Unit 15: Cybersecurity II Capstone Project
Lesson at a glance
| Item | Detail | | --------------------- | --------------------------------------------------------------------------------------- | | Suggested length | 10 × 60 minutes (final two weeks) | | Recommended placement | Weeks 21–22 | | Prerequisite | Units 1–14 | | Materials | Capstone option packets, panel rubric, presentation slides template, signed RoE on file |
Safety: Capstone work is performed within the lab range under signed RoE. No external systems. No personal data. Teacher conferences mandatory at midpoint.
Standards & credential alignment
- VA CTE Cybersecurity Capstone standards.
- NICE Workforce Framework - work-role-aligned demonstrations.
- OffSec PEN-100 / SOC-100 breadth demonstration.
Learning objectives
By the end of the capstone, students can:
- Plan, scope, execute, and document a substantial cybersecurity project.
- Present findings to a panel of professionals (mock or real).
- Defend technical choices and respond to pushback.
- Tie capstone work to an explicit career direction.
Capstone options (pick one)
Option A - Red Team / Blue Team Simulation
Two teams. One attacks the lab range under written RoE. One defends with the SIEM and IR playbook. Teacher referees.
Deliverables:
- Attacker pen test report (Unit 13 standard).
- Defender incident report + timeline (Unit 9 standard).
- Joint after-action report: what worked, what got missed, what the playbook should change.
Option B - SOC Investigation
Teacher provides a curated incident dataset (logs, packet captures, memory image, disk artifacts). Solo or pair.
Deliverables:
- Triage notes.
- ATT&CK-mapped timeline.
- IOC list.
- 8–12 page incident report.
- 7-minute panel presentation.
Option C - Secure Enterprise Build
Design and build a small enterprise from scratch in the lab:
- Active Directory or Azure AD lab.
- Three workstations, one server, one firewall.
- Hardened to a documented baseline (CIS or in-house).
- Monitoring (Wazuh or Security Onion).
- A tested IR runbook for one incident type.
- A written 5-page architecture rationale + threat model.
Deliverables:
- Architecture diagram.
- Hardening checklist with evidence.
- Threat model.
- Demo + 7-minute walk-through.
Option D - Professional Portfolio
A polished public portfolio that wins the first job:
- 5+ written, sanitized lab write-ups.
- 1 long-form post (technical deep-dive).
- A working personal site (GitHub Pages OK).
- A 60-second introduction video.
- A complete LinkedIn profile + resume.
- A 24-month plan (refined from Unit 14).
Deliverables:
- Live URL of portfolio.
- Resume + LinkedIn snapshot.
- 7-minute presentation that walks the panel through the portfolio.
Pacing - full unit (10 days)
| Day | Focus | | --- | -------------------------------------------------------- | | 1 | Capstone selection + scoping document | | 2 | Plan + RoE / authorization sign-off | | 3–4 | Deep work block 1 | | 5 | Mid-point conference with teacher (mandatory) | | 6–7 | Deep work block 2 | | 8 | Draft deliverable + dress-rehearsal presentation to peer | | 9 | Final revisions + presentation polish | | 10 | Panel presentations + portfolio submission |
Day 1 - Scoping document (mandatory before continuing)
Each student submits:
# Capstone Scoping Document
## Option (A/B/C/D):
## Why I picked this option:
## Specific deliverables (list):
## Tools / environment:
## Authorization / RoE statement:
## Definition of done (specific, measurable):
## Risks / dependencies:
## Daily plan (Days 3–9):
## Presentation outline:
Teacher signs off in writing before Day 2 work proceeds.
Day 5 - Mid-point conference (mandatory)
15-minute 1:1 with teacher. Show real progress. Adjust scope if needed. Identify the single thing that will make the project succeed in the second week.
Day 10 - Panel presentations
Format:
- 7-minute presentation.
- 3-minute panel Q&A.
- 5-minute panel deliberation (private).
Panel rubric (each scored 1–5):
- Technical execution.
- Documentation quality.
- Communication.
- Defense under questioning.
- Professional polish.
Suggested panel: teacher + 1–2 invited professionals + 1 second-year peer or alum.
Submission checklist
- [ ] Signed scoping document
- [ ] Final deliverable PDF(s) and any code in a reviewable archive
- [ ] Presentation slides (PDF)
- [ ] Recording of panel presentation
- [ ] Reflection (1 page): what changed about how you see this work, and what you'll do next
- [ ] Updated portfolio with capstone artifact
Capstone defense - common questions
- "Walk me through the moment you were most stuck. What did you do?"
- "If you had two more weeks, what would you do that you didn't?"
- "Where did your work break? What's the limitation a real engagement would hit?"
- "What's the single most important takeaway for someone deciding whether to hire you?"
Common misconceptions
- "I'll figure it out as I go." - The scoping document is the difference between a strong capstone and a missed one.
- "It has to be original." - Reproducing a known scenario well, and presenting it well, is exactly what entry-level roles ask for.
- "The presentation is at the end." - The presentation shapes the work. Plan it from Day 1.
Career connection
Capstone deliverables become portfolio pieces. Panel members hire - and recommend. Many graduates of programs like this report their first interview was won on the capstone, not the resume.
Final reflection prompt (for students)
Two years ago you didn't know what cybersecurity was. Today you can scope an engagement, run it, document it, and defend it under questioning. Write 1 page on what changed about how you see technology, work, and yourself. Keep this. Read it again on the day you start your first cyber job.
Final reflection prompt (for teachers)
- Which capstone option produced the strongest outcomes? Why?
- Which student grew the most? What was the first turning point?
- What didn't work in the capstone structure that you'll change next year?
- Which of your students should you keep mentoring after graduation?