This manual is for IT-FPX4792 Assessment 2, start to submission. The middle deliverable in IT-FPX4792, Website Application Development and Design, usually goes behind the pages: a schema normalized enough that no fact lives in two places, routes and request handling that behave correctly rather than approximately, queries written so a value can never become part of the command, validation performed on the server, and session handling with its flags chosen deliberately. Verdicts land criterion by criterion against the guide that came with your assessment. Our tutors' order of work follows, beside an outline taken criterion by criterion and a worked passage with margin notes. Rather delegate it? A premium original sample for this exact assessment lands in 24 to 48 hours with each control named alongside the attack it answers, revised free until the guide is satisfied. Your courseroom may print this as IT FPX 4792 Assessment 2 or IT4792 Assessment 2; it is the same deliverable, and IT-FPX4792 Assessment 2 is what this manual walks through.
One honesty note before the manual: Capella revises courses and scoring guides over time, so always write to the exact scoring guide attached to your assessment in the courseroom. The course identity above is verified on capella.edu; the method and structure below are our tutors' approach to it, not Capella's official rubric text.
How IT-FPX4792 Assessment 2 is scored
Criteria are settled in isolation at one of four levels, and none of them rescues another. Those four descriptions are the nearest thing to a specification available:
| Level | What it means on a server logic and security deliverable |
|---|---|
| Distinguished | The schema stores each fact once, every query that touches user input is parameterized, status codes match what actually happened, and each control is named with the setting used and the attack it answers. The top column also wants what the control does not cover, and it says so in the criterion. |
| Proficient | The logic is correct and the controls are present. Sound work sitting one move below the top because the settings and the limits were left out. |
| Basic | Security described as a list of good practices and a schema with a fact stored twice. Code that runs, documented in a way that shows no decision was made, lands here. |
| Non-performance | A required element is absent, most often the password storage method or the session flags. What is not there costs a criterion outright. |
This deliverable is the one a marker can break in five minutes if it is wrong. Take the extra hour on the schema before you write handlers, because a customer name stored in three tables becomes a report whose totals disagree and a paragraph explaining why.
The IT-FPX4792 Assessment 2 method, step by step
-
Draw the data model before writing a single handler
Entities, keys, relationships and the cardinality between them, then walk your requirement list and confirm each one can be answered by a query against this schema. Ten minutes here prevents the situation where the same fact lives in three tables and no total agrees with another.
-
Make the request behavior match the meaning of the verb
A form submission answers with a status that describes what happened rather than returning a success code wrapped around an error page, a successful post redirects so a refresh does not repeat it, and routes read like the URL structure you already designed.
-
Send values separately from commands, always
Escaping quotation marks by hand loses to numeric contexts and character-set tricks. A prepared statement with bound parameters means the value is transmitted apart from the command text and can never be read as part of it, and that sentence is the answer to the criterion rather than a preamble to it.
-
Validate on the server and encode on the way out
Any check the page performs disappears the moment somebody posts to your route with a command-line tool, so every check is repeated on the server by type, by range and against a permitted set. Then encode output for the context it lands in, so text a user stored cannot execute inside somebody else's session.
-
Store passwords with a function built for the job
Name the algorithm, the work factor and the measured verification time on your own hardware, and say that a general-purpose fast hash is the wrong tool because commodity graphics hardware tests candidates by the million. Then state the per-user salt and confirm nothing is reversible.
-
Set the session flags on purpose and write down why
Cookies unreadable to scripts, restricted to encrypted transport, with a same-site policy chosen rather than inherited, identifiers regenerated at login, and an idle timeout with a number attached. Six flags, six reasons, one paragraph, and a criterion closed.
A structure that maps to the criteria
Internal targets for a second technical document, not published requirements; the criterion your guide leans on hardest earns the extra words.
| Section | What it must do | Guide |
|---|---|---|
| Data model | Entities, keys, relationships, normal form reached, and the query that answers each functional requirement. | ~300 words |
| Routes and request handling | The route table, the verb used for each, the status codes returned, redirect behavior after a write, and error responses. | ~250 words |
| Business rules and validation | The rules the application enforces, where each is checked, and the server-side validation applied by type, range and permitted set. | ~250 words |
| Authentication and session handling | Password storage with algorithm and work factor, session cookie flags, identifier regeneration, timeout and logout behavior. | ~300 words |
| Injection, output and uploads | Parameterized queries with an annotated extract, output encoding by context, and upload restrictions on type, size and storage location. | ~250 words |
| Limitations and sources | What each control does not cover, what you scoped out, and framework and runtime documentation cited with versions in current APA. | ~200 words |
Annotated sample excerpt
An excerpt from our team pitched at the level a guide's top column occupies. Study how the control, the setting and the limit travel together, then write your own.
Enrollment accounts on the trade school's continuing-education site are stored with a memory-hard password hashing function rather than a general-purpose digest, because a fast hash is designed to be cheap and cheapness is exactly the property an offline guessing attack wants.1 The work factor is tuned so one verification takes about 320 milliseconds on the same hardware the site runs on, which holds a single core to roughly three candidate passwords a second, and each record carries its own sixteen-byte salt so a stolen table cannot be attacked once and read many times.2 What this does not cover is a weak password that survives three guesses rather than three billion, so the control is paired with a check against a published list of compromised passwords at registration, and the residual exposure is a user who reuses a credential that has not appeared in any published breach yet.3
- 1Names the class of function and the reason in the same clause. The property that makes a fast hash wrong is the whole argument, and it costs one line.
- 2Gives the setting, the measured time and the rate it implies. A tuned work factor with arithmetic attached is evidence rather than vocabulary.
- 3States the attack the control does not stop and pairs it with a second control, then owns what remains. That third sentence is where the top column lives.
The full premium sample for your exact assessment, written fresh to your scoring guide and issue, is free to request. Study it, revise it into your own voice, and submit work you understand.
The five mistakes that cost Distinguished
- Values pasted into query strings. Building command text out of submitted input is the defect the criteria expect you to name and remove, not to filter by hand.
- Passwords encrypted rather than hashed. Encryption is reversible by design, and describing a password store as encrypted tells a marker the distinction was never understood.
- Validation performed only in the browser. A request sent directly bypasses every check the page made, so the server has to make them all again.
- Session cookies left at their defaults. Flags that were never chosen cannot be defended, and the criterion is asking which ones you set and why.
- A stack trace on the error page. An exception printed with the database name in it is a finding a marker can screenshot, and it undoes the rest of the security section.
Pre-submission checklist
- Every criterion in the guide has a section with a matching name
- Schema stores each fact once, with keys and relationships stated
- Every query touching user input shown as a parameterized statement
- Server-side validation described by type, range and permitted set
- Password algorithm, work factor, measured time and salt all named
- Session flags listed with a reason each, current APA reconciled both ways
Security section due and the code half written?
Send the brief, the criteria and an archive or a link to whatever exists. The schema comes back normalized, the queries come back parameterized with annotated extracts, and each control comes back with its setting, the attack it answers and the exposure it leaves. First premium sample costs nothing.