A20 — Advanced Capstone
A20 is the final Advanced module. Instead of learning one isolated topic, you will bring architecture, identity, monitoring, incident response, cloud, risk, privacy, governance, recovery, evidence, and communication together in one fictional capstone.
The goal is not to produce the biggest possible report. The goal is to show that you can move from incomplete evidence to bounded conclusions, defensible decisions, accountable recommendations, safe recovery, and communication that different audiences can understand.
Readiness Check
0/4 ready
Module Mission
Real security decisions rarely arrive separated into clean textbook categories. An identity change can affect application behavior. An application problem can create monitoring noise. Missing telemetry can lower confidence in incident scope. A cloud dependency can affect recovery. A technical issue can create privacy or business risk. A policy exception can change how leaders treat the remaining exposure.
A20 is designed around those relationships. You will repeatedly ask how one piece of evidence changes architecture, detection, response, risk, recovery, or communication. The strongest capstone decisions will be the ones that remain defensible across several perspectives.
Advanced capstone quality = evidence discipline + cross-domain reasoning + accountable decisions + bounded confidence + professional communication.
Module Outcomes
Integrate the major Advanced-track cybersecurity domains into one coherent defensive case instead of treating them as isolated topics.
Use evidence, architecture, identity, risk, monitoring, incident response, cloud, privacy, recovery, and governance together to support professional decisions.
Preserve uncertainty by separating facts, hypotheses, assumptions, findings, risks, incidents, exceptions, recommendations, and unresolved questions.
Communicate the same underlying case accurately to technical reviewers, managers, executives, teachers, and portfolio audiences.
Build a final defensive capstone package that demonstrates traceability, ownership, revision, validation, ethical judgment, and publication safety.
Identify final knowledge gaps and prepare systematically for the two Advanced practice tests and the 125-question Advanced final test.
Capstone Principles
The capstone should feel like one connected professional problem. Architecture, monitoring, incident response, cloud, identity, privacy, risk, and leadership communication all examine the same fictional environment from different angles.
Start from supplied facts and source limitations. A plausible explanation remains a hypothesis until enough evidence supports a stronger conclusion.
Findings become actionable when the portfolio identifies who owns the risk, control, service, exception, recovery decision, or communication step.
A control appearing in architecture or policy is not the same as evidence that it is implemented, current, healthy, or effective.
A strong capstone considers degraded operation, dependencies, recovery criteria, validation, rollback, and residual risk rather than focusing only on prevention.
Technical, manager, and executive summaries may emphasize different details, but they must preserve the same confirmed facts, uncertainty, and material conclusions.
Capstone Flow
The phases below describe how the whole module progresses. Individual lessons will use the structure that best fits their topic. Some phases need architecture models, others need evidence tables, decision records, risk registers, communication drafts, or review rubrics.
Main question: What do I already know, what does the case actually contain, and what decisions must the team make?
Evidence and outputs: Knowledge map, case charter, asset inventory, source inventory, stakeholder map, scope, assumptions, unknowns.
Main question: How is the fictional environment designed, where does trust change, and which plausible security conditions deserve attention?
Evidence and outputs: Architecture relationships, trust boundaries, data flows, identity paths, dependencies, threat statements, control expectations.
Main question: Which evidence sources support defensive decisions, how healthy are they, and which monitoring gaps affect confidence?
Evidence and outputs: Telemetry map, synthetic alerts, source-health records, detection objectives, context, validation, quality metrics.
Main question: What should defenders decide now, what remains uncertain, and how can response preserve both security and service continuity?
Evidence and outputs: Timeline, decision log, triage notes, containment rationale, communication, recovery criteria, unresolved questions.
Main question: How do cloud, identity, privacy, and risk decisions change the long-term treatment of the case?
Evidence and outputs: Access review, shared-responsibility map, data-purpose review, risk register, privacy findings, exceptions, owners, treatment.
Main question: What do technical teams, managers, and leaders need to know or decide?
