| Treating MDM or the work profile as something a technician may remove to get a task done | IT-4.2 | 15 | 17 | 5 |
| Choosing a tool from a different fault domain than the symptom | IT-7.2 | 7 | 9 | 6 |
| Picking a control that protects something else (encryption at rest, firmware password, radio, mail filtering) for the threat named | IT-10.3 | 7 | 8 | 4 |
| Treating a one-user or one-app print failure as a floor outage, or a floor outage as one PC | IT-4.3 | 7 | 7 | 5 |
| Misjudging what a RAID level survives or how to recover it | IT-3.2 | 7 | 7 | 6 |
| Charging, prying or ignoring a suspected swollen battery | IT-4.1 | 6 | 7 | 3 |
| Believing RAID parity or mirroring recovers deleted or encrypted files | IT-3.2 | 6 | 6 | 4 |
| Thinking speed profiles, drivers or new modules fix memory placed in slots that share one channel | IT-2.3 | 6 | 6 | 3 |
| Changing LAN-side, DNS or NAT settings when the router has no valid WAN address from the ISP | IT-5.4 | 5 | 5 | 5 |
| Thinking memory generations or types are interchangeable | IT-2.1 | 5 | 5 | 5 |
| Starting recovery with a destructive step (reinstall, diskpart clean) before non-destructive repair | IT-8.3 | 5 | 5 | 5 |
| Not recognising that an fe80:: address alone means no router advertisement or DHCPv6 gave a global address | IT-5.1 | 5 | 5 | 4 |
| Mixing up what the gateway, DHCP and DNS each do | IT-5.1 | 5 | 5 | 5 |
| Pushing on past the change window (or cutting tests and monitoring) instead of following the plan’s stop or roll-back rule | IT-12.1 | 5 | 5 | 5 |
| Thinking IaaS leaves you nothing to manage, or that you own the vendor datacentre | IT-6.2 | 5 | 5 | 4 |
| Treating a MEM POST code with no video as a display or power problem | IT-2.3 | 5 | 5 | 1 |
| Writing ticket notes as complaints or slogans instead of action and result | IT-1.3 | 4 | 7 | 4 |
| Handling an electrical shock report as a routine part swap | IT-1.2 | 4 | 7 | 4 |
| Closing a ticket on a signal (green icon, silence, timer) instead of a verified fix | IT-1.3 | 4 | 7 | 4 |
| Going hands-on with hardware before classifying and escalating a hazard | IT-1.1 | 4 | 7 | 4 |
| Letting urgency replace identity verification | IT-1.4 | 4 | 7 | 3 |
| Opening or touching parts before the PC is powered off, unplugged and you are grounded | IT-1.2 | 4 | 7 | 4 |
| Calling a planned change (adding something new) a repair or an incident | IT-1.1 | 4 | 7 | 4 |
| Missing that unusual data use, ads, fake warnings or sideloaded apps point to a security problem | IT-4.2 | 4 | 6 | 4 |
| Ignoring pending updates when a PC reboot-loops | IT-8.2 | 4 | 5 | 4 |
| Choosing a fault domain that does not fit the scope of the symptom | IT-7.2 | 4 | 5 | 2 |
| Mixing up which service a well-known port belongs to | IT-5.2 | 4 | 5 | 3 |
| Granting broad admin rights (or disabling UAC) where a narrow delegated right would do | IT-10.1 | 4 | 5 | 2 |
| Renewing DHCP or flushing DNS when there is no link at the switch port | IT-5.3 | 4 | 4 | 3 |
| Treating a snapshot as a backup or an off-site copy | IT-6.1 | 4 | 4 | 3 |
| Changing Windows display preferences when multi-monitor output is limited by the dock, cable or port (bandwidth, DP Alt Mode, MST) | IT-3.4 | 4 | 4 | 3 |
| Expecting Windows to show two files whose names differ only by case, or blaming SMB | IT-9.4 | 4 | 4 | 3 |
| Thinking passwords may go in the ticket on some platforms | IT-9.3 | 4 | 4 | 4 |
| Choosing the wrong Windows repair or diagnostic tool | IT-8.3 | 4 | 4 | 4 |
| Thinking hiding or encoding an exposed secret makes it safe again | IT-10.1 | 4 | 4 | 4 |
