This manual is for IT-FPX4575 Assessment 3, start to submission. The final deliverable in this course usually asks you to harden a system against a published benchmark, verify each change without locking yourself out, and state the exposure that remains afterward, with every step mapped to a versioned item rather than to preference. It is graded one criterion at a time against the guide your own courseroom holds. What comes next is the approach our tutors use, a section plan tied to the criteria, and an annotated excerpt. Want the write-up done for you? A premium original sample for this exact assessment comes back in 24 to 48 hours, with revisions included until the guide is satisfied. Your courseroom may print this as IT FPX 4575 Assessment 3 or IT4575 Assessment 3; it is the same deliverable, and IT-FPX4575 Assessment 3 is what this manual walks through.
One honesty note before the manual: Capella revises courses and scoring guides over time, so always write to the exact scoring guide attached to your assessment in the courseroom. The course identity above is verified on capella.edu; the method and structure below are our tutors' approach to it, not Capella's official rubric text.
How IT-FPX4575 Assessment 3 is scored
A level is recorded per criterion and nothing rolls up into a mark. The top descriptor tells you what each hardening paragraph has to contain:
| Level | What it means on a hardening deliverable |
|---|---|
| Distinguished | Each change is mapped to a versioned benchmark item and a named control family, verified from a second session before the first is closed, and followed by an honest statement of the exposure the change does not remove. |
| Proficient | The system is hardened competently and the steps are documented. The changes are right and none of them is anchored to a benchmark item or a control family. |
| Basic | A list of settings changed, in the order a guide presented them. Enforcement is disabled somewhere to make a problem go away, and no residual exposure is named. |
| Non-performance | A required element is absent, most often the benchmark mapping or the verification that the system still works after the change. |
Any security or testing work in this subject is done inside a scope somebody authorised in writing, on a system you are entitled to touch, which for coursework means your own virtual machine rather than an employer's. Say so in the document, name the authorisation, and the professional-conduct criterion is answered before the technical work starts.
The IT-FPX4575 Assessment 3 method, step by step
-
Turn the criteria into headings, then record the scope and authorisation
Name the system, the release, and the written authorisation covering the work, including what is explicitly out of scope. A hardening or testing write-up that never establishes permission has left a criterion untouched, and in this program the conduct criteria are marked as strictly as the technical ones.
-
Choose the benchmark and cite it by version
Configuration standards come from the benchmark published for your specific distribution and version, or from a federal implementation guide where the scenario is government work. Both are revised on a cycle, so a reference without a version cannot be checked against anything and cannot support a mapping.
-
Change one thing, then verify from a second session
Open a second connection before you touch remote access settings and keep the first one alive until the second proves the change works. Locking yourself out of a remote host is the classic self-inflicted outage in this subject, and the verification step is also the evidence the criterion wants.
-
Restrict exposure at the network layer as well
Name the firewall, set a default deny, permit only what the scenario needs, and restrict administrative access by source rather than leaving it open to everything. Then show the resulting rule set as output, because a described firewall and a configured firewall look the same in prose and different in a listing.
-
Configure mandatory access control instead of switching it off
When a policy blocks something you need, put the system into the mode that records the denial without blocking it, read the denial to learn what was refused, build and review a targeted policy permitting only that, then return to enforcing and confirm the service works. Permissive is a diagnostic step, not a resting state.
-
State the residual exposure, then self-score
For each change, say what it does not fix, because a private key held with no passphrase still authenticates and automatic updates still leave a reboot window. Then mark each criterion against the guide yourself and rewrite whatever is below the top level. Submit early, since an evaluation may need two business days.
A structure that maps to the criteria
These figures are the planning targets our tutors work to on a hardening deliverable rather than Capella rules, so shift them toward whichever criterion carries the most weight on your guide.
| Section | What it must do | Guide |
|---|---|---|
| Scope and authorisation | The system, the release, the written permission, the window, and what is explicitly excluded. | ~200 words |
| Baseline | The state before any change, captured as output, with the benchmark and version selected for comparison. | ~200 words |
| Remote access and accounts | Administrative login policy, key handling, source restriction, and verification from a second session. | ~300 words |
| Network and packages | Firewall default and permitted rules shown as output, update mechanism, and what is held back. | ~250 words |
| Mandatory access control | Mode, the denial read, the targeted policy built, and the return to enforcing with the service confirmed. | ~250 words |
| Mapping and residual exposure | Each change against a versioned benchmark item and control family, with what remains exposed, current APA. | ~300 words |
Annotated sample excerpt
An original excerpt from our team showing a single change carrying its authorisation, its mapping, and its limits. Take the three-part shape, then write every hardening step in your own write-up that way.
The authorisation letter of 2 May scopes this work to one host, the public marketing server at a single named address, and it is signed by the operations director, so nothing else on that subnet is in scope for either hardening or testing.1 Before the test window the remote access daemon was reconfigured to refuse direct administrative login and to accept keys only, the change was mapped to the corresponding item in the distribution benchmark at version 2.0.0 and to the access control family in the control catalog, and it was verified from a second session while the original connection was still open.2 The residual exposure is stated rather than implied: a private key held without a passphrase still authenticates, so the retest checks key policy and not only the daemon setting.3
- 1Establishes the written authorisation, the single host in scope, and what is excluded, which is the sentence the conduct criterion is looking for.
- 2Pairs the change with a benchmark item at a stated version and a control family, then records the verification method, so the step is auditable rather than asserted.
- 3Names what the change does not fix and turns that into a retest item, which is the move that lifts a hardening paragraph to the top level.
The full premium sample for your exact assessment, written fresh to your scoring guide and issue, is free to request. Study it, revise it into your own voice, and submit work you understand.
The five mistakes that cost Distinguished
- Enforcement switched off instead of configured. Turning the protection off removes the containment the scenario needed, and it grades as avoidance rather than as a fix.
- Benchmarks cited without a version. These documents are revised on a cycle, so an undated reference cannot be checked and cannot support a mapping.
- Remote access changed with no second session open. The verification is also the safety net, and losing access to the host costs an evening and a criterion.
- No residual exposure named. Every control leaves something behind, and saying what remains is the difference between engineering and a checklist.
- Scope and permission never stated. Work of this kind belongs inside an authorisation somebody signed, and a write-up that skips it leaves a criterion unanswered.
Pre-submission checklist
- Scope, written authorisation, and exclusions recorded before any change
- The benchmark named with its version, and the control catalog family identified
- A baseline captured as output before the first setting is altered
- Remote access verified from a second session while the first stays open
- Mandatory access control configured through a targeted policy, not disabled
- Residual exposure stated per change, then self-scored before submission
Hardening write-up due?
Send the prompt, the criteria, your distribution and release, and the scope you were given. Every change comes back mapped to a versioned benchmark item and a control family, verified from a second session, and followed by the exposure it does not remove. Eight specialists work the file and it comes back inside 24 to 48 hours.