Chapter 12 — Practice portfolio and final review | Professional Authorized offensive security and red team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 12 — Practice portfolio and final review

Lesson map

Lesson 12 published. Map, example, EX056.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Portfolio contents"]
  N2["12.2 Presentation"]
  N3["12.3 Gaps"]
  N4["12.4 Standing rules"]
  N5["12.5 Handoff"]
  N6["12.6 Portfolio integrity"]
  N7["12.7 Continuing education"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX056"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Portfolio contents"]
  N2["12.2 Presentation"]
  N3["12.3 Gaps"]
  N4["12.4 Standing rules"]
  N5["12.5 Handoff"]
  N6["12.6 Portfolio integrity"]
  N7["12.7 Continuing education"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX056"]

[Learning outcomes]
    |
    v
[12.1 Portfolio contents]
    |
    v
[12.2 Presentation]
    |
    v
[12.3 Gaps]
    |
    v
[12.4 Standing rules]
    |
    v
[12.5 Handoff]
    |
    v
[12.6 Portfolio integrity]
    |
    v
[12.7 Continuing education]
    |
    v
[Worked example] --> [Exercise EX056]

Learning outcomes

You will (1) assemble a portfolio of artifacts from this course; (2) present to a supervisor; (3) identify gaps for the next course; (4) restate standing safety rules.

12.1 Portfolio contents

ROE checklist result; scope-check output; filtered finding list; one executive finding paragraph; one engineer finding paragraph; ticket hygiene screenshot; reflection from the supervised lab. Each artefact is one Leo produced in this course, with dates. Alongside them the portfolio holds the scoped plan, validated findings with evidence hashes, the ENG-440-style report and retest notes. Together they show he can scope, filter, write for two audiences, track remediation and reflect — the practitioner outputs from Chapter 1. Synthetic member data only; real identifiers never enter the pack.

12.2 Presentation

Ten minutes: context of HCU, how you stayed in scope, top two findings, verification plan, what you will not do alone yet. Presentation to the CISO leads with decisions needed, then method and evidence appendices. Leo practises a ten-minute cut so payday urgency does not force a jargon-heavy dump that buries the cookie-flag owner and due date. His ten minutes end with what he will not do alone yet, such as leading a threat-led scenario. Honesty about limits is part of the presentation, not a footnote.

12.3 Gaps

Leo notes he has not yet led a threat-led (CBEST/TIBER-style) scenario or a full WSTG pass — topics for longer courses. Those gaps go on his development plan beside the portfolio. Longer courses and supervised practice close them; claiming them now would misrepresent readiness. HCU's own limits, the AS/400 exclusion and the absence of a threat-led exercise, are written in the portfolio as owned limits, not hidden, so examiners do not invent coverage they will not find in the ROE. Naming gaps shows judgment.

12.4 Standing rules

No authorization, no test. No exploit code on real systems. Stop means stop. Evidence stays controlled. Leo prints those four lines on the portfolio cover and on the first page of every engagement folder; they are the standing rules when pressure rises before an exam. The cover also restates the ROE rules Leo will not start without: staging first, no password spraying, stop if member data appears unexpectedly, and delete within 30 days. It carries the emergency contact rule too, because that empty field nearly started Leo's first window, and he still will not start without the emergency_contact field filled.

12.5 Handoff

Store the portfolio in HCU's training record so the next supervisor sees evidence, not only a completion tick. A completion tick without artefacts forces the next supervisor to rediscover Leo's strengths and gaps; the training record should open to evidence. Handoff to the next analyst includes the vault path, the status of open tickets T-15 and T-18, and the emergency contact field now filled. Email alone is not handoff and leaves the next analyst guessing, so a walkthrough of the jump environment is scheduled before Leo steps away.

12.6 Portfolio integrity

Artifacts in the portfolio must be the ones Leo actually produced in this course, with dates. Replacing them with polished samples from the internet misrepresents skill and is treated as academic dishonesty; downloaded sample reports, however polished, are not evidence of Leo's skill, and examiners who ask him to explain an artefact he did not write will notice. Portfolio integrity also means hashes on evidence files and a changelog when a finding is updated after peer review. Quiet edits after sign-off are refused; the CISO sees the same pack the peer reviewed.

12.7 Continuing education

After acceptance, Leo schedules one skill to deepen each month — this quarter, OWASP WSTG session management on staging under authorization — and records it next to the portfolio so progress is visible in reviews. Continuing education for Leo also includes WSTG updates and ATT&CK technique refreshes for T1078, logged beside the portfolio so examiners see currency. Conference talks that would publish HCU-specific paths stay off the continuing-education list on purpose. The monthly skill is chosen from the gaps on his development plan, so a full WSTG pass is built up one area at a time.

12.8 Safety restatement on the portfolio cover

The first page of Leo's portfolio states: no real systems were tested in this course; all labs used synthetic data; exploit code was neither used nor requested. Readers who open the portfolio first see that safety boundary: synthetic labs only, no live HCU scanning, no exploit code. That restatement protects Leo and HCU if the file is shared with a new supervisor or examiner. The cover also restates that testing finds what patching, logging and training missed under written permission, and that a clean report still leaves everyday hardening to product and network teams. Safety language is not an appendix; it is the first page.

Worked example (synthetic HCU)

Leo presents; the supervisor accepts the portfolio with one action: add the emergency-contact near-miss to the team onboarding page. Next course link: AI security (043).

Synthetic case — Harborline Credit Union (HCU). The credit union, Leo Okonkwo and all figures are invented for teaching.

Errors and limits

Local policies and laws differ; follow HCU's authorization and your jurisdiction. This book never authorizes testing of real systems.

Exercises

EX056 — Portfolio artifacts. List five portfolio artifacts. Rubric: 3 = five from the contents list; 2 = three; 1 = one; 0 = none.
EX057 — Presentation must-say. What must Leo say about scope in the presentation? Rubric: 3 = how he stayed in scope / exclusions / pause-to-ask; 2 = partial; 1 = skip it; 0 = none.
EX058 — Gap honesty. Why list gaps in the portfolio? Rubric: 3 = shows limits; guides next training; builds trust; 2 = partial; 1 = hide gaps; 0 = none.
EX059 — Standing rule. State the standing rule about exploit code. Rubric: 3 = never on real systems / not taught for use outside auth lab policy; 2 = partial; 1 = ok if careful; 0 = none.
EX060 — Next course. What is the next course number and topic? Rubric: 3 = 043 AI security; 2 = AI; 1 = wrong; 0 = none.

Synthesis

A portfolio proves authorized practice; gaps and safety rules travel with you to the next course.

Continue studying — chapter 12 of 12

← Chapter 11 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →