Module 12, Capstone: put it all together

Estimated time: 10-20 hours over 2-4 weeks · Prerequisites: M0-M11 (Track A leans on M2, M3, M8, M9; Track B leans on M5 and M10)

Security+ SY0-701 domains supported: Consolidates all domains.

Everything so far has been input. This module is output: a portfolio artefact you can put in front of an employer. In M0 you chose a target role: SOC or GRC. Now you build the evidence for it. A career changer with no cyber job history gets interviews on exactly two things: a cert and proof you can do the work. This is the proof.

What you'll get from this module

• A completed capstone project matched to your target role.
• Track A (SOC/technical): 3-5 professional challenge write-ups in a public GitHub repo.
• Track B (GRC): an Essential Eight gap assessment, risk register and executive summary for a realistic fictional business.
• A published, linkable portfolio you'll reference in every application (M13).
• The habit that separates professionals from hobbyists: documenting your work.

---

1. Why write-ups beat certificates alone

Hundreds of applicants for an entry role will list Security+. Very few attach a link that says "here is me actually triaging, investigating and communicating." Hiring managers consistently reward that link because it answers their real question (can this person do the job and explain their thinking?) better than any cert logo.

The rule for both tracks: the deliverable is the document, not the activity. Solving a challenge and telling no one is practice. Solving it and writing it up clearly is a portfolio.

---

2. Choose your track

	Track A: SOC / technical	Track B: GRC
Best if you chose	SOC Analyst L1 in M0	GRC / Security Analyst in M0
You'll produce	3-5 challenge write-ups	A mini security assessment pack
Builds on	M2, M3, M8, M9 labs	M5 (Essential Eight), M10 (risk register)
Shows employers	Technical method + investigation discipline	Framework knowledge + business communication

Can't decide? Do the track for your target role properly, then borrow one exercise from the other track later. Plenty of SOC roles value a candidate who can write a risk summary, and vice versa.

---

🧪 Track A: the SOC/technical capstone

The brief: complete a structured set of free hands-on challenges and produce 3-5 professional write-ups in a public GitHub repository.

A1. Pick your challenges

Choose from these free platforms (you met most of them earlier in the course):

• TryHackMe: free rooms; the guided, beginner-friendly option. Good sources for defensive write-ups.
• OverTheWire Bandit: the classic Linux command-line wargame from M3. A write-up covering a run of levels shows command-line fluency.
• picoCTF: Carnegie Mellon's free CTF platform; the practice gym has standalone challenges across forensics, web and general skills.
• PortSwigger Web Security Academy: free web security labs from M9; a lab write-up demonstrates OWASP Top 10 understanding.

A strong mix for a SOC-targeted portfolio: two defensive/investigation rooms, one Bandit progression, one picoCTF forensics challenge, one PortSwigger lab. Depth beats volume: five clear write-ups outrank twenty thin ones.

A2. The write-up template (use this structure every time)

# Challenge name — platform, difficulty, date

## Objective
What was the goal, in one or two sentences? What skills does it exercise?

## Environment
What was I working with? (Platform, target machine/level, tools used.)

## Method
The heart of the write-up. Step-by-step: what I tried, what worked,
what DIDN'T work and why I changed approach. Screenshots of key steps.

## Findings
What was discovered/achieved. What the vulnerability or artefact was
and why it matters in the real world.

## What I'd do in a real SOC
If this appeared in a production environment: how would I detect it,
what would I escalate, what control would prevent it?

That last section is the differentiator. Anyone can copy commands; connecting a lab exercise to "here's the detection and the control" is analyst thinking, and it's what an interviewer will ask you about.

A3. Quality bar

• Write for a reader who is technical but didn't do the challenge.
• Include screenshots of the key moments (not every step).
• Include the dead ends. "I tried X, it failed because Y" reads as honesty and method, not weakness.
• Proofread. A write-up full of typos undercuts the "I document carefully" message.

---

🧪 Track B: the GRC capstone

The brief: perform a mini security assessment of the fictional business below and produce three artefacts: an Essential Eight Maturity Level 1 gap assessment, a risk register, and a one-page executive summary with a 90-day uplift plan.

B1. The scenario: meet Karri & Co

This scenario is original course content. It's yours to assess.

Karri & Co is a 12-person accounting firm in Perth. They handle tax, bookkeeping and payroll for around 400 small-business clients, which means TFNs, bank details and payroll data. Their IT, honestly described:

• Microsoft 365 for email, Teams and OneDrive; every staff member has a licence.
• 12 laptops (a mix of ages; some still on an out-of-support Windows version), used in-office and at home.
• One on-premises file server in a cupboard, holding 15 years of client records.
• No MFA: the partners found it "fiddly" and turned it off after a week.
• Backups run to an external drive that sits next to the server. Restore has never been tested.
• Everyone is a local administrator on their laptop "so IT tickets are rare."
• Software updates happen "when the laptop nags enough." No one owns patching.
• No security policies, no incident response plan; the office manager does IT "as a side duty."
• One partner clicked a fake myGov link last year; nothing (visibly) happened, and nothing was changed.

B2. Deliverable 1: Essential Eight ML1 gap assessment

Using the Essential Eight from M5, assess Karri & Co against Maturity Level 1 for each of the eight strategies. For each: current state (from the scenario), gap, and a plain-English recommended action. A table works well. Where the scenario doesn't state something, record the assumption you made. Assessors do this constantly in real engagements.

