NICA CCCA common mistakes
NICA CCCA · Understand the traps and how to avoid them.
Treating qualitative risk ratings (High/Medium/Low) as if they were interchangeable with quantitative values, and picking an answer that 'calculates' risk without a defined asset value, exposure factor, or likelihood figure.
Candidates memorize the SLE/ALE formulas and then apply them to a scenario that only supplies qualitative descriptors, because the formula feels like the 'technical' answer. The exam deliberately tests whether you can recognize which risk method the scenario actually supports.
What to do instead
Before choosing, ask: does the stem give me dollar values and probabilities, or only descriptive labels? If only labels, the defensible answer is a qualitative assessment or a risk matrix, not ALE. Practice sorting stems into qualitative vs. quantitative by underlining the data they provide.
Confusing risk treatment options: labeling a control that reduces likelihood or impact as 'risk avoidance', or calling a documented decision to accept residual risk a 'mitigation'.
The four treatments (avoid, mitigate/reduce, transfer, accept) overlap in everyday speech, and candidates map 'we bought insurance' or 'we added MFA' to whichever term sounds most responsible rather than to the precise definition.
What to do instead
Anchor on the definition: avoidance eliminates the activity entirely; mitigation reduces likelihood or impact; transfer shifts financial consequence (insurance, contract); acceptance retains the residual risk with sign-off. Read the action verb in the answer choice, not the outcome, and eliminate any option whose verb contradicts the treatment definition.
Selecting a flat network or VLAN-only segmentation answer when the scenario describes a compromised host that must be prevented from reaching sensitive systems, rather than choosing a control that enforces policy between zones.
Candidates equate 'segmentation' with VLANs because VLANs are the most familiar tool, but VLANs are Layer 2 broadcast separation and do not by themselves enforce traffic policy between segments.
What to do instead
When the requirement is to restrict east-west traffic or contain a compromised host, look for an enforcing control: internal firewalls, security groups, or microsegmentation with deny-by-default policy. Reserve VLAN answers for broadcast-domain or basic separation questions and check whether the stem demands inspection or policy enforcement.
Choosing a detection tool by its popularity (e.g., 'deploy a SIEM' or 'install antivirus') instead of matching the tool's native capability to the specific indicator or behavior described in the stem.
Candidates default to the most prominent-sounding technology, missing that the stem describes a behavior (e.g., anomalous outbound beaconing, credential dumping) that requires a specific detection method such as network flow analysis or endpoint behavioral monitoring.
What to do instead
For each detection question, first name the observable (log source, network flow, process behavior, file integrity) and then pick the tool that natively sees it. Reject any option that cannot observe the stated data source, regardless of how advanced it sounds.
Skipping containment or evidence preservation and jumping straight to eradication or recovery steps when the scenario describes an active incident.
Candidates want to 'fix' the problem and pick the remediation step because it feels decisive, forgetting that the incident response lifecycle orders containment before eradication and that volatile evidence is lost if systems are rebuilt first.
What to do instead
Memorize the order: preparation, detection/analysis, containment, eradication, recovery, lessons learned. In any active-incident stem, the correct next step is almost always the earliest incomplete phase. If the question mentions evidence, prefer the answer that preserves volatile data before shutdown or rebuild.
Treating a vulnerability scan report as a validated finding and prioritizing remediation purely by CVSS base score, ignoring exploitability context, asset criticality, and false-positive validation.
CVSS base scores are numeric and easy to sort, so candidates equate 'highest number' with 'fix first', overlooking that base score excludes environmental and temporal factors and that scanners produce false positives requiring confirmation.
What to do instead
Prioritize using a combination of severity, exploit availability, exposure (internet-facing vs. internal), and business criticality of the asset. When a stem asks for the first action after a scan, favor validation/triage before mass remediation, and remember environmental scoring adjusts the base score.
Mixing up authentication factors: counting a password plus a security question as MFA, or labeling a hardware token plus a PIN as 'something you have and something you know' when the stem describes two instances of the same category.
Candidates count the number of steps rather than the number of distinct factor categories (knowledge, possession, inherence), so multi-step single-category logins get misclassified as multifactor.
What to do instead
Label each credential in the stem as knowledge, possession, or inherence before answering. MFA requires at least two different categories. Security questions and passwords are both knowledge; a token and a smart card are both possession. Also watch for 'something you do' (behavior) as a separate category.
Choosing symmetric encryption when the scenario requires key distribution to many parties without sharing a secret, or choosing asymmetric encryption for bulk data protection where performance matters.
Candidates remember 'AES is strong' or 'RSA is secure' without connecting the algorithm to the operational constraint in the stem (scalability of key exchange vs. throughput).
What to do instead
Map the constraint to the property: many recipients or no pre-shared secret implies asymmetric or a hybrid scheme; large data volume implies symmetric with a session key. For integrity-only needs, consider hashing or HMAC rather than encryption. Read the stem for the words 'share', 'scale', 'performance', or 'confidentiality only'.
Confusing governance artifacts: citing a policy when the question asks for the procedure, or treating a standard as a guideline, and misidentifying who owns versus who implements a control.
Policy, standard, procedure, and guideline are used loosely in practice, and candidates pick the most authoritative-sounding term instead of the artifact that matches the level of detail and mandatory status described.
What to do instead
Use the hierarchy: policy states intent and is mandatory and high-level; standards are mandatory specific requirements; procedures are step-by-step instructions; guidelines are recommended, not mandatory. For ownership, senior management/board approves policy while operational staff execute procedures. Match the artifact to the level of detail in the stem.
Answering monitoring and logging questions with 'enable more logging' or 'retain logs longer' when the stem asks how to detect a specific event, rather than selecting the log source, correlation rule, or alerting mechanism that would surface it.
Volume-based answers feel safe and are hard to argue against, but the exam tests whether you can map a detection requirement to a specific telemetry source and analytic, not whether you can recommend generic logging hygiene.
What to do instead
Identify the event type first (authentication, network connection, file change, process execution) and choose the telemetry source that records it plus the correlation or alert that flags it. Treat 'collect more logs' as a distractor unless the stem explicitly states the required data is not being collected at all.