Capstone Defense Preparation and Oral Presentation

What the Capstone Defense Is

The capstone defense is the final demonstration that you can do the work of a cybersecurity professional — not just talk about it. You will present your integrated project to a panel, run live tools, and answer technical questions on the spot. The defense runs 30 minutes and is scored across five categories using a rubric. A score of at least 80% is required to pass. If you fall short, you have one remediation opportunity within five business days.

This lesson prepares you to walk into that room confident and ready.

Building Your Slide Deck

Your deck must contain 12 to 18 slides. Every slide should serve a purpose; remove anything decorative that does not add technical meaning. Cover these topics in order:

1. Project scenario and scope — What problem were you solving? Who is the fictional or representative organization? What assets were in scope?

2. Architecture decisions with threat-model justification — Show your network or system diagram. For each major design choice, state the threat it addresses. Cite the relevant domain concept (for example, defense-in-depth, least privilege, or network segmentation).

3. Hardening steps and evidence — List the configurations you applied and show screenshots or log excerpts as evidence. Panels look for specifics, not vague claims.

4. SIEM rule logic and alert demonstration — Explain the detection logic behind at least one rule in plain language. Be ready to show the alert firing live.

5. Automation script walkthrough — Walk through the script line by line at a high level. Explain what each section does and why you chose that approach.

6. Vulnerability findings summary and remediation priorities — Show your scanner output, explain how you ranked findings (severity, exploitability, asset criticality), and describe the remediations you applied or recommended.

7. Lessons learned — What would you do differently? What did this project teach you about real-world security operations?

Keep text on slides minimal. Use diagrams, tables, and screenshots. The slides support your spoken words; they are not a script.

Rehearsing Effectively

You will rehearse twice before the formal defense.

First rehearsal — solo and timed. Present out loud to yourself or a camera. Use a timer. Aim to finish the presentation portion in about 20 minutes, leaving 10 minutes for questions. If you run over, cut content rather than speaking faster. If you finish too early, you likely skipped important detail.

Second rehearsal — peer review. Your peer acts as a panel evaluator. They use the instructor-provided question bank — organized by Security+, CySA+, and ISC2 CC domains — to ask you at least five technical questions. They score your responses on the rubric and give you written feedback. You do the same for them. After the exchange, both of you revise weak areas. Do not skip this step; peer review surfaces gaps that solo practice cannot.

The Peer Review Exchange

When you act as the reviewer, your job is to challenge your peer fairly, not to be easy or cruel. Ask questions from each domain area so coverage is broad. Write your feedback specifically: instead of "you did not explain the rule," write "you stated the SIEM rule fired on port 445, but you did not explain the threshold or time window that triggered it." Specific feedback is actionable feedback.

When you receive feedback, resist the urge to argue. Listen, take notes, and then go back to your documentation and lab to fill the gap.

The Formal Defense

The panel includes at least two evaluators — your instructor plus one additional evaluator such as a program advisor, employer partner, or second instructor. During the defense you must:

• Live-demonstrate at least one SIEM alert firing and your automation script executing. Test your lab environment immediately before the session. Have a backup screenshot or recording in case of a technical failure, but always attempt the live demo first.
• Answer a minimum of five panel questions without consulting notes. Questions are drawn from the question bank and cover Security+, CySA+, and ISC2 CC domain topics such as threat actors, attack techniques, controls, monitoring, incident response, and governance concepts.

If you do not know an answer, say so clearly and explain what you would do to find the answer in a professional setting. Panels respect honesty and process far more than a guess.

Rubric Categories and Scoring

Each of the five categories is scored 1 (does not meet expectations) to 4 (exceeds expectations):

| Category | What evaluators look for |

|---|---|

| Presentation clarity and organization | Logical flow, clear language, appropriate pace |

| Technical accuracy of design decisions | Correct use of security concepts, justified choices |

| Live demonstration success | Tools work, student explains what is happening |

| Documentation package | Complete, accurate, previously graded |

| Correctness of panel question responses | Accurate, appropriately detailed answers |

Maximum points: 20. Passing threshold: 80%, meaning a score of 16 or higher.

Professionalism and Conduct

Treat the defense like a job interview. Arrive early, confirm your lab environment is running, and have your slide deck open and ready. Speak to the panel, not the screen. If a live demonstration fails, stay calm, explain what should be happening, and offer your backup evidence. Panicking or giving up immediately signals poor professional readiness; methodical troubleshooting under pressure signals the opposite.

There are no physical safety hazards specific to this presentation, but be aware of data handling responsibilities: do not include real personal data in your screenshots or documentation, and ensure your lab environment is isolated from production systems per your program's acceptable-use policy.