EPSO IT/ICT common mistakes
EPSO IT/ICT · Understand the traps and how to avoid them.
Calling a correct per-node average proof that real latency targets will be met.
The isolated property does not establish the complete actual configuration, authority, evidence or outcome.
What to do instead
State the simplified assumptions and seek actual capacity and performance evidence.
Converting between binary, decimal, and hexadecimal by treating the digits as ordinary base-10 place values, for example writing 0.1 decimal as 0.0001 binary or translating 2 KB as 2000 bytes without noticing the prefix convention the question uses.
Candidates memorize '1 KB = 1024 bytes' from consumer packaging and never build a positional-value model, so digit-by-digit conversion feels like a copying exercise rather than a weighted sum.
What to do instead
Convert by explicit place-value expansion: write each bit's weight (128, 64, 32, 16, 8, 4, 2, 1) above the digit, circle the powers that sum to the target, and group bits in fours for hex. State whether the stem uses SI or binary prefixes before computing.
Ordering the memory hierarchy by capacity instead of by proximity to the CPU, or explaining cache as 'extra RAM' that stores whole programs, so questions about locality, hit rate, or why a loop over a large array runs slowly get answered with speed-of-RAM claims.
The slogan 'cache is fast memory' is recalled in isolation, without a mental picture linking registers, L1, L2, L3, RAM, and disk along shared axes of latency, size, cost, and volatility.
What to do instead
Draw the hierarchy once as a ladder from registers to disk and label each rung with typical latency and typical size. Then rehearse locality: explain why the same loop is faster after a warm-up pass and why row-major traversal of a 2-D array beats column-major.
Mixing up pre-increment and post-increment, or assuming left-to-right evaluation of function arguments, in code-tracing questions.
Candidates read expressions as mathematical notation rather than as sequenced side effects, and evaluation order of arguments is often unspecified in the language being tested.
What to do instead
Separate side effects into individual statements and trace the specified language and version. Distinguish a permitted but unspecified order from undefined behavior caused by conflicting unsequenced accesses. A compiler run is an observation, not proof that an undefined expression has a guaranteed result. Avoid using such an expression as a numeric-output exercise.
Writing pseudocode or a code fragment that ignores the stated input constraints, such as assuming nonempty input or using a sentinel loop that fails on the first element.
Candidates focus on the happy path and do not test their written answer against boundary cases before moving on.
What to do instead
Before finalizing any constructed response, run three cases mentally: empty or zero input, a single element, and a duplicate or maximum value. Adjust the loop bounds and initializations so each case is handled, and state the assumption explicitly if the problem permits it.
Filtering grouped results in a WHERE clause (for example WHERE COUNT(*) > 5), comparing a column to NULL with = instead of IS NULL, or assuming UNION and JOIN do the same thing when combining two tables.
WHERE is encountered first in every tutorial and gets generalized to all filtering, and NULL is treated as an ordinary value rather than as unknown, which produces wrong intuitions about three-valued logic.
What to do instead
Classify every filter before writing it: row-level predicates go in WHERE, group-level predicates go in HAVING, and any NULL test uses IS NULL or IS NOT NULL. Sketch the result table for JOIN (horizontal, matched columns) versus UNION (vertical, matching schemas) to fix the distinction.
Declaring a table well designed because it 'looks organized', while leaving a transitive dependency such as storing instructor name and office in a course-enrollment table, or designating a foreign key as the primary key without checking uniqueness.
Spreadsheet intuition treats any tidy grid as normalized, and the candidate checks only that a key exists rather than testing candidate keys against every functional dependency the scenario implies.
What to do instead
List the functional dependencies in plain sentences ('each course has one instructor, and each instructor has one office') before any table is drawn. Place every determinant on the left, split off any non-key dependency into its own relation, and verify that each relation's chosen key uniquely determines all its other attributes.
Choosing the answer that describes the 'best practice' control rather than the answer that reflects what the business has decided it can tolerate.
Candidates transfer an audit or security-engineering mindset into CRISC, where the risk practitioner's job is to inform and enable a business decision, not to impose the safest option. Options containing words like 'eliminate', 'ensure', 'mandate', or 'all risk is avoided' feel rigorous but are usually wrong.
What to do instead
Before answering, classify the question: is it asking what the risk practitioner should DO next, or what the business should DECIDE? If the stem involves tolerance, appetite, or trade-offs, eliminate any option that removes the business's choice and prefer the option that quantifies, communicates, and escalates.
Jumping to a response (mitigate, transfer, avoid, accept) before establishing or confirming the risk context and performing the assessment.
Experienced practitioners recognise the response immediately in the scenario and answer it, skipping the earlier step the question actually asks about. CRISC questions are sequence-sensitive; the 'next' step is almost always the earliest incomplete step in the risk process.
What to do instead
Apply a fixed sequence check on every stem: identify/context, then analyse/assess, then evaluate against appetite, then respond, then monitor and report. Ask 'what has explicitly already happened in this stem?' and select the first action that comes after it.
Choosing quantitative risk analysis over qualitative without testing whether the data needed for quantification exists or whether the decision requires it.
Quantification is presented as more mature, so candidates assume it is always the better answer. In practice, forcing quantification on sparse or unreliable data produces false precision and is a poor recommendation.
What to do instead
Ask what data is available and what decision is being made. If the stem shows missing historical data, a novel risk, or a fast screening decision, select qualitative or semi-quantitative; select quantitative when reliable loss data or actuarial input exists and the decision involves material financial trade-offs.
Confusing authentication with authorisation and assigning the wrong control to a scenario, for example answering 'multi-factor authentication' when the question is about limiting what a logged-in user can reach.
Both live in the same identity domain and both are described with similar vocabulary (access, permissions, credentials), so candidates pattern-match on 'access' and pick the wrong half of the pair.
What to do instead
Distinguish identity verification from the authorization decision for the actual request. Some resources allow unauthenticated public access, and authorization can be checked repeatedly during a session. Roles and permissions concern allowed actions rather than merely proving who supplied a credential.
Treating symmetric and asymmetric keys as interchangeable and choosing the wrong key for a task, such as using a public key to decrypt a password vault or a private key to encrypt bulk data.
The key pair vocabulary is learned as a pair of words rather than as a workflow, so candidates cannot reconstruct who holds which key and what each operation achieves.
What to do instead
Draw the two-party diagram once from memory: sender encrypts with the recipient's public key, recipient decrypts with their own private key; sender signs with their own private key, verifier checks with the sender's public key. Rehearse it until you can derive any key question from the diagram rather than recall.