| Thinking the physical slot length sets PCIe bandwidth, or that a lane mismatch stops the card or drops its generation | IT-2.1 | 4 | 4 | 3 |
| Bringing Windows tools or destructive steps to a strange Linux box | IT-9.1 | 4 | 4 | 4 |
| Naming fixed capacity, single tenancy or manual provisioning as cloud characteristics | IT-6.2 | 4 | 4 | 4 |
| Blaming RAM, drivers, heat or display settings for faults that track GPU/CPU load when temperatures are normal and the evidence points to power delivery | IT-3.3 | 4 | 4 | 2 |
| Expecting an under-rated charger to cause no symptoms, or unrelated ones | IT-4.1 | 4 | 4 | 4 |
| Thinking a quick format or profile deletion removes data from a drive | IT-10.3 | 4 | 4 | 3 |
| Mixing up the trade-offs of 2.4, 5 and 6 GHz Wi-Fi or the Wi-Fi generations | IT-5.4 | 4 | 4 | 4 |
| Not knowing the print path order, or reinstalling the driver every time | IT-4.3 | 4 | 4 | 4 |
| Treating DHCP scope exhaustion with workarounds (daily restarts, all-static, APIPA) instead of capacity and lease time | IT-5.3 | 4 | 4 | 4 |
| Treating a Secure Boot block as a TPM, partition-style or firmware-reset problem instead of a controlled exception | IT-2.2 | 4 | 4 | 3 |
| Treating a request for new access or a new item as an incident or break/fix | IT-1.1 | 3 | 6 | 3 |
| Classifying by the device involved instead of by how many people are affected | IT-1.1 | 3 | 6 | 3 |
| Recording passwords or opinions in the ticket | IT-1.4 | 3 | 6 | 3 |
| Carrying on after heat or a burn smell because the new part seems to work | IT-3.3 | 3 | 4 | 2 |
| Blaming the toner cartridge or paper feed when toner rubs off a laser printout | IT-4.3 | 3 | 4 | 3 |
| Misunderstanding promiscuous mode (it lets a vNIC see other guests’ frames; it does not change VLAN, CPU or firewall) | IT-6.3 | 3 | 4 | 3 |
| Treating hand-off context and requester confirmation as optional overhead | IT-7.3 | 3 | 4 | 3 |
| Plugging the CPU cooler into a chassis or other header and expecting firmware to monitor it | IT-2.1 | 3 | 3 | 3 |
| Mixing up clean install and in-place upgrade, or treating them as not changes | IT-8.1 | 3 | 3 | 2 |
| Running destructive diskpart commands during an inventory step | IT-3.1 | 3 | 3 | 2 |
| Blaming the battery, charger or a power setting when the fault follows the lid angle | IT-4.1 | 3 | 3 | 3 |
| Mixing up DNS record types | IT-5.2 | 3 | 3 | 3 |
| Changing or imaging a disk before inventorying which disk is which | IT-2.4 | 3 | 3 | 3 |
| Expecting to manage the platform or hardware in SaaS | IT-6.2 | 3 | 3 | 2 |
| Treating job reports, labels or reachability as proof a backup can be restored | IT-12.3 | 3 | 3 | 3 |
| Starting with a fix (reimage, flush, disable security) before identifying the problem | IT-7.1 | 3 | 3 | 3 |
| Answering a RAM count mismatch with software steps instead of seating or firmware | IT-2.4 | 3 | 3 | 3 |
| Thinking a VM is a remote session, a physical server or a disk backup | IT-6.1 | 3 | 3 | 3 |
| Underplaying signs of an attack or phish (closing, ignoring, lecturing, unlocking) instead of recording and handling it as an incident | IT-10.2 | 3 | 3 | 2 |
| Forcing a locked file (delete, take ownership, Safe Mode) instead of stopping its owner gracefully | IT-11.3 | 3 | 3 | 3 |
| Choosing a bigger or unrelated recovery (RAID rebuild, chkdsk, bare-metal) for one deleted file on a healthy volume | IT-12.3 | 3 | 3 | 3 |
| Treating PC malware symptoms as hardware or user error | IT-10.2 | 3 | 3 | 2 |
| Thinking a PSU may be opened and serviced if you are careful | IT-3.3 | 3 | 3 | 2 |
| Treating the firewall, Defender or patching as optional or something to switch off | IT-10.3 | 3 | 3 | 3 |
