Software Developer exam mistakes to avoid

Updated 16 September 2026 · 2 min read

Developer tests reward precision, and most lost marks come from reading code too quickly or relying on habits from one language. The mistakes below appear again and again, even among working developers. Each has a simple habit that prevents it.

How this guide was made

Written for this site with AI assistance, then checked automatically before publishing. The topic table, sample questions, worked examples and study plan are generated from this site’s question bank: each worked example is recalculated by separate code, and each sample answer says where it came from.

The guide deliberately states no salaries, grades, pass marks or exam dates. Those change, and they could not be checked here, so take them from the advert itself.

This site is independent and is not affiliated with MIFOTRA or any employer.

Guessing the output instead of tracing

When a question shows a loop and asks for the final value, many candidates recognise the pattern and guess. The trap is usually in the details: a loop that starts at 1 instead of 0, a condition using less-than instead of less-than-or-equal, or a variable updated after it is printed. Write down each variable and trace line by line.

Off-by-one errors

Arrays in most languages start at index 0, so the last element of a ten-item list sits at index 9. Ranges in some languages exclude their end value. Questions exploit these rules deliberately, so check the first and last iteration of every loop.

Choosing the wrong data structure

Candidates sometimes pick a list when fast lookup is needed, or a stack when items must come out in the order they went in. Match the required behaviour: last in, first out for a stack; first in, first out for a queue; fast lookup by key for a hash map; and ordered traversal for a tree.

Writing insecure database code

In questions about querying with user input, joining the input directly into an SQL string looks simple and is wrong. Parameterised queries or prepared statements are the secure answer. The same thinking applies to password storage, where salted hashing is expected.

Confusing HTTP status codes and methods

401 means the client is not authenticated, while 403 means it is authenticated but not allowed. 201 signals that a resource was created, and 204 that a request succeeded with nothing to return. PUT usually replaces a resource, while PATCH updates part of it. These distinctions are common test material.

Assuming one language's rules apply everywhere

Integer division, string immutability, variable scope and how objects are copied differ between languages. When a question uses pseudocode or an unfamiliar language, read its conventions carefully instead of assuming your usual language's behaviour.

Questions where these mistakes cost marks

During a penetration test, an assessor sits in the break room and watches an employee type their complex password into a laptop. The assessor then uses these credentials later. What occurred?
1. Eavesdropping
2. Tailgating
3. Pretexting
4. Shoulder surfing
Show the answer
D. Shoulder surfing
Shoulder surfing involves visually observing a user entering sensitive information, such as a password or PIN.
Original practice question, written against published exam objectives. Open this question
The hospital management system is experiencing issues with user authentication due to a compromised authentication token. What is the best approach to resolve this issue while minimizing disruption to patient care?
1. Utilize a multi-factor authentication system to add an additional layer of security
2. Implement a token revocation mechanism to invalidate compromised tokens
3. Implement a token-based authentication system with secure token storage
4. both b) and c)
Show the answer
D. both b) and c)
Combining multi-factor authentication with securely stored tokens both contains the current compromise and hardens against the next one.
Real past-paper question; answer cross-checked against the original session. Open this question
An attacker leaves several USB drives labeled "Q3 Layoffs & Bonuses" in the company parking lot, hoping curious employees will plug them into corporate workstations. This technique is called...
1. Baiting
2. Dumpster diving
3. Watering hole
4. Pretexting
Show the answer
A. Baiting
Baiting relies on curiosity or greed, offering something enticing (like a USB drive with an interesting label) to trick the victim into compromising their system.
Original practice question, written against published exam objectives. Open this question

Common questions

How can I get faster at tracing code?

Practise with short programs daily, writing variable values in a table as you go. Speed comes from a consistent method, not from skipping steps.

Should I learn Big O notation for a practical developer role?

Yes, at a basic level. It helps you choose efficient approaches, and it appears often in written tests.

What if a question uses a language I have never written?

Read it as pseudocode. Most languages share the same basic structures, so focus on what each line does and watch for any convention the question explains.

Do tests still ask about object-oriented principles?

Frequently. Be ready to explain encapsulation, inheritance, polymorphism and abstraction with a short example of each, because questions often present code and ask which principle it demonstrates.