NCCSA common mistakes
NCCSA · Understand the traps and how to avoid them.
When asked which control is 'best' or 'most appropriate', the candidate picks the strongest-sounding technical control (e.g., full-disk encryption, MFA everywhere) instead of the control that matches the stated risk, cost, and business context.
Candidates memorize controls as a ranked list of 'good, better, best' and treat security questions as strength contests, so they ignore the qualifiers in the stem such as budget limits, legacy systems, or usability requirements that make a lighter control the correct answer.
What to do instead
Before answering, underline the constraint words in the stem (cost, legacy, availability, regulatory, user population). Then evaluate each option against that constraint and eliminate any option that is technically strong but operationally or financially infeasible in the scenario. Practice writing one sentence per option explaining why it fits or fails the stated constraint.
The candidate classifies a control by its mechanism rather than its function, for example labeling encryption as a 'preventive' control in every context, or calling a firewall log review 'detective' when the stem describes blocking traffic.
Control categories (preventive, detective, corrective, deterrent, compensating) and control types (technical, administrative, physical) are taught as vocabulary lists, and candidates apply the label they memorized for a technology instead of reading what the control actually does in the scenario.
What to do instead
For each control in the stem ask two questions: 'What does it do to the threat (stop, notice, recover, discourage)?' and 'How is it implemented (technology, policy/people, physical barrier)?' Answer those two independently. Build a personal table of 15 common controls with both classifications and revisit it until the mapping is automatic.
The candidate treats the OSI/TCP-IP layer of an attack or defense as fixed by the protocol name, placing TLS inspection at Layer 4 because it involves TCP, or calling ARP spoofing a Layer 3 attack.
Candidates learn 'Layer 2 = switching, Layer 3 = routing, Layer 4 = TCP/UDP' as a shortcut and then misapply it to protocols that span layers, which is exactly where exam questions concentrate.
What to do instead
Learn the layer by what the data unit and addressing scheme are: MAC frames are Layer 2, IP packets Layer 3, TCP/UDP segments Layer 4, and anything that reads or rewrites application payload (HTTP headers, DNS names, TLS certificates) is Layer 7. Drill 20 scenarios (VLAN hopping, ARP poisoning, IP fragmentation, port scanning, TLS interception, DNS tunneling) and state the layer plus the reason in one line each.
The candidate selects 'segment the network' or 'install a firewall' as the answer for every network security scenario, even when the stem describes an insider threat, a compromised endpoint already inside the perimeter, or a need for confidentiality of data in transit.
Perimeter defense is the most familiar mental model, so candidates default to it and overlook that the scenario calls for encryption, least privilege, or endpoint detection rather than a boundary control.
What to do instead
Ask where the attacker or data already is relative to the control. If the threat is already inside, boundary controls do not help; look for host-based, identity-based, or data-level controls. Practice sorting scenarios into 'outside-in', 'inside', and 'data in transit/at rest' buckets before reading the options.
The candidate answers endpoint questions by choosing the tool with the most features (e.g., full EDR suite) when the scenario is about a constrained device, a legacy OS, or a policy-only requirement where a simpler control is correct.
Endpoint security is often studied as a product feature comparison, so candidates equate capability with correctness and ignore deployment constraints such as unsupported operating systems or limited compute.
What to do instead
For endpoint scenarios, first identify the asset class (server, workstation, mobile, IoT/OT, legacy) and its constraints, then match the control to that class. Know which controls are host-based versus network-based and which require an agent. Write a short comparison of antivirus, EDR, application allowlisting, and patch management covering what each does and does not cover.
The candidate confuses authentication, authorization, and accounting, for example describing role assignment as authentication, or treating a password policy as an authorization control.
The three A's are introduced together and candidates memorize the acronym without anchoring each term to a concrete event (proving identity, granting access, recording activity), so similar-sounding options look interchangeable under time pressure.
What to do instead
Anchor each term to a question: authentication answers 'who are you?', authorization answers 'what may you do?', accounting answers 'what did you do?'. For every option in an IAM question, state which question it answers. If an option answers a different question than the stem asks, eliminate it immediately.
The candidate defaults to 'least privilege' or 'role-based access control' for every access control question, even when the stem describes a need for attribute-based decisions, separation of duties, or a specific access control model such as mandatory or discretionary.
Least privilege and RBAC are the most rehearsed phrases, so they become reflex answers; candidates stop reading for cues like 'based on user department and time of day' (ABAC) or 'no single person can complete the transaction' (separation of duties).
What to do instead
Memorize one trigger phrase per model: RBAC = job function/role, ABAC = attributes and context, MAC = classification labels and clearance, DAC = owner discretion, separation of duties = no single point of control. Scan the stem for the trigger before looking at options, and choose the model the stem describes rather than the one you like best.
The candidate calculates risk as threat times vulnerability only, or reports a raw vulnerability score as the organizational risk without factoring likelihood, impact, existing controls, or asset value.
Candidates memorize a simplified formula and apply it mechanically, forgetting that risk assessment is contextual and that a high technical severity on a low-value, well-controlled asset may be low organizational risk.
What to do instead
Write the full chain explicitly on scratch paper: asset value, threat, vulnerability, existing controls, likelihood, impact, resulting risk. Adjust likelihood downward for effective existing controls and upward for exposure. When a question gives a CVSS-style score, treat it as one input and check whether the stem supplies asset criticality or compensating controls that change the answer.
The candidate jumps to eradication or recovery steps before containment, or recommends shutting down a suspected compromised host as the first action without considering evidence preservation.
Candidates study incident response phases as a list but answer from instinct under time pressure, and instinct says 'fix it fast'; they also overlook that powering off destroys volatile memory evidence.
What to do instead
Memorize the order and apply it as a checklist to every scenario: preparation, detection/analysis, containment, eradication, recovery, lessons learned. Before selecting any action, ask 'which phase is the stem in?' and 'does this action destroy evidence?'. For volatile evidence, remember the order of volatility and prefer isolating the host from the network over shutting it down.
The candidate confuses the roles and obligations in governance questions, for example treating the data owner as the party who implements controls, or assuming senior management can transfer accountability for risk to the security team.
Titles such as owner, custodian, steward, and controller sound similar, and candidates memorize definitions without mapping them to decisions and accountability, so they pick the option that sounds most senior or most technical.
What to do instead
Build a one-line role map: owner decides classification and accepts risk, custodian implements and operates controls, steward handles day-to-day data quality, and senior management retains ultimate accountability that cannot be delegated. For each governance option, ask 'does this describe a decision, an implementation, or an accountability?' and match it to the role the stem names.