| Thinking ping, a DNS lookup or a path trace proves a service is listening | IT-5.2 | 3 | 3 | 2 |
| Fixing cloud productivity problems with the wrong control (password reset for a missing licence, etc.) | IT-6.2 | 3 | 3 | 3 |
| Skipping or reordering steps of the troubleshooting methodology | IT-7.1 | 3 | 3 | 2 |
| Reading “bootable device not found” as a failed internal drive before checking removable media and the boot order | IT-3.1 | 2 | 4 | 2 |
| Trusting AI output or public AI tools with private data without checks | IT-12.2 | 2 | 4 | 1 |
| Changing several things at once to save time | IT-7.1 | 2 | 3 | 1 |
| Working on the local PC when the whole tenant is down | IT-6.2 | 2 | 3 | 2 |
| Fixing a printer configuration problem with hardware or the wrong setting | IT-4.3 | 2 | 3 | 2 |
| Treating several different problems as one | IT-7.2 | 2 | 3 | 2 |
| Turning the firewall off or reimaging as a troubleshooting step | IT-5.3 | 2 | 2 | 1 |
| Missing that the default gateway must be on the host’s own subnet | IT-5.1 | 2 | 2 | 1 |
| Thinking firmware (UEFI) runs inside or after Windows | IT-2.2 | 2 | 2 | 0 |
| Using the Intel Mac or Windows key to reach macOS Recovery on Apple silicon | IT-9.2 | 2 | 2 | 2 |
| Starting with a stack reset, full network reset or driver reinstall instead of the lowest rung | IT-13.4 | 2 | 2 | 2 |
| Jumping to boards or firmware for a dark panel after POST is fine | IT-3.4 | 2 | 2 | 0 |
| Treating access the user never had as a technical fault or incident | IT-9.3 | 2 | 2 | 1 |
| Reading "DNS works, web does not" on guest Wi-Fi as a DNS, proxy or signal fault instead of a captive portal waiting for sign-in | IT-5.3 | 2 | 2 | 1 |
| Thinking going offline changes a user’s rights or switches UAC off, rather than an online check failing | IT-10.1 | 2 | 2 | 2 |
| Acting alone as the incident responder or wiping the PC immediately | IT-10.2 | 2 | 2 | 2 |
| Reading macOS’s native NTFS read-only behaviour as a failing or locked drive | IT-9.4 | 2 | 2 | 2 |
| Investigating, copying or deleting prohibited content yourself instead of stopping and reporting | IT-12.2 | 2 | 2 | 1 |
| Changing the VM or rebooting before confirming its current state | IT-13.3 | 2 | 2 | 2 |
| Ignoring what a removal test just proved (onboard video works, so the monitor and board video are fine) | IT-2.3 | 2 | 2 | 2 |
| Thinking a layer-2 change (cable type, STP, a shared DHCP scope) lets different VLANs talk | IT-5.3 | 2 | 2 | 1 |
| Replacing a part before isolating the fault (e.g. new screen before testing an external monitor) | IT-4.1 | 2 | 2 | 2 |
| Mixing up TCP (connection-oriented, reliable) and UDP (connectionless, best effort) | IT-5.2 | 2 | 2 | 2 |
| Granting broad privilege (permanent root, chmod 777, disabling SELinux/AppArmor) where one capability or a proxy does the job | IT-9.1 | 2 | 2 | 2 |
| Ignoring or delaying action on drive-failure warnings (SMART, clicking) | IT-3.1 | 2 | 2 | 2 |
| Reading an 80 PLUS rating as the power supply’s wattage, connectors or warranty | IT-3.3 | 2 | 2 | 2 |
| Misreading which counters show a storage bottleneck | IT-11.3 | 2 | 2 | 2 |
| Thinking DNS assigns addresses or routes traffic | IT-5.1 | 2 | 2 | 2 |
| Believing Secure Boot speeds up, encrypts or protects the disk like antivirus | IT-2.2 | 2 | 2 | 2 |
| Writing guesses in the note as measured results or root cause | IT-7.3 | 2 | 2 | 2 |
| Expecting a higher copper category to extend beyond the 100 m channel | IT-3.4 | 2 | 2 | 2 |
