CNCDP common mistakes

Before answering, underline the requirement verb and the layer it implies (preventive, detective, corrective). For architecture items, prefer controls that eliminate the attack path (segmentation, least-privilege identity, egress filtering, deny-by-default) over monitoring add-ons, and be able to state the residual risk each design leaves.

Frame zero trust answers around policy enforcement points, per-request authentication and authorization, device posture, and logging of every decision. Explain how the design removes implicit trust from the internal network and how legacy or unmanaged assets are handled rather than assumed away.

Build a mental table: strategic intelligence informs risk and investment; operational informs campaign awareness; tactical maps to TTPs and ATT&CK techniques; technical covers indicators such as hashes and domains. Practice classifying a mixed list of artifacts and naming the decision each one can support, plus its shelf life.

For any scenario, ask whether the observable is disposable (IP, domain, hash) or durable (process lineage, command-line pattern, authentication anomaly). Answer with detection logic tied to behaviour and pair it with the ATT&CK technique it represents. Know that threat intelligence should feed hunting hypotheses, not just blocklists.

Rank by risk contextualized to the environment: exposure, data sensitivity, business function, threat activity against that product, and existing mitigations. Use CVSS as an input, not the decision. Be ready to explain why an authenticated scan differs from an unauthenticated one and what false negatives and false positives mean for prioritization.

Classify each finding by root cause: missing patch, misconfiguration, design weakness, or unsupported asset. Match the remediation type to the cause, and where patching is impossible, describe compensating controls, risk acceptance with sign-off, and a tracked remediation timeline. Know the difference between a vulnerability scan, a penetration test, and a configuration benchmark.

For every detection answer, state the log source and field-level logic, the ATT&CK technique covered, expected benign triggers, and the tuning approach. Practice mapping common techniques to the specific event IDs, audit policies, or sensor types that would surface them, and explain why a missing log source is itself a finding.

Follow the sequence: identification and scoping, containment (short-term then long-term), eradication, recovery, lessons learned. In scenario items, name the specific containment action (isolate host, disable account, block C2, segment network) and justify it against business impact. Confirm the initial access vector is closed before declaring recovery.

Drill the sequence: registers and cache, memory, network state and connections, running processes, disk, remote logs, archival media. For every forensic scenario, state the acquisition method (write blocker, hashing, memory capture tool), the documentation required at each transfer, and why integrity verification matters. Never analyze on the original evidence.

Structure hunt answers as: hypothesis (from threat intel or ATT&CK gap), data sources required, query or analytic logic, expected findings and false positives, and the outcome (new detection, tuning, or gap closure). Distinguish hunting from monitoring (reactive, known-bad) and from incident response (confirmed event).

Learn one-line purposes and scopes for the major frameworks and map them to question types: management system vs. control catalog vs. risk methodology vs. sector regulation. When an item names a business constraint (contractual, regulatory, certification), let that constraint select the framework rather than personal familiarity.

For every risk scenario, name the treatment, the residual risk after treatment, and the accountable owner (business owner, not the security team alone). Distinguish inherent from residual risk, and be clear that risk acceptance requires documented, authorized sign-off rather than silent inaction.