Working the Questions
Phase 1 and 2 were about content. Phase 3 is about deliberation. This gives you one procedure to run on every question, and then walks it through five real ones, three of which defeated two independent expert readers.
Most people who stall at this stage know the material. They lose points on questions where two answers both look right, which is the case on roughly three questions in ten.
We put 1,750 practice questions in front of two expert readers who never saw the answer key. Of the questions they got wrong, 96% were ones where they had already spotted the correct answer and set it aside as their second choice.
The knowledge was there. The tie-break failed. That is the whole game from here, and it is a skill you can drill.
Get in the right mindset
The stance that comes with every Measuring Stick, boiled down to four things you can actually hold in your head under pressure.
- You advise. You do not fix.Your seat is risk advisor, not engineer. You recommend and senior management decides, so the program is theirs to drive and yours to inform. When something goes wrong, the answer repairs the process rather than the one broken instance. On any question, work out who actually owns the decision.
- Risk decides, and risk starts with the asset.Nothing gets chosen until you know what you are protecting and what it is worth. From there ask how much protection is enough, and whether this particular control earns what it costs. A safeguard priced above the asset is the wrong safeguard.
- Life first. Ethics always.Neither is ever traded for cost, uptime, or convenience. If an option protects a person, it wins, and it wins without deliberation.
- Build it in, layer it, watch the people.Security designed into a system beats security bolted on afterwards. Assume any single control fails and put another behind it. The human is still the easiest way in. Confidentiality, integrity and availability is the lens you read with, never the answer you pick.
One caution. This stance tells you what the question is asking. It never tells you which words to circle. If you catch yourself picking an option because it contains a principle you believe in, stop and check that it actually answers the stem. An option that names the CIA triad, or names defense in depth, is almost always the generic one, and generic explains nothing about the specific control in front of you.
The procedure, on every question
Three steps. The first two are what you do on every question whether it looks hard or not, and they are what produce the two-answer state. The third is what you do once you are in it.
Work the stem before you read a single option.
Cross out any phrase you could remove and still have a sentence, then find the main thing the question is about. Both take seconds, both happen before the options can pull you anywhere, and both change what you are looking for when you start looking.
rules 1 and 6 · decide 13% outrightRead all four options with the stem covered.
Take each option on its own and name what it is true about. Nearly every wrong answer here is a true statement about something else, so asking whether an option is true tells you nothing. This is the step that takes you from four to two, and on its own it settles more than half of every question you will meet.
rule 2 · decides 53% outrightNow you are down to two. Break the tie, and go back to the clause.
Reach for the last three rules, in order, and stop at the first one that kills a candidate. If none of them fires, re-read the stem for a clause you dismissed. On the questions where two expert readers disagreed with each other, rules 1, 4 and 5 fired three times as often as they do across the bank as a whole.
rules 3, 4 and 5 · decide 16% outright
The six rules
The plain-language name is the one to remember. The name underneath it in small type is what every worked answer in your question bank calls it, so you can always match the two up.
Step 1 · on the stem
Cross out the extra bit.
Delete the clauseSome stems carry a phrase you could cross out and still have a sentence. Cut it, answer the shorter question, then put it back. If your answer changed, that phrase was put there to pick the other one.
decides 7.0% · 108 of 1,539
Big word wants a big answer.
Check the head nounFind the main thing the question is about. Program, plan or policy means take the widest option. A named tool, protocol or phase means take the narrow specific one.
decides 6.1% · 94 of 1,539
Step 2 · on every option
True, but true about what?
Check the verb and the objectNearly every wrong answer here is a true statement about something else. So never ask whether an option is true. Cover the stem, read the option on its own, and name what it is true about. Wrong options swap either the doing word (prevents, detects, reports) or the thing it is done to (the network, the host).
decides 52.7% · 811 of 1,539
Step 3 · when two are left
Pick the one that sounds like a book.
Spot the quoteIf a phrase is too particular to be something an exam writer invented, it was copied from a standard. Stop reasoning toward the answer and take the option worded like a textbook over the one worded like your job.
decides 4.7% · 72 of 1,539
Whose job is it?