Evidence and outputs: Technical summary, manager brief, executive recommendation, priorities, owners, checkpoints.
Main question: Is the final submission coherent, defensible, safe, explainable, and ready for Advanced-track assessment?
Evidence and outputs: Portfolio submission, traceability, revisions, contribution statement, readiness review, targeted study plan.
Professional Roles
Connects evidence across sources, preserves confidence boundaries, documents findings, and identifies unanswered questions.
Explains system relationships, trust boundaries, dependencies, control design, resilience, and architecture tradeoffs.
Maps risks to defensive questions, telemetry, context, source health, validation, tuning, and signal-quality measures.
Coordinates triage, scope, containment, evidence preservation, communication, recovery, reassessment, and closure criteria.
Reviews shared responsibility, privileged and workload access, federation, data protection, cloud governance, and lifecycle evidence.
Translates technical findings into impact, likelihood, residual risk, privacy purpose, minimization, treatment, ownership, and review.
Turns complex evidence into concise, accurate decision support without hiding uncertainty or overstating technical conclusions.
Checks traceability, consistency, authorship, revision quality, presentation readiness, limitations, and publication safety.
Evidence Model
Advanced analysis is not only about collecting more evidence. It is about understanding the meaning and limits of each source. The capstone will repeatedly test whether you can avoid turning a partial clue into a complete conclusion.
Useful for: Shows intended systems, data flows, identity paths, trust boundaries, dependencies, and control placement.
Important limit: Does not by itself prove implementation or current operational behavior.
Useful for: Supports access, role, ownership, lifecycle, federation, authentication, authorization, and service-identity reasoning.
Important limit: One successful sign-in does not prove that all later actions were authorized or expected.
Useful for: Supports event timing, source health, defensive visibility, alert context, correlation, and detection-quality decisions.
Important limit: No event in a source is not meaningful when the source itself may be delayed, missing, or unhealthy.
Useful for: Supports approved maintenance, ownership, purpose, ticket history, exceptions, decision context, and remediation tracking.
Important limit: An approved change does not automatically prove every observed effect is expected or safe.
Useful for: Supports business impact, control requirements, treatment, acceptance, exception, accountability, and review decisions.
Important limit: A policy statement does not prove compliance, and a risk rating does not replace its reasoning.
Useful for: Supports restoration capability, dependency readiness, return-to-service criteria, validation, and residual operational risk.
Important limit: Backup existence alone does not prove successful or trustworthy recovery.
Fictional Case Preview
A20 will use one fictional case so the artifacts can connect naturally. The case provides enough complexity for Advanced reasoning while remaining entirely synthetic and safe.
Organization
Northbridge Learning Cooperative — a completely fictional education-services organization created only for CyberShield Academy.
Primary service
Northbridge Learning Portal, a fictional cloud-connected application used for student services, reporting, communication, and scheduled processing.
Core dependencies
Cloud identity, application services, protected data storage, background processing, monitoring, recovery services, administrative workflows, and third-party identity federation.
Opening condition
A synthetic cluster of identity, application, monitoring, service-health, and change records creates several plausible explanations for an interruption and unusual administrative activity.
Capstone question
How should defenders interpret the evidence, protect critical services, govern risk and privacy, restore confidence, and communicate the most important decisions without overstating what the evidence proves?
Safety boundary
All systems, identities, records, alerts, logs, risks, timestamps, addresses, organizations, and outcomes are fictional. The capstone requires no real access, testing, scanning, exploitation, or live investigation.
Lesson Map
Reconnect the major Advanced-track ideas before beginning the capstone: evidence, architecture, networking, threat modeling, identity, detection, incident response, cloud, application security, risk, privacy, governance, resilience, and communication.
Capstone Work
Build a readiness map that identifies which concepts are strong, which need targeted review, and which earlier artifacts can support the capstone.
Portfolio Artifact
Advanced Knowledge Readiness Map
Learn how to enter a complex defensive case without jumping to conclusions by defining mission, scope, stakeholders, assets, evidence, constraints, assumptions, unknowns, and decision priorities.
Capstone Work
Review the fictional Northbridge capstone briefing and create a case charter that explains what is known, what remains uncertain, and what the defensive team must decide.
Portfolio Artifact
Capstone Case Charter and Evidence Inventory
Review the fictional environment as a connected system of assets, identities, data flows, trust boundaries, dependencies, assumptions, plausible threats, existing controls, and resilience needs.
Capstone Work
Produce a concise architecture review and threat model that identifies the most important defensive design questions without claiming unsupported vulnerabilities.
Portfolio Artifact
Architecture and Threat Model Decision Pack
Connect capstone risks to defensive questions, telemetry, source health, alert context, correlation, detection quality, tuning, validation, ownership, and degraded visibility.
Capstone Work
Build a provider-neutral monitoring and detection review using synthetic evidence and define which signals support the most important defensive decisions.
Portfolio Artifact
Detection and Monitoring Review
Use the capstone evidence to make bounded incident-response decisions involving triage, scope, containment, communication, evidence preservation, recovery, reassessment, and decision ownership.
Capstone Work
Create a fictional incident-response decision record that preserves facts, hypotheses, uncertainty, changing evidence, recovery criteria, and unresolved questions.
Portfolio Artifact
Incident Response Decision Record
Review cloud shared responsibility, workforce and workload identity, privileged access, data protection, federation, service dependencies, logging, configuration governance, recovery, and access lifecycle.
Capstone Work
Produce a cloud-and-identity review that connects access and platform decisions to evidence, ownership, residual uncertainty, and safe recommendations.
Portfolio Artifact
Cloud and Identity Governance Review
Translate the capstone findings into business risk and privacy decisions using impact, likelihood, control strength, data purpose, minimization, retention, ownership, treatment, exceptions, and review triggers.
Capstone Work
Create a combined fictional risk-and-privacy register that distinguishes technical observations from business decisions and records residual risk clearly.
Portfolio Artifact
Risk and Privacy Decision Register
Convert detailed defensive evidence into concise leadership communication that preserves facts, uncertainty, material impact, options, owners, decisions, and next checkpoints.
Capstone Work
Create technical, manager, and executive versions of the same capstone conclusion while keeping the underlying facts consistent.
Portfolio Artifact
Executive Capstone Brief
Assemble the capstone evidence into a coherent professional submission with artifact selection, traceability, revisions, limitations, contribution transparency, presentation notes, and publication safety.
Capstone Work
Build the final Advanced Capstone Portfolio Submission from the strongest fictional artifacts created during A20.
Portfolio Artifact
Advanced Capstone Portfolio Submission
Perform the final quality and knowledge review before the Advanced practice tests and final test by checking technical reasoning, cross-artifact consistency, communication, safety, evidence, and remaining study gaps.
Capstone Work
Complete a final readiness review that identifies strong domains, remaining weaknesses, targeted review actions, and evidence that the Advanced track is ready for assessment.
Portfolio Artifact
Advanced Final Readiness Review Pack
Readiness Questions
Can I explain why one evidence source may support an observation without proving cause or intent?
Can I trace a system relationship across architecture, identity, data, monitoring, and recovery?
Can I distinguish a threat, finding, risk, incident, policy exception, recommendation, and decision?
Can I explain how source health changes the confidence of a monitoring conclusion?
Can I reason about privileged human identities and workload identities separately?
Can I distinguish backup availability from validated recovery readiness?
Can I connect technical evidence to business impact, privacy, ownership, and treatment?
Can I communicate uncertainty clearly without making the work sound weak or incomplete?
Can I explain what I personally contributed and what tools or assistance supported the work?
Can I keep the entire capstone fictional, defensive, ethical, and safe for a public student portfolio?
