Appendix C. Exam day guide

Time allocation. With 35 questions in 60 minutes, you have just over 1 minute 40 seconds per question. On the first pass, mark and move on if a question takes more than 90 seconds. Ordering and matching take longer, so reserve the last 15 minutes. Questions are worth 2 or 3 points; build your score on questions you know while ensuring you do not miss the 3-point analytical questions.

Read conditions first. Look at the bold conditions and ask, "Would the answer change without this condition?" "There is only one staff member" signals eliminating options requiring human review of every case; "external sharing must remain" signals eliminating options that remove the feature; "enforceable in code" signals eliminating options that add prompt sentences.

Common elimination rules.

1. Options changing only the system prompt are usually supporting measures and have lower priority when the question asks for a control.
2. Logging and monitoring alone are detection rather than prevention. Distinguish whether the question asks how to "stop" or "discover" something.
3. Larger models, longer contexts and lower temperature are not security controls by themselves.
4. Removing an entire feature is safe, but wrong if the scenario requires keeping it.
5. Watch for options mixing confirmed flaws with possible causes. Classification questions rely on confirmed facts.

Statement evaluation. A statement is not correct if its reason is wrong, even when its conclusion is right. Get into the habit of checking the reason first. Exaggerations of official documentation ("always," "completely") are another common trap.

Sequence questions. Ask "what is this step's input?" A step requiring an earlier output must come later. In incident response, remember that stopping ongoing damage precedes cause analysis.

Matching questions. Eliminate certain pairs first, using the fact that one remaining choice may be unused.

Last five minutes. Revisit only marked questions. Change an initial answer only when you have found a missed condition.