Chapter 50 — Final defense
Lesson map
Lesson 50 published. Map, example, EX148.
flowchart TD
N0["Learning outcomes"]
N1["50.1 The defense"]
N2["50.2 Presentation"]
N3["50.3 Expected questions"]
N4["50.4 Answering"]
N5["50.5 Professional questions"]
N6["50.6 Reflection"]
N7["50.7 Next steps"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX148"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["50.1 The defense"]
N2["50.2 Presentation"]
N3["50.3 Expected questions"]
N4["50.4 Answering"]
N5["50.5 Professional questions"]
N6["50.6 Reflection"]
N7["50.7 Next steps"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX148"]
[Learning outcomes]
|
v
[50.1 The defense]
|
v
[50.2 Presentation]
|
v
[50.3 Expected questions]
|
v
[50.4 Answering]
|
v
[50.5 Professional questions]
|
v
[50.6 Reflection]
|
v
[50.7 Next steps]
|
v
[Worked example] --> [Exercise EX148]
Learning outcomes
You will (1) present and defend the engineering work; (2) answer technical and professional questions; (3) reflect on development across the course; (4) plan continued professional growth.
50.1 The defense
A 30-minute presentation and 45 minutes of questions from an academic examiner and an industry examiner.
The two examiners bring different perspectives: the academic checks method and reasoning, the industry examiner checks practical value and professional judgement. Thirty minutes forces Amara to focus on the most important points. Forty-five minutes of questions tests whether she understands the work deeply enough to defend it. The examiners have read the thesis and dossier beforehand, so questions can go straight to detail. The outcome is decided privately after the session and given to Amara the same day.
50.2 Presentation
Problem and evidence of need; requirements; design and review; results against requirements; failures and fixes; remaining gaps; lessons.
The order follows the thesis argument. Including failures and fixes shows learning, not only success. Amara rehearses with Paolo and a classmate, timing each part so she does not run out of time before the results. Slides carry few words and clear figures, such as the stacked stage-time bars, which the examiners can read quickly. Every result slide names its evidence ID so examiners can check the dossier during questions.
50.3 Expected questions
"Why not deploy agents?" "How do you know five false alerts per week is acceptable?" "What happens when the person maintaining the approved-device list leaves?" "What would you do differently?"
Preparing for likely questions lets Amara answer clearly rather than improvising. Each question probes a different weakness: design choices, how a threshold was set, sustainability after she leaves, and self-reflection. She writes short answers backed by evidence for each and practises delivering them. She also prepares for the question she fears most, about the uncovered web interface path.
50.4 Answering
Answer directly, show evidence, admit limits. On false alerts: the night shift agreed the threshold based on measured triage time; it is reviewed quarterly.
Direct answers show confidence; evidence shows the answer is grounded; admitting limits shows honesty. The false-alert threshold came from measured triage time and agreement with the night shift, not from a guess, and quarterly review ensures it stays appropriate. When she does not know an answer, Amara says so and explains how she would find out, which examiners generally respect more than a confident guess that later turns out to be wrong.
50.5 Professional questions
The industry examiner asks how Amara handled a disagreement with depot managers; she describes rescheduling around dispatch and what she learned.
The industry examiner is interested in how Amara works with others, a skill that matters as much as technical ability in a SOC. Describing a real disagreement and how she resolved it, by rescheduling around dispatch, shows she can balance security goals with business needs. She admits that her first proposal ignored dispatch peaks and explains how the managers' feedback changed the rollout schedule.
50.6 Reflection
From calculus of queues in chapter 1 to the capstone, the course built a path: model, measure, design, verify, validate, operate.
The path from modelling queues to building and validating a detection shows how the early chapters' tools became practical skills. Each step built on earlier ones: measurement relied on statistics, design on architecture, verification on programming. Amara sees the course as a single connected method rather than separate subjects. The examiners ask which early subject she used most; she names statistics, because almost every decision rested on measured rates and percentiles.
50.7 Next steps
Amara plans to join Lindqvist as a junior detection engineer and to study for further qualifications.
Joining Lindqvist lets Amara continue the depot work, including the follow-up on the web management interface. Further qualifications deepen her knowledge in areas she found challenging during the capstone. She leaves the placement with a clear plan and a record of evidence of what she can do. Paolo agrees to stay her mentor during her first year, and they set goals for her first six months on the team.
Preparing
Amara rehearses twice with Paolo and once with fellow students who play hostile examiners. Each rehearsal produces a list of weak answers, which she strengthens with evidence from the dossier. She prepares backup slides for detailed questions on latency and completeness but keeps the main talk short and focused on decisions.
After the defense
Examiners return minor corrections within a week: two figures need clearer units and one limitation needs expanding. Amara makes them, her tutor confirms, and the final thesis and dossier index are deposited.
Worked example
Asked "What would you do differently?", Amara answers: "Start operational scheduling in design, test under busy conditions earlier, and involve analysts in requirements from day one — every late fix in my project traced to one of those."
Synthetic case. The defense is invented.
Errors and limits
A defense samples the work; the dossier carries the full evidence.
Exercises
- EX148 — Talk outline. Outline the defense presentation. Rubric: 3 = need, requirements, design/review, results, failures, gaps, lessons; 2 = five; 1 = two; 0 = none.
- EX149 — Threshold justification. How did Amara justify five false alerts per week? Rubric: 3 = agreed with night shift from measured triage time; reviewed quarterly; 2 = partial; 1 = arbitrary; 0 = none.
- EX150 — Differently. What three things would Amara do differently? Rubric: 3 = scheduling in design, busy testing earlier, analysts in requirements; 2 = two; 1 = one; 0 = none.
Synthesis
The defense closes the course: model, measure, design, verify, validate and operate, with honest reflection on what to improve.
Continue studying — chapter 50 of 50
← Chapter 49 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →