Chapter 30 — Capstone assessment
Lesson map
Lesson 30 published. Map, example, EX088.
flowchart TD
N0["Learning outcomes"]
N1["30.1 Panel agenda"]
N2["30.2 Defence with citations"]
N3["30.3 The refusal question"]
N4["30.4 After the panel"]
N5["30.5 Portfolio entry"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX088"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["30.1 Panel agenda"]
N2["30.2 Defence with citations"]
N3["30.3 The refusal question"]
N4["30.4 After the panel"]
N5["30.5 Portfolio entry"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX088"]
[Learning outcomes]
|
v
[30.1 Panel agenda]
|
v
[30.2 Defence with citations]
|
v
[30.3 The refusal question]
|
v
[30.4 After the panel]
|
v
[30.5 Portfolio entry]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX088]
Learning outcomes
You will (1) present the capstone package to a review panel; (2) defend scope, method and residual-risk choices with cited frameworks; (3) answer "what would you refuse?" correctly; (4) identify your next course step without claiming the book is finished.
30.1 Panel agenda
Ten minutes: decision and scope. Ten minutes: method and gates. Ten minutes: evidence, rating and report. Ten minutes: purple-team learning and retest. Ten minutes: questions. The panel holds the ROE and the checker outputs while you speak.
Priya keeps a visible timer on the desk, and the panel kit checklist fails readiness if one is missing. The time boxes protect the later blocks: a candidate who spends twenty minutes on technical detail leaves no time to show purple-team learning or the retest plan. Because the panel holds the ROE and checker outputs, every claim can be checked against an artefact as it is made.
30.2 Defence with citations
When asked why exclusions come first, cite Chapter 2 and the ROE practice. When asked why you borrow a white team, cite TIBER-EU/CBEST ideas. When asked how you rated F-09, show the matrix. Opinions without artefacts score poorly.
Priya practises these answers aloud and keeps them on a one-page crib sheet, which the panel allows on the desk. For F-09 she opens the rating matrix and walks through the likelihood and impact cells rather than defending the rating from memory. An answer that points to an artefact lets the panel check it, while a confident opinion leaves them nothing to verify.
30.3 The refusal question
Panels ask what you would refuse. Strong answers: testing without a reachable white team; fare-payment contact; mid-window scope expansion by chat; providing exploit steps; keeping evidence on a personal laptop. Weak answers: "nothing, we are flexible."
Each strong answer names a condition and the reason it ends the work, such as no reachable white team meaning nobody can authorise a stop or a restart. Oral safety fails if any of the four classes of refusal is missing: white-team absence, fare-payment contact, chat-based scope expansion and exploit steps. A flexible answer suggests the candidate has not yet thought about where the boundaries are.
30.4 After the panel
Pass means the package meets the Chapter 29 rubric and the oral defence showed judgement. It does not mean the manuscript has passed A4 or independent review. The next course in the study path is course 089, AI and machine-learning security for technologists.
Before questions end, Priya says aloud that the package uses synthetic data and that a pass carries no live authority. That sentence is on the pass-script checklist, because candidates sometimes describe a course pass as if it certified them to test real systems. Saying the limits clearly is part of the judgement the panel is assessing.
30.5 Portfolio entry
After the panel, Priya files a short portfolio note: which artefacts she led, which refusal she practised, which detection tickets she opened. The note cites ENG-712 and labels everything synthetic. Future employers reading a portfolio should see judgement, not a claim that she "hacked a transit agency."
Priya's note lists the evaluation sheet and the handoff pack as artefacts she led, the fare-payment refusal as the one she practised, and DET-19 as a ticket she opened. Wording such as hacked a transit agency is banned from the note, because it is false for a synthetic exercise and suggests the wrong attitude to an employer.
Worked example
Priya presents ENG-712's package. She is asked to expand into fare-payment "just this once". She refuses, quotes the exclusion language, and offers a separate engagement proposal if the fare owner authorises it. She is asked for exploit steps for T1552.001; she points to the ATT&CK page and to the book's boundary. The panel marks safety and residual-risk honesty as strengths.
Synthetic case. The panel exchange is invented for assessment practice.
Errors and limits
Memorising framework names without tying them to a decision fails. Claiming accreditation from this draft fails.
Exercises
- EX088 — Refuse list. Give three distinct refusals a technologist must be ready to make. Rubric: 3 = three from no white team / excluded systems / chat scope change / exploit steps / personal evidence stores; 2 = two; 1 = one; 0 = none.
- EX089 — Citation defence. In one sentence, defend why logged ≠ alerted using Chapter 19 language. Rubric: 3 = detect-and-respond goal needs notification/response, not only telemetry; 2 = partial; 1 = logged is enough; 0 = none.
- EX090 — Next step. What is the next course after this book's chapter 30, and what must you not claim about this draft? Rubric: 3 = course 089 AI security + no claim of finished/A4/accredited book; 2 = one part; 1 = wrong course; 0 = none.
Synthesis
Present artefacts, cite frameworks, practise refusal, and leave with humility about what a draft manuscript is.
Continue studying — chapter 30 of 30
← Chapter 29 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →