time variance.
Both store data in tables and are queried with SQL, so the structural difference is invisible unless the candidate applies the defining properties. The terms 'mart' and 'warehouse' also sound like size labels rather than scope labels.
What to do instead
Test each option against the four warehouse properties: subject-oriented, integrated, nonvolatile, and time-variant. Operational systems are organized by function and are updated in place; warehouses are organized by subject and hold historical snapshots. A data mart is a subset scoped to one department or subject, and it can be dependent (fed from the warehouse) or independent. If the scenario mentions cleaning and reconciling sources from multiple systems, the answer is the warehouse, not the source system.
Selecting a supervised classification technique for a question whose real task is finding unknown groupings, or claiming a model is validated by the same data used to train it.
Classification is the most familiar technique, and 'prediction' sounds like the goal of every analytics project. Candidates also miss the train/test separation because it is procedural rather than conceptual.
What to do instead
Name the task before looking at the options: predicting a known label is classification, predicting a number is regression, finding natural groups without labels is clustering, finding co-occurring items is association rules. Then check validation: a model evaluated on its training data is overfit, so look for a held-out test set or cross-validation. If the scenario says 'no predefined categories' or 'discover segments', clustering is the answer.