ICYB common mistakes
ICYB · Understand the traps and how to avoid them.
When asked to identify a control type, the candidate labels a control by the technology that implements it (e.g., calls a firewall a 'preventive control' only because it is a device) instead of classifying it on the correct axis: preventive/detective/corrective/compensating versus administrative/technical/physical.
Study material presents controls in lists by technology, so candidates memorize examples rather than the two independent classification axes. Under time pressure they collapse both axes into one label and pick the most familiar word.
What to do instead
Before answering, write the two axes explicitly. Ask 'what does it do?' (prevent, detect, correct, compensate) and separately 'how is it implemented?' (policy/training, technology, barrier/guard). Practice sorting ten controls into a 4x3 grid until the two questions are automatic.
The candidate treats 'risk' as synonymous with 'threat' or with 'vulnerability', so questions asking for the risk of a scenario get answered with the attacker's capability or the weakness itself rather than the combination of likelihood and impact against an asset.
Everyday usage blurs these terms, and exam stems often describe a threat actor in detail, which pulls attention toward the actor. Candidates then select the option naming the threat rather than the option describing exposure and consequence.
What to do instead
Rewrite each stem into the sentence 'Asset X is exposed to threat Y through vulnerability Z, producing likelihood L and impact I.' Eliminate any answer that names only one component. Memorize that risk = f(likelihood, impact) and that residual risk remains after controls.
On authentication questions the candidate selects the strongest-sounding factor (e.g., a long password, a security question, or a one-time code sent by SMS) as 'multi-factor' or as 'strongest', without checking whether the factors come from different categories (knowledge, possession, inherence) and whether the channel is resistant to interception.
Marketing language around MFA has trained people to treat any second step as strong. Candidates also count two knowledge factors as MFA because the login screen shows two prompts.
What to do instead
For every option, label the factor category. Reject any pair drawn from the same category. Then rank by phishing and interception resistance: hardware-bound credentials and passkeys above push approval, above TOTP, above SMS and email codes, above knowledge questions. Apply this ranking explicitly in the answer rationale.
The candidate confuses symmetric and asymmetric key usage in hybrid encryption and in digital signatures: they say the sender encrypts with the recipient's private key, or that a signature is verified with the signer's private key, or that TLS encrypts bulk data with RSA.
The words 'public' and 'private' are learned as a pair without attaching the direction of operation. Diagrams in study guides show arrows without stating who holds which key, so the candidate reconstructs the flow incorrectly under pressure.
What to do instead
Drill two fixed sentences until automatic: confidentiality means encrypt with the recipient's public key and decrypt with the recipient's private key; authenticity means sign with the sender's private key and verify with the sender's public key. Add that hybrid schemes use asymmetric operations only to establish or wrap a symmetric session key.
Asked to choose a control for a given data state, the candidate applies encryption at rest when the scenario describes data crossing an untrusted network, or applies TLS when the requirement is protecting a stolen disk, and does not distinguish hashing from encryption when the requirement is integrity or password storage.
The single word 'encryption' is used for all protective transformations. Candidates match on the keyword 'protect data' rather than on the state (in transit, at rest, in use) and the security goal (confidentiality versus integrity).
What to do instead
Parse each stem into two slots: data state and security goal. Map state to mechanism (in transit: TLS, IPsec, SSH; at rest: full-disk or database or object-store encryption with managed keys; in use: enclaves or memory protection). Map goal to primitive: confidentiality means encryption, integrity means hash or MAC, password verification means salted slow hash.
The candidate answers incident-response sequencing questions by jumping to eradication or recovery, or by starting containment before validation and scoping, and misplaces evidence preservation relative to containment actions.
Real-world instincts reward 'stop the bleeding' and 'fix it fast', and vendor tooling emphasizes remediation. Exam stems describe active damage, which reinforces the urge to skip identification and scoping steps.
What to do instead
Recite the lifecycle in order: preparation, detection and analysis, containment, eradication, recovery, lessons learned. For each scenario, name the current phase before reading options, and reject any option that destroys volatile evidence or contains a host without first confirming scope.
The candidate misreads log and alert data in monitoring questions, for example treating a high volume of failed logins as confirmed compromise, or treating a single successful login from a new country as benign, instead of weighing the sequence, source, timing, and correlation across sources.
Candidates evaluate each indicator in isolation and anchor on the first salient detail. They also lack a mental baseline of what normal looks like, so they cannot judge deviation.
What to do instead
Practice reading short log excerpts and writing a one-line narrative of the sequence before looking at the options. Ask three questions every time: what is the baseline, what deviates, and what corroborating source would confirm it. Prefer answers that correlate multiple sources over answers that act on a single event.
In secure-development questions the candidate picks input validation, WAF rules, or output encoding as a fix for injection and cross-site scripting without matching the control to the specific flaw, and treats a web application firewall as removing the vulnerability rather than reducing exploitability.
All these controls are taught together as 'web security', so they blur. Candidates also default to the perimeter control because it is the most familiar name in the list.
What to do instead
Build a flaw-to-fix table and memorize it: injection maps to parameterized queries plus server-side validation; cross-site scripting maps to contextual output encoding plus a restrictive content security policy; broken access control maps to server-side authorization checks on every request. State in the rationale that a WAF is compensating, not corrective.
On cloud and shared-responsibility questions the candidate assigns a control to the wrong party, for example assuming the provider secures identity configuration, patching inside customer workloads, or customer data classification, or assuming the provider's compliance certification transfers to the customer's application.
The boundary shifts by service model (infrastructure, platform, and software as a service), and candidates memorize a single split. Marketing material also implies 'secure by default' covers everything.
What to do instead
For each scenario, first name the service model, then draw the line: the provider secures the physical layer, hypervisor, and managed-service internals; the customer secures identity and access configuration, data classification, and workload configuration. Answer with the layer named explicitly, and treat inherited certifications as scoping the provider only.
The candidate answers governance and compliance questions by choosing the most secure-sounding option rather than the one consistent with the stated framework, regulatory obligation, or risk appetite, and confuses a policy with a standard, procedure, or guideline.
Security training rewards maximally restrictive answers, and candidates do not separate 'what the organization decided' (policy) from 'how it is measured' (standard) and 'how it is done' (procedure). They also default to the strictest control when a question asks for the proportionate one.
What to do instead
Memorize the hierarchy: policy states intent and is approved by management; standard sets measurable requirements; procedure gives step-by-step instructions; guideline is advisory. Then answer relative to the framework or regulation named in the stem, and prefer the option that maps to a documented requirement over the option that is merely strictest.