This manual is for IT-FPX4803 Assessment 2, start to submission. The middle deliverable in IT-FPX4803, System Assurance Security, usually asks you to model the threats against a data-flow view and then produce verification evidence for the controls you claim: a structured enumeration per element and per boundary crossing, complementary analysis techniques chosen for what each one finds, a dependency inventory, and results captured with dates and tool versions visible. Each criterion is settled by itself against the guide attached to your own assessment. Below sits the working order our tutors use, an outline taken from the criteria, and a marked-up passage. Rather delegate it? A premium original sample for this exact assessment lands within 24 to 48 hours, reviewed by a second technical reader, revised free until the guide is satisfied. Your courseroom may print this as IT FPX 4803 Assessment 2 or IT4803 Assessment 2; it is the same deliverable, and IT-FPX4803 Assessment 2 is what this manual walks through.
One honesty note before the manual: Capella revises courses and scoring guides over time, so always write to the exact scoring guide attached to your assessment in the courseroom. The course identity above is verified on capella.edu; the method and structure below are our tutors' approach to it, not Capella's official rubric text.
How IT-FPX4803 Assessment 2 is scored
Every criterion in this one is decided separately at one of four levels, and a strong section lifts nothing else. Read all four descriptions as a checklist before drafting:
| Level | What it means on a threat model and verification deliverable |
|---|---|
| Distinguished | A structured method is applied consistently across every element and crossing, the threats you dismissed are justified rather than omitted, and each verification technique is paired with what it finds and what it cannot see. The criterion also wants the coverage gap named, and it says so. |
| Proficient | The model is complete and the tests were run. Solid, and one column short because coverage and blind spots were left implicit. |
| Basic | A list of threats with no method behind the list and evidence asserted rather than shown. Technically literate description lands here when nothing is traceable. |
| Non-performance | A required element is absent, most often the trust boundaries on the diagram or any actual tool output. Missing is judged more harshly than incomplete. |
One caution that belongs in every document at this stage: any scanning, fuzzing or penetration testing you describe must be authorized and in scope, run against a target you own or have written permission to test, with the window and the approval recorded. A disposable virtual machine on your own hardware is the safe way to produce evidence.
The IT-FPX4803 Assessment 2 method, step by step
-
Draw the data flow before you enumerate anything
Processes, data stores, external entities and the flows between them, with trust boundaries drawn where control changes hands. A threat list assembled without that picture is a list of things you already knew rather than an analysis of this system.
-
Apply one structured prompt set and apply it everywhere
Take the six-category prompt set most course material uses, which is identity spoofing, data tampering, denied responsibility, information exposure, service denial and privilege escalation, and walk it over every element and every crossing. Consistency is what makes the exercise repeatable, and repeatable is what the criterion is measuring.
-
Justify the threats you rule out
A dismissal with a reason is analysis; a dismissal by silence is an omission a marker will find. Write one line per ruled-out threat naming the property of your design that makes it inapplicable, and be honest when the real reason is that the control lives outside your boundary.
-
Pick verification techniques for what each one finds
Analysis of source code finds different defects from exercising a running instance, and neither finds what a careful read of the authentication and authorization paths finds. Name all three, say which you ran, and say what the ones you skipped would have caught.
-
Confirm authorization before anything is executed
Testing tools are pointed only at a target you own and administer, built for the purpose and disposable afterwards. If an assessment appears to invite live testing against a real environment, obtain the scope, the window and the written approval from your faculty member and the system owner first, and put that record in the document.
-
Capture evidence so a stranger could reproduce it
The tool and its version, the target and its version, the date, the command or configuration used, and the output itself. Then inventory the components you did not write, because dependencies with known defects are part of your attack surface whether or not you enumerated them.
A structure that maps to the criteria
Internal targets for a second assurance document rather than published requirements; whichever criterion your guide weights most deserves the length.
| Section | What it must do | Guide |
|---|---|---|
| Data-flow view and trust boundaries | The diagram described in prose, with every element named and every boundary crossing identified by what moves across it. | ~250 words |
| Threat enumeration | The structured method applied per element and per crossing, with the threats found stated as concrete scenarios. | ~350 words |
| Dismissed threats | Each threat ruled out with the design property or scope boundary that makes it inapplicable. | ~150 words |
| Verification approach and authorization | The techniques chosen, what each finds, the environment used, and the written authorization and scope under which anything ran. | ~250 words |
| Evidence and results | Tool and target versions, dates, commands or settings, the output, and the dependency inventory with known defects. | ~300 words |
| Coverage, blind spots and sources | What the combined techniques could not reach, and standards, procedures and advisories cited by revision in current APA. | ~200 words |
Annotated sample excerpt
An excerpt our team produced at the register a guide's highest level describes. Study how the threat, the mechanism and the verification travel together, then write your own.
At the crossing between the warehouse label-printing application and the print spooler, spoofing is the threat that matters most, because the spooler accepts a job from any host on the segment and the application identifies itself only by source address, which any device on that segment can claim.1 The claimed control is mutual authentication between the application and the spooler, so it was verified rather than asserted: the whole stack was rebuilt inside a disposable virtual machine on hardware I own, which is the only environment any of this testing was authorized for and the scope was agreed in writing with the faculty member beforehand, and a second container on the same private network attempted a submission using a copied source address on 14 July 2026 and was refused with a certificate error recorded in both logs.2 What this evidence does not cover is the production segment, where the address-based trust is still live, so the finding stands as confirmed in the lab and unverified in the environment that actually matters.3
- 1Names the crossing, the threat category and the specific mechanism that makes it reachable. A threat tied to one flow is analysis; a threat listed by name is a glossary.
- 2Records the authorized, in-scope lab environment, the date and the observed refusal. Evidence with a location and a timestamp is what a criterion about verification can actually credit.
- 3Separates what was proven from what was not. Saying the production case remains unverified is stronger than implying the lab result transfers.
The full premium sample for your exact assessment, written fresh to your scoring guide and issue, is free to request. Study it, revise it into your own voice, and submit work you understand.
The five mistakes that cost Distinguished
- A threat list with no method behind it. Threats produced from memory cannot be shown to be complete, and completeness is what a structured prompt set buys you.
- Trust boundaries left off the diagram. Without a line showing where control changes hands, every crossing looks equally trusted and the model explains nothing.
- Evidence described instead of shown. Saying a control was verified is a claim, while a procedure, a timestamp and an output are evidence.
- Tools pointed at something you do not own. Written authorization scoped in advance is the difference between an academic exercise and an offense, and a document that skips it is a problem beyond the grade.
- Dependencies left out of the surface. Components you did not write carry their own defects, and a verification section with no inventory has an unexamined half.
Pre-submission checklist
- Every criterion in the guide has a section with a matching name
- Data-flow view described with trust boundaries on every crossing
- One structured method applied across all elements, dismissals justified
- Verification techniques paired with what each finds and misses
- Authorization, scope and environment recorded before any tool output
- Tool and target versions, dates and commands captured, current APA both ways
Threat model and evidence due?
Send the system description, the controls you intend to claim and the criteria for this stage. The model comes back walked element by element with dismissals justified, and the verification section comes back with the environment, the authorization and the coverage gap all written. First premium sample free.