Fix the actorIf the stem names a person, the answer has to sit inside that person’s authority. Not the smartest move available, and not what you would do. What they are allowed to do.
decides 2.9% · 44 of 1,539
Put them in order, take the earliest.
Sort before you rankMost FIRST and BEST questions are sorting problems wearing a ranking problem’s clothes. Lay the options on a line: what has to exist already, what the process does, what it produces.
decides 8.5% · 131 of 1,539
Close to one question in five has nothing for the rules to bite on. Four bare protocol names, four report types, four intervals. Run the steps, find that nothing fires, and stop looking for a trick. You either know the term or you do not, and the time is better spent on the next question. That is 18% of the bank, and recognising it fast is worth as much as any rule here.
When it is not two
Two is overwhelmingly the case. Across 2,950 expert attempts, one option looked defensible 71% of the time and two looked defensible 28% of the time. Three happened on roughly one attempt in a hundred. Four never happened once. So step 3 is built for the two-answer case on purpose, but two other situations come up and you should recognise them.
Three look defensible. Nothing changes except that step 3 runs longer. Keep going until a rule kills one, then re-run from the top on the two that survive. Rule 6 usually settles these, because a three-way tie is normally one option at the wrong altitude and two at the right one.
Nothing looks defensible. This is rare and it usually means the question is broken rather than that you have a gap. When it happened in our review, the fix was always the same: ignore how badly the stem is worded and pick the only option that is even in the right subject area. Do not let a broken stem push you into an off-topic answer that happens to read cleanly. Take the near-miss in the right domain and move on.
Five worked examples
Each one shows the rules being run in order and where they stop. Answer the question yourself before you read the walkthrough. The examples get longer as they go, because the later ones need more of the ladder.
Both experts missed this one
- Mean time to repair (MTTR)
- Quality of Service (QoS) between applications
- Availability of network services
- Financial penalties in case of disruption
Commit to an answer before reading on.
Both expert readers chose C, availability. It is the reflex answer, and for almost any other customer it would be right.
Availability of network services. True for every customer of every ISP.
Quality of Service between applications. Voice is the one service where a link that is technically up is still useless.
150 milliseconds of jitter destroys a call while the availability meter still reads 100 percent. That is the entire reason the clause is in the sentence.
- A. Mean time to repair matters in every SLA, so it also survives the cut.
- C. True and important, and true for everyone, which makes it a generic answer to a specific question.
- D. Penalties pay you after the outage. They do nothing to keep calls intelligible while the link is up.
Carry this forward. A clause you can delete without breaking the sentence was put there to move the answer. Find the option that only wins with the clause restored.
Both experts missed this one too
- It is not necessary to protect PII as long as it is in the hands of the provider.
- A security agreement with a Cloud Service Provider (CSP) was required so there is no concern.
- The personal information should be maintained separately connected with a one-way reference.
- The personal information can be hashed and then the data can be sent to an outside processor.
Commit to an answer before reading on.
A and B are throwaways. Both say your obligation ends once someone else holds the data, and it does not. That leaves C and D, and both readers took D.
Hash it and send it. Social security numbers, emails and phone numbers come from small, enumerable sets. A dictionary recovers the original in seconds.
Keep the personal information in-house and send a one-way reference. The identifying data never leaves at all.
The word “one-way” appears in both ideas, which is why D feels like C restated. The difference is where the identifier lives. A one-way reference has no mathematical relationship to the original. A hash is computed from it.
- A. Factually false. Your obligation to protect PII does not transfer to a provider.
- B. Factually false. A contract allocates responsibility and does not remove the risk or your accountability.
- D. Real pseudonymization and poor protection, because a hashed low-entropy identifier is reversible and the derived value still leaves your control.
Carry this forward. A one-way reference and a one-way function are different things. Say the option out loud as a standalone sentence and see whether you still believe it.
The stem is quoting a document
- External
- Overt
- Internal
- Covert
Commit to an answer before reading on.
One reader chose C, internal, because “everyday” reads like a synonym for routine, business as usual, inside the network.
Internal, external. Where the tester sits.
Covert, overt. Whether the staff were told a test was coming.
