7.2. Common Exam Patterns and Distractors

Watch for these patterns:

1. "FIRST" questions: Usually "Identify the problem" or "Check physical layer"
2. Security terminology: Vulnerability vs. threat vs. exploit vs. risk
3. IDS vs. IPS: Detection vs. prevention
4. Port numbers: Know the common ports cold
5. APIPA recognition: 169.254.x.x = DHCP failure
6. OSI layers: Which layer does X operate at?
7. Longest prefix match: /26 beats /24 regardless of AD

Common distractors:

• Plausible-sounding wrong answers that mix up related concepts
• Answers that would work but aren't the BEST answer
• Technically correct statements that don't answer the question