| Treating rising SMART reallocations as something maintenance (defrag, format) can fix, or silencing the warning | IT-3.1 | 2 | 2 | 2 |
| Expecting a network, disk or system-information command to report battery wear | IT-4.1 | 2 | 2 | 2 |
| Thinking a split pair is a continuity, crossover or length fault (the wire map passes; crosstalk fails) | IT-3.4 | 2 | 2 | 2 |
| Thinking gateway-style addresses (.1, .254) are reserved by the protocol, rather than the network and broadcast addresses | IT-5.1 | 2 | 2 | 2 |
| Not linking a stopped DHCP Client service to lease failures | IT-8.2 | 2 | 2 | 2 |
| Factory-resetting a phone when the problem is one network path | IT-4.2 | 2 | 2 | 2 |
| Missing that "IP works, name fails" points to the name / DNS path | IT-5.3 | 2 | 2 | 2 |
| Expecting a duplex mismatch to drop the link or break DHCP/DNS (the link stays up while late collisions and CRC errors climb) | IT-5.3 | 2 | 2 | 2 |
| Believing Group Policy cannot reach laptops or VPN clients at all | IT-8.4 | 2 | 2 | 2 |
| Treating a temporary-profile sign-in as a system-file, OS or password problem instead of a profile that would not load | IT-11.3 | 2 | 2 | 2 |
| Treating a port replicator and a docking station as the same thing | IT-4.2 | 2 | 2 | 2 |
| Thinking registered ECC server memory works in any board once speed, voltage or slot count is right | IT-2.1 | 2 | 2 | 1 |
| Thinking file size, timestamps or a password prove a file was not altered | IT-10.4 | 2 | 2 | 2 |
| Mixing up display technologies and attributes (TN, IPS, VA, OLED; refresh vs resolution) | IT-3.4 | 2 | 2 | 2 |
| Linking a network symptom to the wrong cause (e.g. jitter to DNS, IP conflict to Wi-Fi) | IT-5.3 | 2 | 2 | 2 |
| Thinking UEFI natively boots Windows from MBR, or confusing partition styles with file systems or dynamic disks | IT-8.1 | 2 | 2 | 2 |
| Handing a guest with no adapter or APIPA to the OS team when the host is up, instead of the hypervisor owner | IT-6.3 | 2 | 2 | 2 |
| Making a rebuild or reset the default fix | IT-11.2 | 2 | 2 | 2 |
| Doing a repeated, identical task by hand on every PC instead of a tested script | IT-13.2 | 2 | 2 | 2 |
| Testing a change in production instead of a sandbox | IT-12.1 | 2 | 2 | 2 |
| Believing a browser setting does more than it does (private mode hides you from the employer, etc.) | IT-10.2 | 2 | 2 | 2 |
| Thinking the service tag and panel part number are paperwork or a software setting rather than what identifies the right replacement panel | IT-4.1 | 2 | 2 | 2 |
| Believing RAID 0 survives a disk failure | IT-3.2 | 2 | 2 | 2 |
| Blaming browser settings, the sites or the network when every HTTPS site warns on one PC | IT-10.2 | 1 | 3 | 1 |
| Relying on hiding the SSID or obscurity instead of real controls on a SOHO network | IT-5.4 | 1 | 2 | 1 |
| Classifying signs of account compromise as a request or a profile fault | IT-10.2 | 1 | 1 | 1 |
| Treating a setting that reverts after every policy refresh as a local hardware or driver fault | IT-8.2 | 1 | 1 | 1 |
| Jumping to a fix at a higher layer before the lower layer is proven (e.g. flushing DNS on an APIPA box) | IT-5.3 | 1 | 1 | 1 |
| Fixing guests one by one when many guests on one host fail together | IT-6.3 | 1 | 1 | 1 |
| Using closed yes/no questions when you need the user to describe the problem | IT-1.4 | 1 | 1 | 1 |
| Not realising Windows Hello for Business keys are bound to the TPM, so clearing it destroys them | IT-10.1 | 1 | 1 | 1 |
| Blaming the SIM, hotspot or location services when one kind of account data (calendar) stops syncing and mail still works | IT-4.2 | 1 | 1 | 1 |
| Treating a container runtime as a hypervisor | IT-6.1 | 1 | 1 | 1 |
| Choosing a motion specification (refresh rate, response time) when the need is colour range | IT-3.4 | 1 | 1 | 1 |
| Collecting disk or archive evidence before memory and temporary files | IT-10.4 | 1 | 1 | 1 |
| Testing or escalating before asking intake questions | IT-1.3 | 1 | 1 | 1 |
| Mixing up the virtual network modes | IT-6.1 | 1 | 1 | 1 |
| Keeping a swollen lithium-ion battery in use or trying to flatten or puncture it | IT-4.1 | 1 | 1 | 1 |
| Assuming any laptop drive or memory module fits if the capacity is right | IT-4.1 | 1 | 1 | 1 |
| Attaching a service to the wrong well-known port | IT-5.2 | 1 | 1 | 1 |
| Reaching for a clean install before inventory or for a hardware (POST) fault | IT-8.1 | 1 | 1 | 1 |
| Looking in logs that cannot attribute a directory change (firewall, client application, DHCP) instead of directory-service audit events | IT-10.4 | 1 | 1 | 1 |
| Picking a network tool that tests something else | IT-5.3 | 1 | 1 | 1 |
| Blaming the NIC when ping to the server works and one application fails | IT-5.2 | 1 | 1 | 1 |
| Missing that clock skew breaks Kerberos logons | IT-8.4 | 1 | 1 | 1 |
| Naming the form factor from the case or a guess instead of measuring the board | IT-2.1 | 1 | 1 | 1 |
| Thinking old snapshot chains are harmless or even helpful | IT-6.1 | 1 | 1 | 1 |
| Blaming ARP, DHCP or switches for old DNS answers instead of cached records (TTL) | IT-5.3 | 1 | 1 | 1 |
| Mixing up which mask gives which block size (a longer mask means fewer addresses) | IT-5.1 | 1 | 1 | 1 |
| Choosing a server role that provides a different service | IT-5.2 | 1 | 1 | 1 |
| Treating a voicemail, a calm screen or an expired timer as verification | IT-7.3 | 1 | 1 | 1 |
| Choosing a network device that does a different job | IT-5.4 | 1 | 1 | 1 |
| Counting the network and broadcast addresses as usable hosts | IT-5.1 | 1 | 1 | 1 |
| Confusing plenum, riser, direct burial and shielding by what they protect against | IT-3.4 | 1 | 1 | 1 |
| Missing that Kerberos tickets depend on synchronised clocks | IT-5.4 | 1 | 1 | 1 |
| Repairing fault after fault past the time box when the evidence favours a planned rebuild | IT-11.3 | 1 | 1 | 1 |
| Thinking chapter 13 is optional reading, new theory or a vendor exam rather than lab practice | IT-13.1 | 1 | 1 | 1 |
| Mixing up clean install, reset and in-place repair | IT-11.2 | 1 | 1 | 1 |
| Ignoring an application requirement (64-bit, dedicated GPU, RAM, storage) when installing | IT-8.2 | 1 | 1 | 1 |
| Misreading what it means when a fault follows the user or follows the device | IT-11.1 | 1 | 1 | 1 |
| Looking for the hardware virtualization switch inside Windows | IT-6.1 | 1 | 1 | 1 |
| Thinking a password may go in the ticket with consent or if the ticket is private | IT-12.2 | 1 | 1 | 1 |
| Applying the maintenance task of one printer type to another | IT-4.3 | 1 | 1 | 1 |
| Blaming the host when LAN tests pass and failure starts beyond the gateway | IT-5.3 | 1 | 1 | 1 |
| Rebooting or rebuilding first and collecting evidence later | IT-8.3 | 1 | 1 | 1 |
| Reading unexpected MFA push prompts as an app, clock or sync glitch | IT-10.1 | 1 | 1 | 1 |
| Thinking a standard format or degaussing works for every drive type | IT-10.3 | 1 | 1 | 1 |
| Replacing parts or software before proving the cheap power layer | IT-3.3 | 1 | 1 | 1 |
| Mixing up the category word (memory, storage, socket) with the part being identified | IT-2.1 | 1 | 1 | 1 |
| Mixing up standard, normal and emergency changes | IT-12.1 | 1 | 1 | 1 |
| Mixing up a chain-of-custody record with an incident timeline or an asset list | IT-10.4 | 1 | 1 | 1 |