Fake Dashboard
Fictional integrated case scope, domains, artifacts, and assessment readiness
Capstone lessons
10
Knowledge review through final Advanced readiness
Integrated domains
12+
Architecture, identity, network, detection, incident response, cloud, risk, privacy, recovery, governance, communication, portfolio
Primary case
1
One coherent fictional Northbridge defensive scenario
Module test
25
Comprehensive A20 readiness questions
Fake SOC Alert
Source: Fictional Northbridge Capstone Review Queue • Time: 09:35
Fake Log Panel
[CASE] Northbridge Learning Cooperative capstone initialized as fictional training material [SCOPE] primary portal, identity, data, worker, monitoring, recovery, and governance dependencies included [EVIDENCE] architecture, identity, cloud, alert, log, service-health, change, risk, privacy, and recovery records available [QUALITY] facts, interpretations, assumptions, hypotheses, findings, risks, incidents, exceptions, and recommendations must remain distinct [OWNERSHIP] major technical and business decisions require named fictional owners [RECOVERY] backup presence and restoration readiness will be evaluated separately [COMMUNICATION] technical, manager, and executive outputs must preserve the same underlying case truth [PORTFOLIO] final submission must show traceability, revisions, limitations, contribution, and publication safety [SAFETY] no real systems, accounts, credentials, private records, or operational offensive activity are authorized
Training note: this is fake data for defensive analysis practice only.
Cross-Domain Reasoning
One of the best ways to test a capstone recommendation is to ask how it affects several domains. For example, improving privileged-role ownership may reduce identity risk, strengthen incident attribution, improve cloud governance, make policy evidence clearer, and give leadership a more accountable decision path.
Trust boundaries and critical dependencies help determine which telemetry and health signals deserve attention.
Role purpose, approval, lifecycle, and authentication context affect how unusual administrative activity should be interpreted.
Managed services, shared responsibility, identity dependencies, backups, and regional or service dependencies affect restoration decisions.
A technical control can reduce security exposure while still creating data-purpose, access, retention, or minimization questions.
A requirement matters only when ownership and review evidence make compliance visible and governable.
Leaders need material impact, confidence, options, owners, and next decisions rather than a copy of every technical record.
Defender Habits
Final Portfolio Outcome
The A20 portfolio is not one enormous document. It is a connected set of artifacts that can be traced back to the same fictional case and explained as one professional story. Each phase should add useful evidence or a defensible decision rather than repeating earlier work.
Final A20 collection
Advanced Capstone Portfolio Submission + Final Readiness Review Pack
The completed package should demonstrate architecture reasoning, threat modeling, monitoring, incident response, cloud and identity governance, risk and privacy decisions, recovery awareness, executive communication, portfolio quality, and readiness for the final Advanced assessments.
Module Test
The A20 module test will assess integrated Advanced reasoning rather than isolated memorization. Questions will ask you to connect evidence, architecture, identity, monitoring, response, cloud, privacy, risk, recovery, communication, and professional judgment.
After A20
After A20 and its module test are complete, the Advanced track moves into two 50-question practice tests followed by the 125-question final test. A20.10 will help identify which domains deserve review before those assessments.
50 mixed Advanced questions covering the full curriculum with defensive, scenario-based reasoning.
50 additional mixed questions designed to expose remaining weak domains before the final.
125 questions comprehensively assessing the complete High School Advanced track.
Safety Boundary
Every A20 organization, identity, system, service, address, domain, alert, log, incident, risk, policy, architecture record, cloud record, and outcome must remain fictional or synthetic. The capstone does not authorize access to any real environment.
Do not scan, probe, enumerate, exploit, test credentials, bypass controls, evade monitoring, collect real logs, inspect private records, access cloud accounts, change configurations, or investigate real organizations for this project. Advanced quality comes from evidence reasoning, defensive design, governance, communication, and safe professional judgment.
Key Takeaways
Begin A20
A20.1 does not repeat every earlier lesson. It identifies the concepts you need for the capstone, reconnects the most important cross-domain relationships, and creates a readiness map so weak areas can be reviewed before they affect the final case.