B3. Deliverable 2: risk register

Build on your M10 risk register format. Identify 6-10 risks, each with: description, likelihood, consequence, overall rating, existing controls, and recommended treatment. At least one risk each for: the untested backups, the missing MFA, the admin-rights situation, and the unsupported operating systems. Rate honestly. Not everything is "extreme," and a register with graduated ratings shows judgement.

B4. Deliverable 3: one-page executive summary + 90-day uplift plan

One page, written for the partners (smart people, zero security vocabulary):

• Three sentences on overall posture.
• The top 3-5 risks in business terms ("client tax file numbers could be stolen," not "inadequate IAM controls").
• A 90-day uplift plan: what to fix in days 1-30, 31-60, 61-90, sequenced by risk reduced per dollar and per hour of disruption. MFA and tested backups should feature very early, and you should be able to say why.

If you can make a 12-person accounting firm's partners want to act, you can do GRC.

---

3. Publishing your portfolio

Both tracks end the same way: publish it where an employer can click it.

• A GitHub repository is the standard: free, professional, and doubles as evidence you can use Git. One repo, a clear README that introduces you and indexes the artefacts, one folder per write-up or deliverable. A simple free blog works too. The platform matters far less than the writing.
• Never publish real employer or client data: not from your current job, not "anonymised" screenshots of real systems, nothing. Fictional (Karri & Co) and lab content only. This rule follows you your entire career.
• Respect each platform's write-up policy. Some TryHackMe rooms and subscription content are locked and must not have public walkthroughs; picoCTF and others have their own rules about active competition challenges. Check before you publish. Where a platform restricts spoilers for specific content, write about your method and lessons, not the answers/flags, which, conveniently, is also the more impressive write-up.

---

4. Ethics: the line you never cross

Only ever test systems built for practice, or with written authorisation

Every platform in this module is designed to be attacked. That's the entire point of them. The same actions against any system you don't have explicit written permission to test (a former employer, your ISP, a "just curious" website) are crimes in Australia under the Criminal Code Act 1995 (Cth), Part 10.7 (computer offences), with penalties including imprisonment. There is no "I was just practising" defence, and a conviction ends a security career before it starts. Authorised targets only. Always.

---

Self-check

Answer before you reveal. The attempt is what makes it stick. Your score and card ratings are saved on this device only.

Scored self-check

Check your understanding

Commit to an answer before you check: the attempt is what makes it stick. Your first answer to each question is the one scored; practising again afterwards doesn't change it. Saved on this device only.

Question 1 of 7You’ve passed Security+ and you’re up against hundreds of applicants listing the same cert. According to the module, what actually gets a career changer interviews?

A clickable link to write-ups showing you triaging, investigating and communicatingStacking more certifications until your resume stands outCompleting as many challenges as possible, even without documenting themListing the platforms you practised on in your resume

Question 2 of 7You chose GRC back in M0, but a mate insists CTF write-ups look more impressive to employers. What does the module advise?

Switch to Track A: technical portfolios always beat GRC onesDo both tracks in full so you cover every baseDo Track B properly for your target role, then borrow one Track A exercise laterFlip a coin, the two tracks are interchangeable

Question 3 of 7Drafting your Bandit write-up, you’re tempted to cut the two hours of failed approaches and show only the commands that worked. What does the module say?

Cut them: dead ends make you look like you struggledKeep the dead ends and explain why you changed approachReplace them with screenshots of every single step insteadList only the final working commands so the write-up stays short

Question 4 of 7Your Karri & Co risk register rates every one of its eight risks “extreme”. Why is that a problem?

A register with graduated ratings shows judgement: rate honestly, not dramaticallyIt isn’t: a firm this exposed genuinely is extreme across the boardRegisters are only allowed one extreme risk at a timeExtreme risks belong in the executive summary, not the register

Question 5 of 7In your 90-day uplift plan for Karri & Co, why should MFA and tested backups land in days 1-30?

They’re the cheapest items on the list, even if the risk reduction is modestThey deliver the largest risk reduction for the least cost and disruptionThe Essential Eight requires MFA before anything else can be assessedQuick wins early make the plan look good to the partners

Question 6 of 7A TryHackMe room you loved doesn’t allow public walkthroughs. What do you do?

Publish anyway: a platform’s write-up policy isn’t legally bindingPublish the step-by-step walkthrough but blur the flags in your screenshotsWrite about your method and lessons learned instead, or pick an unrestricted challenge

Question 7 of 7After finishing the PortSwigger labs, a mate suggests trying the same techniques on your old employer’s login page, “just to see if it’s vulnerable”. What’s the reality?

Fine, as long as you don’t cause any damage and report what you findFine, because you used to have legitimate access thereIt’s a crime under the Criminal Code Act 1995 (Cth), Part 10.7, regardless of intentRisky, but worth it if the findings help you land a job

When an employer clicks your portfolio link and starts asking questions, the template sections, the Karri & Co deliverables and the publishing rules need to come out without hesitation. That fluency is part of what the portfolio proves.

Flashcards · spaced repetition

Drill the key terms

Say your answer out loud (or in your head) before revealing. Recall is the workout. "Knew it" pushes a card's next review further out; "Review again" brings it back today.

Card 1 of 18

Prompt

The capstone’s one rule for both tracks?

---

Next module

➡️ M13: Career launch. The payoff: your Security+ exam plan, free accredited study options, Australian pathway programs, and how to actually land the first role.