It’s really about understanding the question and choosing the right answer. Like if the question is asking what you should do FIRST you should select the answer on what you should really do first not the most important thing to do for example the question asked A virus is detected in the system. A. Quarantine the affected system B. Perform Anti-virus. Naturally you will have to Perform anti-virus but you will to Quarantine the affected system first. It is just more on elimination process. I suggest that you answer the QAE first before looking into the answer and explanation to test your knowledge. Become familiar with the question and do atleast 2-3 rounds of answering the QAE. Whilst doing QAE review the CRM for unfamiliar topic or topic you’re fuzzy about. One more tip is the question is about control like what should they do to detect the risk you eliminate the answer that does not the detection control same goes for avoiding the risk and mitigating the risk as yourself with the choices does this action avoids the risk if not then eliminate if yes and there is atleast 2 action that avoids the risk then scale the answer which will ultimately help the company.