ATP 108 common mistakes
ATP 108 · Understand the traps and how to avoid them.
Memorising definitions of foundational terms without being able to distinguish closely related pairs (e.g., policy versus standard, threat versus vulnerability versus risk) and choosing the first plausible-sounding option.
Candidates study vocabulary as a list of isolated definitions, so under exam pressure they match on keyword overlap rather than on the functional difference between terms.
What to do instead
For each foundational term, write a one-line test you can apply mechanically (e.g., 'a threat has intent or capability; a vulnerability is a weakness; risk combines likelihood and impact') and practise sorting 20 short scenarios into the correct term before reviewing definitions again.
Treating all governance documents as interchangeable, labelling any mandatory requirement a 'policy' and any detailed instruction a 'standard' regardless of who approves it or what it governs.
The candidate has not internalised the hierarchy of intent, and the exam options are written so that two answers differ only by document type.
What to do instead
Build a small hierarchy table (policy, standard, procedure, guideline) with columns for purpose, specificity, approver, and whether it is mandatory, then classify ten real or invented documents against it.
Selecting a control or framework because it is the most familiar or most comprehensive rather than because it matches the stated objective, scope, or risk context in the scenario.
Candidates anchor on the framework they have used at work and ignore the qualifiers in the stem such as 'minimum necessary', 'third-party assurance', or 'regulatory obligation'.
What to do instead
Before answering framework questions, underline the objective and scope words in the stem and eliminate any option that does not directly serve that objective, even if it is a well-known framework.
Answering control-design questions with a single technical fix when the scenario calls for layered or defence-in-depth treatment, or conversely over-engineering a simple low-risk scenario.
Candidates default to the control they know best and do not calibrate the response to the risk level or the failure mode described.
What to do instead
Practise a two-step routine: first state the risk being mitigated and the required assurance level, then choose the control set proportional to it, and reject any single-control answer for a scenario describing multiple failure paths.
Skipping or rushing the scoping and sequencing steps in process questions, jumping straight to the remediation or testing step as the 'obvious' answer.
Experienced candidates recall the exciting middle of a process and forget that the exam rewards the correct first step, and options are ordered to tempt action over planning.
What to do instead
For every process question, write the ordered steps on scratch paper and locate the stem's current position in that sequence; the correct answer is almost always the next step, not a later one.
Choosing 'escalate to management' or 'conduct a full assessment' as a default answer for procedural scenarios where a specific documented step or threshold applies.
Candidates learn escalation as a safe fallback and apply it even when the scenario describes a routine event with a defined handling path.
What to do instead
Learn the decision thresholds in each procedure you study and practise matching scenario facts to the threshold; reserve escalation answers for scenarios that explicitly exceed authority, budget, or risk appetite.
Confusing tool outputs with conclusions, for example treating a scanner finding, a risk score, or a log alert as a confirmed compromise or a confirmed control failure.
Candidates equate automation with certainty and forget that tools produce indicators requiring validation and context.
What to do instead
For any tool-related question, ask 'what would I need to verify before acting on this output?' and prefer answers that include validation, correlation, or triage over answers that act directly on raw output.
Recommending a tool or technology as the primary answer to a problem that is fundamentally about process, ownership, or human behaviour.
Technology options look concrete and decisive, so candidates pick them over slower organisational answers even when the stem describes a governance or training gap.
What to do instead
Classify the root cause in the stem as people, process, or technology before reading the options, then require the chosen answer to address that same category.
Mixing up obligation types, treating a recommended practice, a contractual requirement, and a legal requirement as equivalent when selecting a compliance response.
Candidates memorise standard names without their status or applicability, and exam options are crafted to reward knowing which instrument actually binds the organisation in the scenario.
What to do instead
For each standard or regulation you study, record its nature (law, contract, voluntary standard, guidance), its jurisdiction or applicability trigger, and one example obligation, then answer compliance questions by first identifying which instrument applies.
Answering ethics and professional-practice questions with the option that protects the organisation or the client relationship rather than the option that upholds the stated professional duty, and failing to disclose conflicts or uncertainties.
Real-world pressure and loyalty intuitions pull toward discretionary or quietly accommodating answers, and candidates do not check the answer against a duty hierarchy.
What to do instead
Apply a fixed test to every ethics item: identify the duty owed, ask whether the proposed action is transparent and defensible if published, and prefer disclosure plus escalation over concealment or unilateral discretion; drill this on short scenarios until it is automatic.