This manual is for IT-FPX4070 Assessment 3, start to submission. The later work in this course usually turns to visibility and recovery: where sensors sit, which logs are worth keeping, what threshold makes an alert worth reading, who responds, and how long a restore actually takes. Detection with no written response is decorative, and a backup that has never been restored is a hope, so both of those sentences have to appear somewhere in your draft. Below: the method, a structure mapped to each criterion, and one annotated model excerpt. Need it handled? Send the case and a premium original sample arrives inside 24 to 48 hours, revised free until the guide is satisfied. Your courseroom may print this as IT FPX 4070 Assessment 3 or IT4070 Assessment 3; it is the same deliverable, and IT-FPX4070 Assessment 3 is what this manual walks through.
One honesty note before the manual: Capella revises courses and scoring guides over time, so always write to the exact scoring guide attached to your assessment in the courseroom. The course identity above is verified on capella.edu; the method and structure below are our tutors' approach to it, not Capella's official rubric text.
How IT-FPX4070 Assessment 3 is scored
Four levels decide each criterion and none of them is a mark out of a hundred. The level text is the specification your draft answers:
| Level | What it means on a detection and response submission |
|---|---|
| Distinguished | Sensor placement is justified by the traffic each one can actually see, thresholds are justified by volume, every alert has an owner and a first action, and recovery times are measured rather than asserted. The date of the restore test appears. |
| Proficient | Sensors, logs, alerts, and a response process are all present and coherent. Complete, with the numbers behind them missing. |
| Basic | A list of log sources and a promise to monitor them. Where a submission lands when detection was treated as a purchase. |
| Non-performance | A required element is absent, most often the response owner or the recovery testing, so the criterion built on it cannot be marked. |
Logging is graded on selection rather than on volume. Name the sources that earn their storage, say how long each is kept and who reads it, and drop the rest with a sentence explaining why. A design that keeps everything and reads nothing is the same as a design that keeps nothing.
The IT-FPX4070 Assessment 3 method, step by step
-
Map the criteria, then name what you are trying to catch
Detection has to be aimed. Write down the three behaviors you most need to see in this environment, drawn from your own threat model, and let those three decide every sensor and every log source that follows. Monitoring chosen without a target is monitoring nobody will tune.
-
Place sensors where the traffic you care about actually flows
A forty-person architecture firm keeps its value in a drawing archive, so the flows worth watching are access to that archive, authentication into it, and anything leaving the office network in bulk. A sensor on a segment the archive traffic never crosses detects nothing, and saying which flow each sensor sees is what earns the placement criterion.
-
Select log sources, retention, and a reader for each
Authentication events, privileged command use, boundary denies, endpoint process creation, and file access on the archive are the ones that earn their space here. Give each a retention period and a named position that reviews it, because an unread log is an expense rather than a control.
-
Defend a threshold with arithmetic
Take the archive: about 60,000 file opens a month, of which perhaps 6 would represent someone taking work they should not. A rule that flags any user opening more than 40 drawings in an hour fires on a genuine deadline push as well as on a departing employee, so the number needs a reason and a second condition. Requiring two independent signals, such as unusual volume together with an unusual hour, cuts the queue enough that a two-person team will still be reading it in March.
-
Give every alert an owner and a first action
Write the alert, the threshold, the position that responds, and the first thing they do, in a table. An unowned alert is an unread alert. Then run the response process through containment, eradication, and recovery, and say who is allowed to disconnect a machine on a deadline day.
-
Measure the restore, then self-score and submit
Recovery closes the loop, so state the recovery time you measured rather than the one you hoped for, name the date of the test, and say what failed during it. A restore test with a recorded failure and a fix reads far stronger than an untested claim. Then mark yourself row by row and submit early inside the two business day window.
A structure that maps to the criteria
Word targets our tutors plan against for a detection and recovery deliverable of this size, not Capella rules; your scoring guide sets the real proportions.
| Section | What it must do | Guide |
|---|---|---|
| What you are trying to detect | The three behaviors that matter most here, drawn from the threat model rather than from a product list. | ~200 words |
| Sensor placement | Each sensor, the flow it can see, and why that flow carries the behavior you named. | ~250 words |
| Log strategy | Sources kept, retention per source, who reads each one, and what you deliberately dropped. | ~250 words |
| Thresholds and correlation | The arithmetic behind each threshold and the second condition that keeps the queue readable. | ~300 words |
| Alerts and response | Alert, threshold, owner, first action, then containment through recovery with decision rights named. | ~250 words |
| Recovery evidence and sources | Measured restore time, test date, what failed, and references in current APA. | ~200 words |
Annotated sample excerpt
An excerpt from a model our team wrote, showing how a threshold reads once the arithmetic is on the page.
The archive records roughly 60,000 file opens a month across thirty-one drafters, and a departing employee copying a project would sit somewhere inside that traffic rather than outside it.1 A single rule on volume alone, set at forty drawings in an hour, fires on any deadline push and would have produced fourteen alerts in the last quarter, none of them real, which is how a two-person team learns to ignore a queue.2 The rule therefore requires two conditions together, unusual volume and access outside the user's normal hours, which reduces the same quarter to two alerts, both worth reading, and the write-up states that a patient attacker working during office hours defeats it.3
- 1Establishes the volume first, because a threshold without a denominator cannot be defended to anybody.
- 2Shows what the naive rule would have cost in false alerts, using a real count. This is the arithmetic the evaluation criterion is asking for.
- 3Improves the rule, quantifies the improvement, and admits what still gets through. The admission is the top-column move.
The full premium sample for your exact assessment, written fresh to your scoring guide and issue, is free to request. Study it, revise it into your own voice, and submit work you understand.
The five mistakes that cost Distinguished
- A sensor watching a link the data never crosses. Monitoring a segment your archive traffic never uses detects nothing at all.
- Log everything, read nothing. Retention with no reader is storage cost, and the criterion asks who reviews each source.
- Thresholds with no denominator. A number chosen without knowing the daily volume cannot be defended and usually floods the queue.
- Alerts with no owner and no first action. An unassigned alert is an unread alert, and the design has to name the position that reads it.
- Backups scheduled and never restored. A recovery time nobody has measured is a hope, and the criterion wants a test date and a result.
Pre-submission checklist
- Three target behaviors named and traced back to the threat model
- Each sensor justified by the flow it can actually see
- Every log source given a retention period and a named reader
- Each threshold defended with volume arithmetic and a second condition where needed
- Every alert carrying a threshold, an owner, and a first action
- Restore time measured with a test date and a recorded failure, then self-scored per row
Detection design due and the thresholds are guesses?
Send the environment, the criteria, and any volume figures you have. You get sensors placed against real flows, a log strategy with readers and retention, thresholds defended with arithmetic, and recovery times written as measurements, inside 24 to 48 hours. Revision is free until the guide is met and the opening premium sample is free.