GAA common mistakes
GAA · Understand the traps and how to avoid them.
Treating IT asset management as an inventory-counting exercise and answering questions purely on 'how to tag and track devices', while ignoring the governance layer (policy ownership, asset lifecycle decision rights, ITAM charter, roles such as asset owner vs asset custodian).
Candidates come from hands-on service desk or desktop support backgrounds where ITAM is experienced as a ticketing and tagging task, so they map exam scenarios onto tool operation rather than onto the governance framework the question is testing.
What to do instead
Before answering, classify the stem: is it asking who decides, who is accountable, or what process governs the decision? If the stem mentions policy approval, role assignment, audit findings, or cross-departmental conflict, answer from the governance layer (charter, RACI, asset ownership model) rather than from tooling. Revise the distinction between asset owner, custodian, and user, and be able to state which role authorises retirement, transfer, and exception.
Confusing discovery, inventory, and configuration management, and choosing an answer that describes a CMDB population activity when the question asks about verified asset records, or vice versa.
The three terms are used interchangeably in vendor marketing and in day-to-day operations, so candidates do not hold a crisp boundary: discovery finds, inventory records and reconciles, configuration management relates items and their attributes and dependencies.
What to do instead
Memorise a one-line definition for each and a test to separate them: discovery answers 'what is reachable now', inventory answers 'what do we own and where is it recorded', configuration management answers 'how is it set up and what does it depend on'. In each question, identify which of those three verbs the stem is actually asking for before reading the options.
Assuming discovery tools produce a complete and accurate asset estate, and answering reconciliation questions as if a single data source is authoritative.
Candidates trust the tool output they have seen in practice and underestimate agents that fail to report, network segments that are unscanned, unmanaged and shadow IT, and duplicates created by MAC address changes or reimaging.
What to do instead
Treat every question as a multi-source reconciliation problem: discovery data, procurement and finance records, and manual attestation each have gaps. When a stem mentions discrepancies, duplicates, or assets missing from the CMDB, look for the answer that establishes an authoritative source plus a reconciliation cadence and exception handling, not the answer that says to rescan more often.
Answering hardware lifecycle questions with a single-stage action (for example 'dispose of the asset') and skipping the prerequisite stages such as approval, data sanitisation evidence, financial write-off, and record closure.
In real operations the last step is the visible one, so candidates jump to it, and they underestimate how heavily the exam weights the control and evidence steps around retirement and redeployment.
What to do instead
For any lifecycle stem, walk the full chain explicitly: request and approval, procurement and receipt, deployment and assignment, in-life change and maintenance, retirement decision, data sanitisation with certificate, financial treatment, and record update. Choose the option that preserves the chain and the audit trail rather than the fastest single action.
Treating software licence compliance as a simple count comparison (installed versus purchased) and ignoring licence metrics, entitlement types, and the difference between consumption and entitlement.
Candidates apply a hardware mindset to software, where entitlement can be per user, per core, per processor, per device, or subscription-based, and where the effective licence position depends on which metric the contract specifies.
What to do instead
For every SAM question, first identify the licence metric and the entitlement basis stated or implied in the stem, then identify the consumption measure that matches that metric. Reject answers that compare unlike units. Practise converting installs into effective consumption (for example users sharing a device, or virtual cores mapped to physical cores) before comparing to entitlement.
Ignoring the shared-responsibility split in cloud and virtual environments, and answering as if the provider discovers, inventories, or licenses everything on the customer's behalf.
Cloud consoles give an impression of complete visibility, and candidates do not separate provider-managed infrastructure from customer-managed workloads, data, and identities.
What to do instead
For each cloud stem, ask what layer the asset sits at: provider infrastructure, customer workloads, customer data, or identity and access. Inventory and configuration responsibility follows the customer for everything above the provider layer. Also check whether the question concerns virtual machines that still consume on-premises licence entitlements, and answer from the customer's obligation rather than the provider's tooling.
Classifying data protection and asset security questions by device type rather than by data classification, so answers focus on locking down laptops while missing retention, access control, and sanitisation requirements for the information itself.
Candidates equate asset security with endpoint hardening and do not connect the asset record to the classification of data it holds, which is what drives handling and disposal requirements.
What to do instead
Re-anchor on the data: identify the classification in the stem, then derive handling, access, retention, and disposal requirements from it. Remember that sanitisation requirements and evidence follow the highest classification the asset has held, not its current use, and that asset records themselves may contain personal data subject to retention limits.
Answering cost optimisation questions by minimising spend, choosing the cheapest option or the largest discount, without weighing total cost of ownership, utilisation, and risk.
Cost reduction and cost optimisation feel synonymous, and candidates default to the visibly cheaper number rather than the option that improves cost per unit of service while preserving compliance and availability.
What to do instead
Screen every financial option against three tests: does it reduce cost per unit of service, does it preserve required service levels and compliance, and does it account for the full lifecycle (acquisition, support, maintenance, migration, disposal)? Prefer answers that improve utilisation or retire underused assets over answers that simply cut price or defer necessary spend.
Choosing metrics by familiarity (ticket counts, number of assets discovered) rather than by whether the metric measures the outcome the stakeholder needs, and reporting raw data without a defined baseline or trend.
Candidates report what their tools emit rather than what the question's audience needs, and they treat a metric as inherently meaningful without a defined calculation, owner, or target.
What to do instead
For each reporting stem, identify the audience and decision first, then select the metric that informs that decision, and confirm it has a stated definition, data source, baseline, and target. Reject vanity metrics that grow with estate size and prefer ratios, coverage percentages, and compliance rates that remain comparable over time.
Handling stakeholder and process questions by escalating or mandating, and ignoring the need to agree scope, define process ownership, and communicate change to affected parties.
Candidates answer from a technical authority mindset, assuming that a correct process will be adopted once published, and they underestimate the change management and communication content the exam expects.
What to do instead
When a stem involves resistance, unclear ownership, or a process that is not followed, prefer answers that establish agreed scope and ownership, define the process with inputs and outputs, communicate to affected stakeholders, and provide a feedback loop. Escalation is the last resort, not the first answer, and mandate without communication is almost always the wrong option.