NCCSI common mistakes
NCCSI · Understand the traps and how to avoid them.
Treating 'accountability' as a synonym for 'authentication' and answering that logging someone in establishes accountability, instead of selecting non-repudiation through attributable, tamper-evident audit records.
The CIA-plus-accountability mnemonic is memorised as a list of words without the operational meaning of each; candidates map the familiar login screen to the unfamiliar term.
What to do instead
For each pillar, write one sentence naming the control that delivers it and the evidence that proves it. For accountability, the evidence is an audit trail binding a unique identity to an action, protected against modification.
Choosing 'transfer' or 'avoid' for every risk-treatment question, even when the scenario describes reducing likelihood or impact through a control the organisation retains and operates.
Insurance is the most memorable example of transfer, so it becomes the default answer; candidates skip the step of asking whether the residual loss stays with the organisation.
What to do instead
Ask two questions before answering: does another party bear the financial consequence, and does the organisation still operate the control? Operated control with retained residual risk is mitigation; contractual or insured shifting of consequence is transfer.
Answering access-control questions with the most restrictive model (MAC or least privilege alone) when the scenario describes data-owner discretion, project-based need, or conflict-of-interest separation.
Least privilege and MAC are taught as 'best practice', so candidates treat them as universally correct rather than matching the model to the stated business requirement.
What to do instead
Map scenario cues to models explicitly: owner discretion to DAC, labels and clearance to MAC, job function to RBAC, policy attributes to ABAC, and mutual exclusion of duties to separation of duties. Answer the model the scenario describes, not the one you would prefer.
Confusing authentication with authorisation and federation with single sign-on, so a question about a user accessing a resource after one login is answered as 'federation' rather than 'SSO within a trusted domain'.
The protocols overlap in vendor documentation; candidates learn product names rather than the trust boundaries each mechanism crosses.
What to do instead
Draw the trust boundary. SSO is one authentication event across applications inside one trust domain; federation extends that trust across organisational boundaries via assertions. Authorisation is a separate decision made after identity is asserted.
Assuming that placing a firewall, WAF, or TLS termination in front of a service secures it, and ignoring that encrypted traffic can hide malicious payloads from inspection.
Candidates equate 'encrypted' with 'safe' and forget that inspection points must decrypt, inspect, and re-encrypt, or that endpoint controls must compensate.
What to do instead
For every network control, state what it can and cannot see. If traffic is encrypted end to end, name the compensating control (endpoint detection, broker-based inspection, mutual TLS with policy) rather than claiming the perimeter device handles it.
Classifying a segmentation question by device type (switch, router, firewall) instead of by the trust boundary and the policy enforcement point the scenario requires.
Network questions are read as hardware-identification quizzes; candidates recall device categories but not where policy is enforced in the described architecture.
What to do instead
Identify the zones and the data flows between them first, then ask which enforcement point sits on that flow and whether the requirement is filtering, isolation, or monitoring. The device name follows from the boundary, not the reverse.
Describing hardening as 'install antivirus and patch' and omitting configuration baselines, application allow-listing, removal of unnecessary services, and integrity monitoring when the question asks for endpoint defence in depth.
A short mental checklist substitutes for a layered model; candidates stop at the first plausible control.
What to do instead
Build a four-layer answer template: reduce attack surface (baseline, remove services), prevent execution (allow-listing, patching), detect behaviour (EDR, integrity monitoring), and contain (isolation, credential protection). Select the layer the scenario is missing.
Confusing hashing, encryption, encoding, and digital signatures, for example answering that a password store should be encrypted with a reversible cipher or that Base64 provides confidentiality.
All four transform data into unreadable-looking strings, and tooling output looks similar; candidates match on appearance rather than on key usage and reversibility.
What to do instead
Classify by purpose and key: encoding is reversible with no key and gives no security; encryption is reversible with a key and gives confidentiality; hashing is one-way and gives integrity of content; a signature uses a private key and gives authenticity plus integrity plus non-repudiation. State the property the question asks for before choosing.
Choosing a symmetric algorithm or a hash when the requirement is proof of origin to a third party, or choosing asymmetric encryption when the requirement is bulk confidentiality at scale.
Key-management trade-offs are memorised as facts about algorithms rather than as consequences for performance and trust distribution.
What to do instead
Decide from the requirement: many recipients or bulk data favours symmetric with a key-exchange step; third-party verifiable origin requires an asymmetric signature; shared-secret integrity requires a keyed hash. Name the key each party holds, then pick the primitive.
Treating incident response phases as a fixed waterfall and placing containment before the question's stated activity, or labelling eradication work as recovery, when the scenario describes partial restoration under monitoring.
The phase names are learned as an ordered list without the criteria that mark entry into each phase, and real incidents interleave them.
What to do instead
Attach a test to each phase: detection and analysis means understanding scope; containment means stopping spread; eradication means removing the cause; recovery means restoring service with validation. Classify the described activity by its purpose, not by its position in the list.