| Misreading Linux permission notation (which triplet is owner, group and others, and the octal values) | IT-9.1 | 1 | 1 | 1 |
| Fixing a guest’s resource limit inside the guest instead of in its VM settings | IT-6.3 | 1 | 1 | 1 |
| Treating an interruption as a request (or a new need as an incident) | IT-1.1 | 1 | 1 | 1 |
| Inventing a switch on an adapter, update or process cmdlet to read the BIOS serial | IT-13.1 | 1 | 1 | 1 |
| Starting a rebuild with only verbal OK, or nothing in place | IT-11.2 | 1 | 1 | 1 |
| Blaming the firewall, file permissions or the file extension when PowerShell says running scripts is disabled | IT-13.2 | 1 | 1 | 1 |
| Treating an .iso as a program to rename or copy rather than a disc image to mount | IT-8.2 | 1 | 1 | 1 |
| Recording a test as an impression (“looked fine”, “all good”) instead of the action, target and result | IT-7.1 | 1 | 1 | 1 |
| Treating a fleet-wide failure after a change as many single-PC repairs | IT-11.1 | 1 | 1 | 1 |
| Mixing up which Windows event records an application crash | IT-11.1 | 1 | 1 | 1 |
| Expecting a NIC-teaming/LACP mismatch to show as addressing or speed faults rather than an unstable aggregate | IT-5.3 | 1 | 1 | 1 |
| Reading an APIPA 169.254 address as a DNS problem or a healthy lease | IT-5.1 | 1 | 1 | 1 |
| Rebuilding the profile or the domain join when the laptop only needs to sign in once on the network | IT-8.4 | 1 | 1 | 1 |
| Mixing up full, incremental and differential backups | IT-12.3 | 1 | 1 | 1 |
| Mixing up the range and use of NFC, Bluetooth and Wi-Fi | IT-4.2 | 1 | 1 | 1 |
| Treating an eSIM as a card or file that can be moved, copied or cloned | IT-4.2 | 1 | 1 | 1 |
| Mixing up IPv6 address types by prefix | IT-5.1 | 1 | 1 | 1 |
| Counting usable hosts without removing the network and broadcast addresses | IT-5.1 | 1 | 1 | 1 |
| Weakening protection (firewall off, a password written in the note) while handling a security report | IT-10.2 | 1 | 1 | 0 |
| Choosing protection that does not match the hazard | IT-1.2 | 1 | 1 | 1 |
| Mixing up what a surge suppressor and a UPS protect against | IT-1.2 | 1 | 1 | 1 |
| Putting drivers or parts before backing up and testing the user’s data in a rebuild plan | IT-11.3 | 1 | 1 | 1 |
| Wiping or locking a personal phone that is leaving BYOD instead of retiring it | IT-4.2 | 1 | 1 | 1 |
| Thinking the firewall may be turned off for convenience if you are admin or have a snapshot | IT-8.2 | 1 | 1 | 1 |
| Using a command or view that changes state when you meant to read it | IT-13.3 | 1 | 1 | 1 |
| Believing everyday materials (plastic bags, rubber soles) protect parts from ESD | IT-1.2 | 1 | 1 | 1 |
| Closing on your own test instead of confirming with the user | IT-7.3 | 1 | 1 | 1 |
| Thinking the user needs no update, or a guessed cause, once the ticket is escalated | IT-7.4 | 1 | 1 | 1 |
| Charging, prying or reinstalling around a swollen MacBook battery | IT-9.2 | 1 | 1 | 1 |
| Doing the malware-removal steps out of order (e.g. remediating before quarantining) | IT-10.2 | 1 | 1 | 1 |
| Believing a suspended BitLocker drive is still fully protected | IT-10.3 | 1 | 1 | 1 |
| Treating an AP admin password change as optional or a silent repair | IT-5.4 | 1 | 1 | 0 |
| Confusing the backout plan with the communication plan, the justification or the approval record | IT-12.1 | 1 | 1 | 1 |
| Reading the OOM killer as a disk, CPU or network problem | IT-9.1 | 1 | 1 | 1 |
| Starting mobile troubleshooting with the most drastic step (factory reset) first | IT-4.2 | 1 | 1 | 1 |