Cybersecurity Analyst exam mistakes to avoid

Updated 16 September 2026 · 3 min read

Security questions are full of plausible options, because almost every security measure is useful somewhere. The mistakes below come from choosing a good control for the wrong problem, acting in the wrong order, or reading evidence carelessly. Each has a habit that prevents it.

How this guide was made

Written for this site with AI assistance, then checked automatically before publishing. The topic table, sample questions, worked examples and study plan are generated from this site’s question bank: each worked example is recalculated by separate code, and each sample answer says where it came from.

The guide deliberately states no salaries, grades, pass marks or exam dates. Those change, and they could not be checked here, so take them from the advert itself.

This site is independent and is not affiliated with MIFOTRA or any employer.

Misidentifying the attack

Phishing, spear phishing, whaling and business email compromise are related but distinct, and so are brute force, password spraying and credential stuffing. Identify the attack wrongly and you will choose the wrong response. Learn the defining feature of each: password spraying tries a few common passwords across many accounts, while credential stuffing replays username and password pairs leaked from other breaches.

Choosing a real control that does not fit

Encryption does not stop phishing, and antivirus does not stop SQL injection. Options like these are tempting precisely because they are genuine security measures. Before choosing, ask whether the control directly addresses how the attack in the scenario works.

Breaking the incident response order

Candidates often choose to eradicate or recover before containing a threat, or to wipe systems before preserving evidence. The expected order is to detect and analyse, contain, eradicate, recover, and then learn lessons. Answers that skip containment usually leave the attacker with access.

Confusing hashing and encryption

Hashing is one-way and verifies integrity; encryption is reversible with a key and protects confidentiality. Questions about storing passwords safely expect salted hashing, not encryption, while questions about protecting data in transit expect encryption. Mixing these up costs easy marks.

Ignoring the evidence in a log extract

When a question provides logs, the answer is in them. Candidates who skim choose a general answer instead of reading timestamps, source addresses and event types. Read every line, note what changes, and describe the sequence to yourself before choosing.

Treating severity as the only priority

In vulnerability questions, the highest score is not always the first fix. Exposure to the internet, known exploitation and the importance of the system all change the priority, so look for those details in the question.

Forgetting the human side of an attack

Many scenarios begin with a person: someone who clicked a link, reused a password or was persuaded by a convincing phone call. Candidates who reach only for technical controls miss answers involving awareness training, verification procedures or a reporting channel that gets staff to raise suspicions early. When the attack targets trust rather than a system, the best control usually addresses people and process as well as technology.

Questions where these mistakes cost marks

What is the main purpose of antivirus software?
1. To improve graphics
2. To speed up the computer
3. To manage files
4. To detect and remove malware
Show the answer
D. To detect and remove malware
Antivirus software identifies malicious code by signature and behaviour, then quarantines or removes it.
Real past-paper question; answer cross-checked against the original session. Open this question
A user complains that they cannot access a specific internal webpage, receiving an HTTP 500 error. At what OSI layer is this error generated?
1. Transport
2. Application
3. Presentation
4. Session
Show the answer
B. Application
Objective 1.1: HTTP errors are generated by the web service at the Application layer (Layer 7).
Original practice question, written against published exam objectives. Open this question
An enterprise connects its 5 branch offices directly to every other branch office using point-to-point links for maximum redundancy. What topology does this represent?
1. Ring
2. Partial Mesh
3. Full Mesh
4. Star
Show the answer
C. Full Mesh
Objective 1.2: A full mesh topology connects every node to every other node. Partial mesh only connects some, Star uses a central hub.
Original practice question, written against published exam objectives. Open this question

Common questions

How do I remember so many attack types?

Group them by what they target: people, passwords, web applications, networks and availability. Then learn the defining feature of each attack within its group.

What if two controls both seem correct?

Choose the one that addresses the root cause most directly, or the one that fits the stated constraints, such as cost or impact on users.

Are questions on social engineering really about technology?

Often they are about people. The best answer may be training, verification procedures or reporting channels rather than a technical tool, because the attack targets human trust.