Sri Lanka ICT Service Exam common mistakes
Sri Lanka ICT Service Exam · Understand the traps and how to avoid them.
Treating the Sri Lanka ICT Service Exam as a purely technical paper and skipping the Public Administration and General Knowledge sections entirely, leaving 20–30% of marks unattempted or guessed.
Candidates with a technical background assume only ICT domains carry weight and spend all revision time on hardware, networking and programming, ignoring that the exam is a service/administrative recruitment test where general knowledge and public administration carry real marks.
What to do instead
Build a revision timetable weighted by the published marks distribution, not by personal interest. Allocate fixed weekly slots to Public Administration (establishment code, financial regulations, administrative structure) and current affairs, and attempt at least two full-length mock papers under timed conditions so no section is left blank.
Memorising definitions of RAM, ROM, cache and secondary storage but failing application-style items that ask which memory is volatile, which is fastest, or which retains data after power-off.
Study notes present hardware as lists to memorise; candidates recite capacity ranges and speeds without building a mental model of the memory hierarchy, so they cannot reason when the question is phrased as a scenario rather than a definition.
What to do instead
Study hardware by function and hierarchy rather than by list. For each component write one line on what it does, whether it is volatile, relative speed and typical use, then practise scenario questions such as 'which storage would hold the operating system during boot'.
Confusing IPv4 address classes, private address ranges and subnet masks, and misidentifying which address range is private or which default mask belongs to a class.
These are memorised as isolated facts without practice in binary or in applying the mask, so under exam pressure candidates mix up 10.x with 172.16–31.x and 192.168.x, or apply a Class C mask to a Class B address.
What to do instead
Drill the private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and class defaults (A /8, B /16, C /24) with 20 quick conversion and identification questions per session, and work a few subnets by hand in binary until the pattern is automatic.
Writing SQL or answering normalisation questions by intuition, producing queries that omit GROUP BY, misuse WHERE with aggregate functions, or leave a table in second normal form while claiming it is in third normal form.
Candidates learn SQL syntax by copying examples rather than running queries, and learn normal forms as slogans ('no partial dependency') without testing them against a concrete relation with a composite key.
What to do instead
Practise on a real database engine with a small sample schema: write SELECT with WHERE, GROUP BY and HAVING, and JOIN queries, then verify output. For normalisation, take one relation with a composite primary key and decompose it step by step to 1NF, 2NF and 3NF, writing the functional dependencies at each stage.
Mixing up the software development life cycle models, describing the waterfall model as iterative or claiming agile has no documentation, and failing to match a model to a stated project scenario.
Models are memorised from summary tables without understanding the assumptions behind each, such as stable requirements for waterfall or incremental delivery for agile, so scenario questions about a volatile-requirements project are answered with the wrong model.
What to do instead
For each model (waterfall, iterative, spiral, prototyping, agile/Scrum) write the phase sequence, the key assumption, one strength and one weakness, then answer at least ten 'which model suits this project' scenarios, justifying the choice in one sentence each.
Treating information security as a list of threats and answering 'install antivirus' or 'use a firewall' for questions that ask for the specific control category, such as preventive versus detective, or the correct response to a phishing incident.
Security is revised as vocabulary (malware types, CIA triad) without linking controls to threats, so candidates cannot select the control that actually addresses the stated risk or classify it correctly.
What to do instead
Map each threat to a control and classify the control as preventive, detective or corrective. Practise incident-response ordering questions (identify, contain, eradicate, recover) and learn the difference between authentication, authorisation and accounting with one concrete example each.
Answering e-government questions with generic enthusiasm ('e-services improve efficiency') rather than naming specific Sri Lankan initiatives, their purpose and their delivery channel.
Candidates rely on general ICT knowledge and never study the national digital government landscape, so they cannot distinguish, for example, a citizen-service portal from a government payment platform or a shared infrastructure initiative.
What to do instead
Maintain a one-page table of major Sri Lankan digital government initiatives with columns for name, purpose, target user and responsible institution, and update it from official government sources. Revise the table weekly and test yourself by covering the purpose column.
Confusing procurement stages with project management stages, for example placing bid evaluation after contract award, or treating a procurement method selection as a project scheduling question.
The two areas overlap in practice but are examined separately, and candidates who study only project management terminology (Gantt, critical path, WBS) cannot answer questions on procurement methods, bidding, evaluation or contract administration.
What to do instead
Learn the procurement cycle as a strict sequence (identification of need, specification, method selection, advertising, bid opening, evaluation, award, contract management) and keep it visually separate from the project life cycle (initiation, planning, execution, monitoring, closure). Practise ordering questions for both.
Giving vague ethics answers such as 'follow the law' when asked about a professional dilemma involving data privacy, conflicts of interest or unauthorised access, without identifying the specific obligation or the correct escalation step.
Ethics and law are treated as common sense and left to the last week, so candidates do not know the relevant legal provisions or the standard professional obligations of an ICT officer in public service.
What to do instead
Study the key legal instruments and professional codes relevant to ICT in Sri Lanka (data protection, computer crime, intellectual property, public-service conduct) and practise dilemma questions using a fixed structure: identify the issue, state the applicable rule or obligation, state the action and the escalation route.
Describing emerging technologies with buzzwords only, unable to distinguish, for example, blockchain from a conventional database, or machine learning from rule-based automation, when the question asks for a definition, use case or limitation.
These topics are absorbed from news headlines and marketing material, so candidates have impressionistic knowledge without the mechanism, which fails questions asking how the technology works or when it is inappropriate.
What to do instead
For each emerging technology (cloud computing service models, IoT, blockchain, AI and machine learning, big data, RPA) write a three-line card covering mechanism, a realistic government use case and a key limitation, and rehearse explaining each in plain language without jargon.