◇ OpenCyber Academy
Bachelor's · Chapter 39 · English

Chapter 39 — Capstone evaluation

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 39 — Capstone evaluation

Lesson map

Lesson 39 published. Map, example, EX115.

flowchart TD
  N0["Learning outcomes"]
  N1["39.1 Against the proposal"]
  N2["39.2 Quality of conclusions"]
  N3["39.3 Method reflection"]
  N4["39.4 Improvements for the security office"]
  N5["39.5 Personal learning"]
  N6["39.6 External check"]
  N7["39.7 Honesty"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX115"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["39.1 Against the proposal"]
  N2["39.2 Quality of conclusions"]
  N3["39.3 Method reflection"]
  N4["39.4 Improvements for the security office"]
  N5["39.5 Personal learning"]
  N6["39.6 External check"]
  N7["39.7 Honesty"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX115"]

[Learning outcomes]
    |
    v
[39.1 Against the proposal]
    |
    v
[39.2 Quality of conclusions]
    |
    v
[39.3 Method reflection]
    |
    v
[39.4 Improvements for the security office]
    |
    v
[39.5 Personal learning]
    |
    v
[39.6 External check]
    |
    v
[39.7 Honesty]
    |
    v
[Worked example] --> [Exercise EX115]

Learning outcomes

You will (1) evaluate the capstone against its proposal; (2) assess the quality of conclusions; (3) reflect on method; (4) identify improvements.

39.1 Against the proposal

All four questions answered with stated limits; sensitivity exercise completed; archive reproducible; second host added (change recorded). Deliverables met on schedule except the report draft, one week late due to the date-parsing fix.

The evaluation is honest about the delay and its cause, which assessors value more than a perfect record. Every deliverable is checked against the proposal's list. The one-week slip used part of the margin built into the schedule, so the final presentation stayed on time in week 12.

39.2 Quality of conclusions

Each conclusion is graded by the strength of its support: Q1 strong (email, proxy, browser and file evidence agree); Q2 persistence strong, full behaviour pending specialist analysis; Q3 partial (mailbox forwarding shown, file share unknown); Q4 moderate (no indicator contact in logs examined; other egress paths not covered).

Grading each conclusion tells readers how much weight to put on it. A strong conclusion is supported by several independent sources; a partial one has known gaps; a moderate one is limited by coverage. These grades come directly from the sensitivity exercise, so they rest on evidence rather than on Leah's impression.

39.3 Method reflection

The evidence matrix early on saved time; the clock offset should have been checked at more than one point; tool time-zone settings should be standardised before analysis begins.

Each reflection points to a specific change. Building the evidence matrix early showed gaps before they became surprises. Measuring the clock offset at more than one point would have answered the defence question directly. Setting tools to UTC at the start would have prevented the one-hour disagreement. These become her own working rules.

39.4 Improvements for the security office

Retain identity and mailbox logs longer; enable file share access logs; standardise UTC display in tools; hold reimaging on alert.

Each recommendation comes from a finding: longer retention from the sensitivity exercise, file share logs from Q3's gap, UTC display from the tool disagreement, and the reimaging hold from the architecture review. Linking recommendations to evidence makes them easier to justify to those who fund them. Each one names an owner and a rough cost, and the list is ordered by how much each would have changed the ws-114 investigation's results, using the sensitivity exercise as the measure.

39.5 Personal learning

Leah notes she learned most from verification failures and peer challenges.

Verification failures, like the one-hour disagreement, taught her how tools can mislead. Peer challenges, like the offset question, showed her where her reasoning needed more support. Both are uncomfortable but useful, and she notes that the course's emphasis on review prepared her to welcome them rather than defend against them. She plans to keep asking a colleague to challenge her findings in future work, even when no formal review is required. The reflection is short and specific, naming the incidents that taught her most.

39.6 External check

Grace reviews the evaluation and agrees with the grades, adjusting Q4 to "moderate, pending firewall review".

Grace's adjustment of Q4 reflects knowledge Leah did not have: firewall logs had not yet been reviewed for other egress paths. The external check strengthens the evaluation by bringing in another view. Leah records the change and its reason, so the final grade is traceable to Grace's review. If the firewall review later finds no other egress path used, Q4 can be upgraded with that evidence. Leaving the grade open rather than guessing keeps the evaluation honest about what was actually checked.

39.7 Honesty

Delays and errors are reported plainly.

Reporting delays and errors plainly shows readers that the rest of the report can be trusted. Hiding the date-parsing bug might have saved embarrassment but would have left the archive inconsistent with the record. Assessors are told what went wrong and how it was fixed, which is the same standard applied to the investigation itself. The evaluation lists each problem with its date, effect on the work and fix. Readers who find no errors listed in a project of this size should be suspicious; a short, honest list is more credible.

What would change the conclusions

Leah lists findings that could overturn her answers: firewall logs showing ws-114 contacting other hosts would change Q4; file share logs from a backup system might settle Q3; specialist analysis of update.dll could reveal data theft capabilities relevant to Q2. Naming these keeps conclusions open to new evidence and tells the security office where to look next.

Worked example

Leah's evaluation table lists each question, answer, supporting sources, grade and limiting factor. For Q3: "Partial — mailbox forwarding of 37 messages shown; file share access unknown (logging disabled)."

Synthetic case. The evaluation is invented.

Errors and limits

Self-evaluation tends to be generous; external review and explicit criteria counter this.

Exercises

Synthesis

Evaluate honestly against the plan, grade each conclusion's support and turn lessons into improvements.

Continue studying — chapter 39 of 40

← Chapter 38 (draft) · Course chapter index · Chapter 40 (draft) →