Order of operations
Activities in a process can be individually correct but listed in the wrong sequence. Cert exams care about the canonical order; an unordered or reversed list is wrong even if all activities belong.
The Trap in One Sentence
You picked the right activities in the wrong sequence. Cert exams care about the order; a correct list out of order is wrong.
Pairs Candidates Confuse
NIST order
Deming PDCA
AAA order
How to Avoid It
- →Memorize ordered frameworks as ordered (don't just memorize members — memorize the sequence).
- →PICERL / NIST IR / Risk Management Framework / OWASP SAMM — all have canonical orders.
- →If the answer is a sequence, verify EACH adjacent pair is in the right relative order before picking.
Frequently Asked Questions
How do I recognize an order-of-operations trap in an exam question?
When the choices are sequences (Plan → Do → Check → Act, Identify → Contain → Eradicate → Recover), the question is testing whether you can match the correct order, not just identify the members. The trap is a sequence whose elements are all correct but listed in the wrong order.
What's the tell-tale stem phrasing that signals this trap?
Stems with "in order," "the correct sequence," "the proper progression," or "FIRST/LAST step" anchor the question on order. Stems with "what should the team do BEFORE [X]" implicitly require sequence knowledge — the BEFORE word locks the relative position.
If multiple orderings seem plausible, how do I decide?
Verify each adjacent pair of steps is in the canonical order. PICERL: P→I→C→E→R→L. PDCA: P→D→C→A. NIST RMF: Categorize→Select→Implement→Assess→Authorize→Monitor. If even one pair is reversed, the sequence is wrong. The shortcut is checking the first two elements — most distractors swap an adjacent pair early.
What's a real example of an order-of-operations trap?
Stem: "What is the correct NIST SP 800-61 incident-response sequence?" Choices: (a) Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned, (b) Identification → Preparation → Containment → Eradication → Recovery → Lessons Learned, (c) Preparation → Containment → Identification → Eradication → Recovery → Lessons Learned, (d) Identification → Containment → Eradication → Preparation → Recovery → Lessons Learned. (a) is correct. The others all have at least one swapped pair.
How is order-of-operations different from phase-confusion?
Order-of-operations asks WHICH ORDER the phases occur in. Phase-confusion asks WHICH PHASE a specific activity belongs to. Order tests sequence; phase tests assignment. They co-occur on IR-flavored stems but the dimensions are distinct.
Why do item writers love this distractor mechanism?
Sequence knowledge is the cleanest discriminator for candidates who learned a framework deeply vs. shallowly. Anyone can memorize members; few can recall the precise canonical order without practice. Item writers exploit that depth gap to test framework mastery.
Where does this trap show up most often?
Sec+ Domain 4 (Operations) for IR and BC/DR sequences. CISSP Domain 7 for the same plus risk-management process sequences (RMF). CISM for governance sequences. GCIH heavily — the SANS PICERL ordering is canonical to the exam.
How do I deliberately drill against this archetype?
Use the trap drill linked from the section above to focus reps on this pattern. Memorize ordered frameworks AS ordered (don't just memorize members — drill the sequence). Quiz yourself with "what comes BEFORE eradication?" / "what comes AFTER recovery?" The adjacent-pair recall builds reflexive sequence memory.
Practice Against This Trap
5 cert-prep questions currently use this archetype as a distractor. Run a trap drill to face them in a row.
Run a Order of operations trap drill →Related Traps
- Phase confusionYou picked the wrong incident-response or lifecycle phase. Containment, eradication, and recovery overlap in time but are distinct activities.
- Temporal confusionYou picked an answer from the wrong moment in the timeline. Before, during, and after the event each call for different controls.
- Actor-vs-actionYou confused who does it with what gets done. 'Plan' vs 'execute', 'controller' vs 'processor', 'analyst' vs 'hunter' are all actor-action splits.