ICSP CS common mistakes
ICSP CS · Understand the traps and how to avoid them.
When a scenario asks who is accountable for a control, the candidate answers with the team that operates the control (for example, the SOC analysts who monitor the SIEM) instead of the business owner who accepts the residual risk.
Candidates conflate operational responsibility with accountability. The exam repeatedly tests the distinction between the person who does the work (responsible) and the person who answers for the outcome (accountable), and operational teams are the most visible actor in the scenario.
What to do instead
For every scenario, write down the roles involved and map them to a RACI-style split before choosing an answer. Ask: who accepts the risk if this control fails? That is the accountable party. Practice with 15 short scenarios where you label responsible, accountable, consulted, and informed before looking at the options.
The candidate selects the first control that technically mitigates the threat (for example, full-disk encryption for a lost-laptop scenario) without checking whether it matches the stated business constraint, cost limit, or regulatory obligation in the stem.
Technical controls feel satisfying and concrete, so they attract attention. The stem often contains a constraint (budget, legacy system, availability requirement) that makes the technically strongest option wrong for that organization.
What to do instead
Before evaluating options, underline every constraint in the scenario: budget, uptime, legacy compatibility, legal jurisdiction, timeline. Eliminate any option that violates a constraint, even if it is technically sound. Then rank the survivors by how directly they address the stated risk.
On least-privilege and role questions, the candidate grants the permission set that lets the user complete today's task efficiently (for example, adding the user to the domain admins group so a one-time software install works) rather than the minimum set needed.
The 'make it work' instinct from real administration overrides the exam's framing. Operational habits favor convenience and broad group membership because that is how many production environments are actually run.
What to do instead
Apply a one-question filter to every access option: does this grant more than the task requires? If yes, it is almost always wrong. Prefer options using temporary elevation, just-in-time access, or a narrowly scoped role, and treat permanent broad group membership as a distractor unless the stem explicitly requires standing access.
The candidate treats encryption as equivalent to integrity or authenticity, choosing an encryption-only option when the scenario describes tampering, forged messages, or repudiation.
Encryption, hashing, and digital signatures are often taught together, so candidates blur their guarantees. Confidentiality controls are more familiar and get selected by default for any 'protect the data' scenario.
What to do instead
Memorize a three-row table: encryption provides confidentiality; a hash or MAC provides integrity; a digital signature provides integrity plus authenticity plus non-repudiation. For each practice question, name the property the attacker violated first, then pick the control that restores exactly that property.
The candidate picks symmetric encryption for a scenario that requires key distribution to many unrelated parties, or picks asymmetric encryption for bulk data transfer, without weighing the key-management and performance trade-offs stated in the stem.
Candidates memorize 'AES is fast, RSA is slow' but do not connect it to the operational problem in the scenario, such as n(n-1)/2 key pairs for symmetric communication among n parties or the cost of asymmetric operations on large payloads.
What to do instead
For any cryptography scenario, ask two questions: how many parties need keys, and how much data is moving? Many parties or open distribution points to asymmetric or a hybrid scheme; bulk data points to symmetric with a wrapped session key. Drill the hybrid pattern (asymmetric to exchange, symmetric to encrypt) until it is automatic.
The candidate answers network segmentation questions by choosing a flat internal network with host firewalls, or chooses a DMZ design that places the database on the internet-facing segment, because the option sounds operationally simpler.
Host-based controls are familiar from endpoint security work, and the candidate undervalues the exam's emphasis on limiting blast radius through architecture. The simplest-sounding topology often looks like the most maintainable one.
What to do instead
For every topology option, draw the trust boundaries and ask where a compromised host can reach next. Reject any design where an internet-facing host shares a segment with data stores or management interfaces. Practice redrawing three-tier and DMZ reference architectures from memory until segment placement is obvious.
The candidate selects a detective control (logging, IDS alerting, monitoring) in a scenario that asks how to prevent a specific action, or selects a preventive control when the stem asks how to detect an ongoing incident.
The stem's verb is easy to skim. Candidates latch onto the technology named in the scenario (a SIEM, an IDS) rather than the control function the question is asking for.
What to do instead
Circle the operative verb in the question: prevent, detect, correct, recover, deter, compensate. Match the control category to the verb before reading the options. Build a personal list of 20 controls and label each as preventive, detective, or corrective so the mapping becomes fast.
The candidate treats a penetration test as a substitute for a vulnerability assessment, or recommends an active exploit test for a production system with strict availability requirements and no change window.
Both activities find weaknesses, so candidates collapse them. The exam tests the distinction in scope, intent, and risk to production, and the availability constraint in the stem is easy to overlook.
What to do instead
Memorize the split: a vulnerability assessment enumerates and prioritizes weaknesses without exploitation; a penetration test exploits to demonstrate impact and requires explicit rules of engagement. When a stem mentions production uptime or no maintenance window, prefer non-exploitative assessment or a test in a cloned environment.
When an incident is in progress, the candidate chooses containment as the first action, or chooses eradication before preserving evidence, rather than following the order the scenario implies.
Containment feels urgent and correct under time pressure. Candidates skip identification and evidence preservation because those steps look passive in a multiple-choice format.
What to do instead
Walk the incident response phases in order for every scenario: preparation, identification, containment, eradication, recovery, lessons learned. If the stem says the scope is unknown, identification comes first; if legal action is possible, evidence preservation precedes eradication. Note that containment strategy depends on the stated business impact, so read for it.
The candidate chooses input validation on the client side, or relies on output encoding alone, when the scenario describes injection or cross-site scripting, instead of enforcing validation and parameterized queries on the server.
Client-side controls are visible in the application code the candidate knows best, and the exam's phrasing about 'user input' invites a front-end answer. The candidate forgets that attackers bypass the browser entirely.
What to do instead
For every injection or scripting scenario, ask where the trust boundary sits and place the control on the server side of it. Default to parameterized queries or prepared statements for SQL, server-side allowlist validation for input, and context-aware output encoding for rendering. Reject any option that names client-side validation as the primary defense.
The candidate classifies data by its storage location or system of record (for example, 'it lives in the HR system, so it is HR data') rather than by the sensitivity and the owner who is accountable for it.
Asset inventories in real environments are organized by system and department, so candidates reuse that mental model. The exam tests classification by impact and ownership, which cuts across systems.
What to do instead
For each data scenario, identify the data owner first, then assign a classification based on the harm from disclosure, alteration, or loss. Remember that the owner delegates custody to the custodian but never delegates accountability. Practice classifying ten data types (PII, PHI, cardholder data, source code, logs) and naming the accountable role for each.