You do not need to name the publication to make that call. One pair is textbook vocabulary and the other is shop floor. And only the announcement axis has anything to do with seeing an organization behave normally, because an announced test gets you prepared administrators no matter where the tester sits.
- A. External describes the tester’s vantage point and says nothing about whether staff were warned.
- B. Overt testing is announced, which produces exactly the rehearsed posture the question is trying to see past.
- C. True that internal testing shows the inside view, and an announced internal test still gets you a prepared team.
Carry this forward. When four options resolve into two paired axes, work out which axis the stem’s qualifier is describing and discard the other pair before comparing anything.
Two rules working together
- Unplug the computer from the network.
- Save the opened files and shut down the computer.
- Report the incident to service desk.
- Update the antivirus to the latest version.
Commit to an answer before reading on.
One reader chose A, unplug the computer, on containment-first reasoning. Containment-first is correct doctrine. It is the wrong lens here.
Unplug the computer from the network.
Report the incident to service desk.
There is a second cost to getting this wrong. A user who yanks the cable or shuts down has just destroyed the volatile memory an analyst needs to identify what is running. This is your own mindset rule in action: do not fix problems.
- A. Right instinct, wrong actor, and a disconnect can destroy evidence before anyone captures it.
- B. The worst of the four. It kills memory evidence and may write infected content to disk.
- D. Updating antivirus is remediation performed by an administrator, and it does nothing about an infection already resident.
Carry this forward. Step 1 finds the clause that matters. Step 3 tells you what that clause means. They are not competing, they run in sequence.
Both experts missed this one
- Collecting security events and correlating them to identify anomalies
- Facilitating system-wide visibility into the activities of critical user accounts
- Encompassing people, process, and technology
- Logging both scheduled and unscheduled system changes
Commit to an answer before reading on.
Both readers chose A. One of them even wrote that C describes program scope rather than a mechanism, which is sound reasoning about a different question.
Collecting security events and correlating them to identify anomalies.
Encompassing people, process, and technology.
Correlation with nobody trained to read the output reduces nothing. Alerts with no defined response process reduce nothing. The risk reduction comes from all three parts working together, which is why the widest option is the right one here and would be the wrong one if the stem had named a tool.
- A. True, and the strongest distractor, but one technical activity inside the program rather than the program itself.
- B. Narrower again, limited to privileged accounts.
- D. Narrowest of all, a single input feed.
Carry this forward. Circle the head noun before you read the options. That one habit is the single most productive move in this whole drill, and this question is why it belongs in step 1 rather than at the end.
Matching this to your answer explanations
Every worked answer in your question bank names its rule in the original wording. Left is the line you will see. Right is what it means.
| What the explanation says | What it means | Step |
|---|---|---|
| rule 1: delete the clause | Cross out the extra bit. | 1 |
| rule 6: check the head noun | Big word wants a big answer. | 1 |
| rule 2: check the verb and the object | True, but true about what? | 2 |
| rule 3: spot the quote, then take the textbook wording | Pick the one that sounds like a book. | 3 |
| rule 3: spot the quote, register branch | Same rule, no quotation on the page. One option is written in the vocabulary of the discipline and the rest in the vocabulary of the job. | 3 |
| rule 4: fix the actor | Whose job is it? | 3 |
| rule 5: sort before you rank | Put them in order, take the earliest. | 3 |
| no rule fires here, this one is recall | Nothing fires. You know it or you do not. | — |
Two things to stop doing
- Stop hunting for the false answer. As examples 3 and 5 show, wrong options are usually true statements sitting in the wrong phase, at the wrong level, or under the wrong person’s authority.
- Stop using the shortcuts you have heard about. Longest answer, answer position, avoid the absolutes, none of them work. We tested all of them against 1,475 questions and every one came back worthless.
Pacing
When you are certain, move on. Certainty was right 998 times out of 1,000 in our testing, and re-reading those questions steals time from the ones that need it. When you are stuck between two, that is your signal to slow down and work step 3 rather than argue with yourself. That feeling is information, so use it.
Work each Measuring Stick like you are taking the real thing. Slow down and work each question methodically. Do not rush.

Recent Comments