This manual is for IT-FPX4071 Assessment 1, start to submission. The opening deliverable in Cyber Attacks and Ethical Hacking usually asks for the paperwork that makes the rest of the work legitimate: the client, the systems in scope, what is excluded, the testing window, the contacts, the signature, and the methodology you will follow. Students find this section dull and evaluators do not, because it is the part that separates a security professional from somebody with a scanner. What follows is our tutors' method, a structure drawn straight from the criteria, and an annotated model excerpt. Rather delegate it? Send the case and a premium original sample comes back inside 24 to 48 hours, reworked at no charge until the guide is clear. Your courseroom may print this as IT FPX 4071 Assessment 1 or IT4071 Assessment 1; it is the same deliverable, and IT-FPX4071 Assessment 1 is what this manual walks through.
One honesty note before the manual: Capella revises courses and scoring guides over time, so always write to the exact scoring guide attached to your assessment in the courseroom. The course identity above is verified on capella.edu; the method and structure below are our tutors' approach to it, not Capella's official rubric text.
How IT-FPX4071 Assessment 1 is scored
FlexPath marks each criterion at one of four levels with no letter grade attached. The level wording is the brief you write against:
| Level | What it means on an authorization and methodology submission |
|---|---|
| Distinguished | Scope and exclusions are both justified, the stop condition for discovering a real prior intrusion is written out, and the methodology is named with any deviation from it explained. The awkward permissions are settled on the page rather than assumed. |
| Proficient | Client, scope, window, contacts, and a methodology are all present and consistent. Complete, with the difficult cases unaddressed. |
| Basic | A permission paragraph and a promise to be careful. Where a submission lands when the section was treated as a formality. |
| Non-performance | The authorization record is absent or unsigned, which fails the professional standard before any technical work is read. |
Everything in this course rests on permission, so the register of this deliverable is contractual rather than technical. Write in the language of what is allowed, by whom, for how long, and with which exceptions. A sentence a lawyer could not act on is a sentence this criterion will not reward.
The IT-FPX4071 Assessment 1 method, step by step
-
Turn the criteria into headings and separate authority from technique
Mark each criterion as an authority row or a technique row. Authority rows want names, dates, signatures, and boundaries. Technique rows want a stage and a reason. Answering an authority row with technical enthusiasm is the commonest way a strong technical student loses this deliverable.
-
Write the scope as a list somebody could hold you to
Name the systems by hostname or address range, name the applications, and name the environment. A regional pet-supply retailer running a storefront, a warehouse system, and a marketing site is three decisions and not one: the storefront is in scope during the window, the warehouse system is out of scope because a failed order pick costs a day of shipping, and the marketing site is in scope but excluded from any test that could take it offline.
-
Justify the exclusions rather than dropping them quietly
An exclusion with no reason reads as convenience, and an exclusion with a reason reads as judgment. Say that the payment provider is excluded because it belongs to a third party who has not authorized testing, and that this is a limitation of the engagement rather than an assurance about that provider.
-
Set rules of engagement, including the awkward ones
Decide in writing whether social engineering is permitted, whether any denial of service testing is allowed at all, whether production may be touched during trading hours, who receives an out-of-hours call if something breaks, and what happens the moment you find evidence of a real intrusion that predates you. That last rule is the one evaluators look for, because it is the one a beginner never writes.
-
Name the methodology and say where you depart from it
Pick a published testing methodology, cite it, and list the stages you will actually perform, since attempting every stage badly is worse than covering two properly. Where your criteria only require reconnaissance and enumeration, say that exploitation is out of scope by instruction rather than leaving a reader to wonder.
-
Confirm your practice environment is yours, then self-score
Any hands-on work behind this deliverable belongs on systems you own, on virtual machines you built, or on platforms that publish an explicit invitation to test them. Never test an employer's systems to produce a class artifact, because unauthorized access statutes turn on permission rather than on motive. Then mark yourself against each row and submit early inside the two business day window.
A structure that maps to the criteria
The word counts below are planning targets our tutors use for an engagement document at this level, not Capella rules; expand whatever your guide weights most.
| Section | What it must do | Guide |
|---|---|---|
| Client and objective | Who authorized the work, what they want to learn from it, and the business context around that question. | ~150 words |
| Scope | Systems, applications, and environments named individually, with the testing window and the time zone. | ~250 words |
| Exclusions | What is out of scope, why each item is out, and what that means for the assurance the report can offer. | ~200 words |
| Rules of engagement | Permitted techniques, prohibited techniques, hours, contacts, and the stop condition for a prior intrusion. | ~300 words |
| Methodology and stages | The published methodology cited, the stages performed, tools with versions, and deviations explained. | ~300 words |
| Sources | Testing standards and statutes cited primarily rather than through summaries, current APA both ways. | as needed |
Annotated sample excerpt
An excerpt from a model engagement document our team wrote, at the register the top column describes for an authority section.
Testing runs between 22:00 and 05:00 local time on the dates listed above, because the storefront takes most of its orders during the working day and a degraded checkout costs the client revenue no finding would justify.1 Denial of service techniques are prohibited outright, and any test with a credible chance of exhausting a resource must be described to the technical contact before it runs rather than reported afterwards.2 If evidence of an intrusion that predates this engagement is discovered, testing stops immediately, nothing further is touched, the named executive contact is telephoned within one hour, and the tester preserves rather than investigates, because from that moment the systems are potential evidence and the client's incident process has authority over them.3
- 1Ties the window to a business cost rather than to convenience, which is what turns a scheduling line into a defensible decision.
- 2Draws the prohibition and then handles the borderline case explicitly, so nobody has to interpret the rule under pressure.
- 3Writes the stop condition with a time limit, a named contact, and the reason authority transfers. This is the paragraph that marks the top column in this deliverable.
The full premium sample for your exact assessment, written fresh to your scoring guide and issue, is free to request. Study it, revise it into your own voice, and submit work you understand.
The five mistakes that cost Distinguished
- A test described with no authorization record. Skipping the permission section fails the professional standard before the technical work is even read.
- Scope written as a sentence rather than a list. Their whole network is not a scope, and it leaves both the tester and the client exposed.
- Exclusions dropped without reasons. An unexplained exclusion reads as avoidance, and the criterion is asking for the judgment behind it.
- No stop condition for a prior intrusion. It is the rule a beginner never writes and the rule an evaluator checks for first.
- Every methodology stage claimed at once. Covering two stages properly outscores gesturing at six, and the guide rarely asks for all of them.
Pre-submission checklist
- Criteria sorted into authority rows and technique rows, each answered in kind
- Systems, applications, and environments named individually with a window and a time zone
- Every exclusion carrying a reason and a note on what it limits
- Rules of engagement covering permitted techniques, hours, contacts, and prohibited activity
- The stop condition for a prior intrusion written with a contact and a time limit
- Methodology cited, stages listed, deviations explained, then self-scored per row
Engagement document due and the scope is a paragraph?
Send the case and the criteria attached to it. You get scope written as a list, exclusions with reasons, rules of engagement that settle the awkward cases, and a methodology cited rather than gestured at, inside 24 to 48 hours. Revisions stay free until the guide is met and the first premium sample carries no fee.