Capstone Integration and Case Analysis
What to know
Capstone questions test synthesis: given a scenario, identify the most significant risk, choose the control that addresses root cause, and sequence actions correctly. Work through a repeatable method - clarify the business objective, identify assets and trust boundaries, enumerate threats and existing controls, assess residual risk, then select and justify treatment.
Expect cross-domain cases: a cloud misconfiguration exposing data (cloud, data protection, IAM), a phishing-led intrusion (IAM, detection, incident response), or a vulnerable dependency in a regulated product (secure development, governance, compliance). The best answer usually addresses root cause, respects ownership and authority, and preserves evidence and availability.
Practice prioritization under constraint: limited budget, regulatory deadline, or active incident. Distinguish immediate containment from long-term remediation, and quick wins from structural fixes. Justify choices with explicit criteria so the reasoning is auditable.
Traps
The most common failure is choosing a technically correct but out-of-sequence action - for example, remediation before containment, or policy writing during an active breach. Another trap is selecting the control that treats a symptom. Watch for answers that exceed the responder's authority, ignore regulatory notification, or trade away evidence. Also beware "most secure" options that destroy availability without business justification.
Worked example
Case: a public storage bucket leaks customer records, and the same misconfiguration exists in three other teams. Sequence: restrict public access and preserve logs, assess exposure and notification duties with legal, rotate exposed credentials, then deploy organization-level policy-as-code and audit all buckets. Containment, then scope, then systemic fix.
Rule of thumb: contain, scope, remediate, then prevent recurrence - and justify each step by risk.