Final Assessment
The final assessment tests your understanding of core cybersecurity concepts, threat landscape knowledge, and framework familiarity. You will demonstrate your ability to analyze security scenarios, apply the CIA Triad, identify threat actors and their TTPs, and recommend appropriate controls from established frameworks. This assessment validates your readiness to pursue more advanced courses in the academy.
Learning Objectives — Deep Dive
Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.
Analyze CIA violations
Read the full scenario carefully and identify every CIA triad violation present: confidentiality violations (unauthorized access to or disclosure of data), integrity violations (unauthorized modification of data or systems), and availability violations (disruption of access to systems or data). For a ransomware scenario, all three are typically violated: confidentiality (data exfiltration before encryption), integrity (files are encrypted and rendered unusable), and availability (systems are inaccessible until decryption). Document each violation with the specific evidence from the scenario that supports your classification — vague statements like 'confidentiality was violated' without citing the specific data or system are not sufficient for a professional analysis.
Identify the threat actor
Classify the threat actor using the standard categories: nation-state (sophisticated, well-resourced, motivated by espionage or geopolitical goals), cybercriminal (financially motivated, may use ransomware or fraud), hacktivist (ideologically motivated, typically targets organizations for public embarrassment), insider threat (current or former employee with legitimate access), or script kiddie (low-skill attacker using existing tools without deep understanding). For each category, identify the indicators in the scenario that support or contradict that classification: the sophistication of the attack, the apparent motivation, the specific tools and techniques used, and any attribution clues such as language artifacts in malware or known infrastructure. Threat actor classification informs the defensive response — a nation-state adversary requires different countermeasures than a ransomware gang.
Map to the Kill Chain
Map every attacker action described in the scenario to the corresponding Cyber Kill Chain phase: Reconnaissance (information gathering), Weaponization (creating the attack tool), Delivery (transmitting the weapon to the target), Exploitation (triggering the vulnerability), Installation (establishing persistence), Command & Control (maintaining communication with the compromised system), and Actions on Objectives (achieving the attacker's goal). For each phase, identify what defensive control was absent or failed that allowed the attacker to progress. A complete kill chain mapping shows the full attack timeline and identifies the earliest point at which the attack could have been detected or stopped — this is the most actionable output of the analysis for improving defenses.
Apply NIST CSF
Map each identified gap and failure from your kill chain analysis to the corresponding NIST CSF Function and Category. A failure to detect lateral movement maps to DE.CM (Security Continuous Monitoring). A missing patch that was exploited maps to PR.IP (Information Protection Processes and Procedures) and ID.RA (Risk Assessment). An inadequate incident response maps to RS.RP (Response Planning) and RS.CO (Communications). This mapping translates a specific incident into a structured set of program improvements that can be prioritized and tracked. Present the mapping as a table with columns for the incident finding, the CSF reference, the current maturity level, and the recommended improvement — this format is immediately usable as input to a security program roadmap.
Write recommendations
Write a set of prioritized, specific, and actionable recommendations based on your analysis. Each recommendation should follow the format: finding (what went wrong), root cause (why it went wrong), recommendation (what should be done), priority (Critical/High/Medium/Low based on risk), and effort estimate (days/weeks/months to implement). Avoid generic recommendations like 'improve security awareness' — instead write 'implement a quarterly phishing simulation program using a platform such as KnowBe4 or GoPhish, targeting all employees, with mandatory remedial training for those who click simulated phishing links.' Specific recommendations demonstrate that you understand both the technical problem and the organizational context required to fix it, which is the hallmark of a mature security professional.