EXIN Information Security Essentials common mistakes
EXIN Information Security Essentials · Understand the traps and how to avoid them.
Treating 'information security' as a synonym for 'IT security' or 'cyber security', so that questions about paper documents, verbal disclosure, or physical media get answered with purely technical controls.
Candidates study the technology-flavoured material more heavily and internalise the colloquial usage of 'security' as a network and server topic, so they overlook that the exam's definition covers all information assets in any form.
What to do instead
Anchor on the triad plus the breadth of 'information asset': confidentiality, integrity and availability apply to printed files, conversations, and knowledge held by staff, not only to data in systems. When a scenario involves paper or speech, screen the answer options for organisational, procedural and physical controls before choosing a technical one.
Confusing risk with threat, vulnerability or impact, for example answering 'the threat is that the server is unpatched' or calling the loss of a customer database 'the risk' when the question asks for the vulnerability.
The four terms are used loosely in everyday speech and candidates rely on intuition rather than the formal relationships, so a single scenario produces different labels depending on which word appears first.
What to do instead
Memorise the chain as a sentence you can apply mechanically: a threat actor exploits a vulnerability, which creates a risk of an impact on an asset. Label each element in the scenario before reading the options, and remember risk combines likelihood and consequence, whereas a vulnerability is only a weakness.
Choosing the strongest-sounding control (full disk encryption, multi-factor authentication, blocking all USB ports) when the question asks for the most appropriate or proportionate measure for the stated risk.
Candidates equate 'most secure' with 'best answer' and forget that the exam rewards controls matched to identified risk, cost and usability.
What to do instead
Re-read the stem for the risk being described and the constraint (budget, usability, business need). Eliminate options that are disproportionate, that address a risk not mentioned, or that would break a stated business requirement; then pick the control that directly reduces the named risk.
Treating an information security policy as a technical configuration document and expecting it to specify firewall rules, password lengths or patch schedules, then rejecting the correct 'management commitment and direction' answer.
The word 'policy' is used in product documentation to mean settings, so candidates import that meaning and miss the governance layer the exam is testing.
What to do instead
Separate the document hierarchy explicitly: policy states management intent and mandatory principles; standards give specific measurable requirements; procedures describe step-by-step execution; guidelines are advisory. If the question mentions approval by senior management or scope across the whole organisation, it is policy-level.
Assigning all security responsibility to the security department or the IT team, and missing that the line manager, data owner, or every individual employee carries defined duties.
Candidates picture a dedicated security function and assume ownership sits there, so questions about who accepts residual risk or who classifies data get answered with 'the CISO' or 'IT'.
What to do instead
Learn the standard role split: senior management owns and approves policy and accepts residual risk; the data or asset owner decides classification and access; the custodian implements controls; users comply. When a scenario names a business unit or a manager, expect the answer to place accountability there rather than centrally.
Confusing authentication, authorisation and identification, for example calling a role assignment an authentication measure or treating a username as proof of identity.
The three happen in one login flow, so candidates remember the sequence as a single act and pick whichever term sounds most familiar.
What to do instead
Use the order identification (who are you claiming to be) then authentication (prove it) then authorisation (what may you do). Ask which step in that sequence the described control performs; a password check is authentication, a permission list is authorisation, and a user ID is identification.
Answering access-control questions with 'least privilege' or 'need to know' by reflex when the scenario is actually about segregation of duties, or vice versa.
Both are access principles and are often taught together, so candidates pattern-match on the phrase 'access' rather than on the specific failure described.
What to do instead
Discriminate by symptom: if one person can both commit and approve the same transaction, the answer is segregation of duties; if someone holds rights beyond their job, the answer is least privilege; if someone can read data unrelated to their task, the answer is need to know. Match the principle to the failure, not to the topic heading.
Treating physical and environmental controls as secondary and answering a question about a server room or an office with logical controls such as firewalls or intrusion detection.
Candidates prioritise the technical domain in revision time and skim the physical chapter, so they lack specific answers for fire suppression, humidity, clear desk or tailgating scenarios.
What to do instead
Build a short physical checklist you can recall quickly: siting and access zones, visitor escort and badges, locks and mantraps against tailgating, fire detection and suppression suitable for equipment, temperature and humidity control, power conditioning and backup, and clear desk and clear screen rules. When the scenario mentions a location or a person physically present, expect a physical answer.
Mixing up incident response and business continuity, for example proposing a business impact analysis as the first step in handling a live malware outbreak, or proposing malware containment as the response to a flooded data centre.
Both domains appear under 'what do we do when something goes wrong', and candidates do not separate the short-term containment goal from the longer-term restoration goal.
What to do instead
Sort by timescale and purpose: incident management detects, contains, eradicates and recovers from a specific event, and its first priority is limiting damage; business continuity keeps critical processes running during disruption using a BIA, RTO and RPO; disaster recovery restores the technical infrastructure. Identify whether the stem describes one event or an ongoing outage, then choose from that layer.
Answering compliance questions with the wrong instrument, for example citing ISO/IEC 27001 as a law, treating the GDPR as a voluntary standard, or claiming certification to a standard proves legal compliance.
Candidates group laws, standards and frameworks under 'rules' and remember names without their status, so they cannot tell which are mandatory, which are certifiable, and which are guidance.
What to do instead
Tag each instrument you revise with three attributes: mandatory or voluntary, certifiable or not, and who it applies to. Keep clear that legislation such as the GDPR or national data protection acts creates legal duties, ISO/IEC 27001 is a certifiable voluntary management-system standard, and frameworks such as ISO/IEC 27002 or NIST guidance provide control advice. Certification supports compliance but never replaces a legal obligation.