Chapter 30 — Capstone assessment
Lesson map
Lesson 30 published. Map, example, EX088.
flowchart TD
N0["Learning outcomes"]
N1["30.1 Assessment panel"]
N2["30.2 Design defence"]
N3["30.3 Impact"]
N4["30.5 Questions"]
N5["30.6 Next steps for the city"]
N6["30.7 Next steps for Jonah"]
N7["Feedback from the panel"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX088"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["30.1 Assessment panel"]
N2["30.2 Design defence"]
N3["30.3 Impact"]
N4["30.5 Questions"]
N5["30.6 Next steps for the city"]
N6["30.7 Next steps for Jonah"]
N7["Feedback from the panel"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX088"]
[Learning outcomes]
|
v
[30.1 Assessment panel]
|
v
[30.2 Design defence]
|
v
[30.3 Impact]
|
v
[30.5 Questions]
|
v
[30.6 Next steps for the city]
|
v
[30.7 Next steps for Jonah]
|
v
[Feedback from the panel]
|
v
[Worked example] --> [Exercise EX088]
Learning outcomes
You will (1) present the capstone for assessment; (2) defend design choices; (3) evaluate impact honestly; (4) plan next steps for the city and yourself.
30.1 Assessment panel
Course tutor, Renata, and the IT manager. Jonah presents for fifteen minutes and demonstrates the kit on a synthetic machine.
The panel combines academic, technical and management views: the tutor assesses learning outcomes, Renata assesses forensic quality and the IT manager assesses usefulness to the city. A live demonstration on a synthetic machine shows the kit working rather than described. Each panel member scores against a rubric shared in advance, so Jonah knows what will be judged. The rubric is published with the course materials.
30.2 Design defence
"Why standard library only?" Fewer dependencies to validate and install on sensitive machines. "Why not buy a commercial platform?" Budget, and the city needed processes and records first; the pack is compatible with a future platform.
Good defences give reasons tied to the city's situation rather than general preferences. The standard-library choice follows from the need to validate everything that runs on evidence machines; the decision not to buy a platform follows from budget and from the fact that processes and records were missing, which no product would supply. Jonah also states what would change his mind.
30.3 Impact
Before: no desktop log forwarding, 30-day application logs, 1 of 8 staff trained, about 2 hours to memory capture. After: 94% desktops forwarding, 12-month retention, 8 of 8 trained, 31 minutes in end-to-end testing.
Each figure is traceable to the evaluation and the end-to-end test. Jonah notes that the before time came from a real incident and the after time from a test, so the comparison flatters the new process. He also uses the desktop-only forwarding figure of 94 per cent rather than the combined figure, following the county reviewer's advice.
30.4 Honest limits
USB activity still unlogged; eight desktops pending replacement; exercises faster than real incidents.
Stating limits before the panel asks shows that the evaluation is honest. Each limit is linked to a planned action: USB logging to the readiness list, the old desktops to replacement, and the exercise-time caveat to the panel's suggestion to measure real incidents. Limits without actions would leave the city knowing about risks but not managing them. Jonah also names the limits of his own role: he built and tested the pack but did not run it in a real incident.
30.5 Questions
"What would you do if the evidence store failed?" Restore from the write-once backup and verify against manifests; the runbook exists and was tested once.
The answer is credible because the runbook exists and was tested, but Jonah notes it was tested only once, so the city should repeat the test after any change to backups or storage. Other questions might concern the old desktops or the payments provider; Jonah prepares answers from the evaluation and the known-issues list rather than improvising.
30.6 Next steps for the city
Replace old desktops; review payments provider contract; run a joint exercise with the county.
Each step closes a known gap: replacing old desktops brings their logs into forwarding, reviewing the payments contract addresses its 30-day retention, and a joint exercise with the county tests coordination beyond the city. Owners and dates come from the known-issues list, so the next steps are already tracked rather than merely recommended. Renata owns the joint exercise and sets its date with the county before the panel closes.
30.7 Next steps for Jonah
He applies for an analyst role and plans to continue to further study.
The placement and capstone give him evidence of practical competence: a kit he built, a study he ran and a real incident he supported under supervision. His reflection log shows how his practice changed, from pausing an antivirus scan in his first week to designing the procedures others now follow. He keeps the placement confidentiality agreement in mind when describing that work to employers. Renata agrees to act as a referee.
Feedback from the panel
The panel's main suggestion is to measure real incident times over the next year and compare them with exercise times, to see how much faster exercises are than reality. Jonah adds this to the city's next steps with Renata as owner, and records the panel's other comments in the capstone archive with his responses.
Worked example
The IT manager asks for one sentence for the council. Jonah: "After the May incident, the city can now detect, preserve and scope a similar attack in under an hour, with records that would stand up to review; two gaps remain and are scheduled."
Synthetic case. The assessment is invented.
Errors and limits
Assessment captures the moment; capability decays without practice and maintenance.
Exercises
- EX088 — Standard library. How did Jonah justify standard-library scripts? Rubric: 3 = fewer dependencies to validate/install on sensitive machines; 2 = partial; 1 = cheaper; 0 = none.
- EX089 — Impact figures. Give two before/after figures. Rubric: 3 = e.g. 0%→94% desktop forwarding; 30 days→12 months; 2 = one; 1 = vague; 0 = none.
- EX090 — Council sentence. What makes the council sentence good? Rubric: 3 = plain, specific capability, mentions remaining gaps; 2 = partial; 1 = jargon; 0 = none.
Synthesis
Defend designs with reasons, report impact with figures and limits, and plan for continued practice.
Continue studying — chapter 30 of 30
← Chapter 29 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →