This manual is for IT-FPX4080 Assessment 2, start to submission. The middle deliverable in this course usually turns from the operating system to the software running on it, and it is analysis rather than development: you review a supplied design or code sample, identify weaknesses, map each one to a named risk category, and describe a remediation precisely enough that a developer could act on it without another meeting. Any hands-on work must be authorized and inside a scope somebody wrote down. The criteria reward findings that name the category, the evidence, and the fix. Below is the method our tutors use for it, a structure that maps to the criteria, and an annotated sample excerpt. Prefer to hand it off? A premium original sample for this exact assessment comes back in 24 to 48 hours, revised free until it meets the guide. Your courseroom may print this as IT FPX 4080 Assessment 2 or IT4080 Assessment 2; it is the same deliverable, and IT-FPX4080 Assessment 2 is what this manual walks through.
One honesty note before the manual: Capella revises courses and scoring guides over time, so always write to the exact scoring guide attached to your assessment in the courseroom. The course identity above is verified on capella.edu; the method and structure below are our tutors' approach to it, not Capella's official rubric text.
How IT-FPX4080 Assessment 2 is scored
Nothing is averaged and nothing becomes a letter. An evaluator reads criterion by criterion and places each at one of four levels, so treat the level text as the assignment:
| Level | What it means on an application review |
|---|---|
| Distinguished | Findings are mapped to a named risk category, evidenced in the supplied artifact, and remediated with a fix a developer could implement today. Each criterion has one extra move written into it; go and take it. |
| Proficient | Weaknesses identified accurately and described clearly. Real analysis that has not yet been turned into instructions somebody could follow. |
| Basic | A list of general security advice loosely attached to the application, with no line, route, or field named. |
| Non-performance | A required element is missing, commonly the mapping to a category or the remediation. An absent element settles its own row. |
Keep three problems apart that submissions routinely merge. Proving who somebody is, keeping that proof alive safely, and deciding what they may do are separate mechanisms that fail in separate ways, and a review that treats them as one topic will lose the row that asks about any of them.
The IT-FPX4080 Assessment 2 method, step by step
-
Confirm the authorization and write the scope down
Take a youth sports league that has asked, in writing from its board, for a review of the registration portal it had built. Record who authorized the work, what it covers, what it excludes, and that no testing touches anything outside that list. A review with no written authority is a professional problem before it is a grading problem, and the criteria expect the statement.
-
Follow the untrusted data, not the feature list
Every field, header, upload, and query parameter that arrives from outside is untrusted until validated against what you expect, and validation belongs on the server where nobody can bypass it. Trace each input to its destination and ask what treatment that destination needs, since a value going into a query, a page, a command line, and a file path each require a different defense.
-
Name the category for every finding
Map each weakness to the published list of common application risks your criteria reference, by name, so your evaluator can follow the reasoning without translating it. The mapping also disciplines the review, because a finding that resists categorization is usually two findings or a preference.
-
Evidence the finding in the artifact
Point at the file, the route, the field, or the line. A registration form that concatenates a parent's surname into a lookup query is a finding with an address; injection risk in the application is a topic. Where a fix is best shown as code, four lines contrasting a parameterized statement with a concatenated one make the point better than a page of prose.
-
Separate the three access problems and check the dependencies
Look at authentication, session handling, and authorization one at a time: how the credential is verified, how the session token is issued and invalidated, and whether the server checks that this account may see this child's record rather than trusting the identifier in the request. Then look at the dependency list, because most of the code in a modern project arrived from somewhere else and the vulnerability usually comes with it.
-
Write remediations as instructions, then self-score
Each finding needs a fix specific enough to implement, an owner, and a rough effort. Rank by exploitability against impact rather than listing them in the order you found them. Then mark every criterion D, P, B, or N and revise anything short of the top before uploading early in the week.
A structure that maps to the criteria
These are the proportions our tutors plan a review around rather than Capella requirements; code excerpts are additional to the counts.
| Section | What it must do | Guide |
|---|---|---|
| Authorization and scope | Who authorized the review, what it covers, what it excludes, and what was not tested. | ~200 words |
| Application overview | What the software does, who uses it, what data it holds, and where the trust boundaries fall. | ~250 words |
| Input handling findings | Each untrusted input traced to its destination, with the treatment that destination requires. | ~350 words |
| Access findings | Authentication, session handling, and authorization examined separately, with the failure mode of each. | ~300 words |
| Dependencies | What the project pulls in, how versions are tracked, and what happens when an advisory appears. | ~200 words |
| Remediation and sources | Ranked fixes with owners and effort, plus category and standards references in current APA. | ~250 words |
Annotated sample excerpt
One original model finding from our team, at the level of specificity the guide's top column describes. Copy the anatomy, not the content.
The registration lookup at /parent/find builds its database query by concatenating the surname supplied in the form, which places untrusted input directly into a statement and maps to the injection category in the published risk list the criteria reference.1 The same route also accepts a numeric child identifier and returns the matching record without checking that the record belongs to the requesting account, so an authenticated parent can enumerate other families by incrementing the value, which is an authorization failure rather than a second injection issue.2 Remediation is a parameterized statement for the lookup and a server-side ownership check on every retrieval by identifier, assigned to the portal developer, estimated at under a day, and ranked first because both are reachable by any registered user without special tooling.3
- 1Names the route, the field, and the mechanism, then attaches the published category. An evaluator can verify all three without asking what you meant.
- 2Separates an authorization failure from the injection finding in the same route. Merging them would have cost the criterion that asks about access control.
- 3Gives a fix, an owner, an effort, and a ranking reason. That is the difference between a review somebody can act on and a review somebody has to interpret.
The full premium sample for your exact assessment, written fresh to your scoring guide and issue, is free to request. Study it, revise it into your own voice, and submit work you understand.
The five mistakes that cost Distinguished
- Findings with no address. A weakness reported without a route, field, or line cannot be reproduced or fixed by the person who receives it.
- Client-side validation counted as a control. Anything enforced in the browser can be bypassed by the user it was meant to constrain.
- Authentication, session, and authorization discussed as one topic. Three mechanisms merged into one paragraph lose whichever criterion asks about the others.
- A network control offered as an application fix. A firewall in front of a concatenated query has not changed the query.
- No authorization statement. A review with no written scope is a problem the technical quality of the findings cannot repair.
Pre-submission checklist
- Written authorization and the scope, including what was not tested, appear at the front
- Every untrusted input is traced to its destination and the required treatment named
- Each finding carries a published risk category and a location in the artifact
- Authentication, session handling, and authorization are examined separately
- Dependencies are covered, with a stated response to a new advisory
- Remediations name an owner, an effort, and a ranking reason, then every row self-scored
Application review due and the findings are too general?
Send the supplied artifact, the scope you were given, and the criteria. A premium original returns inside 24 to 48 hours with findings mapped to categories, located in the code or design, and remediated in language a developer can act on. First sample free.