Unit 10: Cybersecurity I Capstone and EHE Credential Preparation

Lesson at a glance

| Item | Detail | | --------------------- | -------------------------------------------------------------------------------------------- | | Suggested length | 6 × 60 minutes (final 2 weeks of Cyber I) | | Recommended placement | Weeks 17–18 | | Prerequisite | All prior units | | Materials | Capstone option packets, EHE practice question banks, portfolio template, peer-review rubric | | Capstone deliverable | Pick one of four (see below) |

Safety: Capstone work uses the lab range only. RoE from Unit 8 applies.

Standards & credential alignment

• EC-Council EHE: full domain coverage and credential preparation.
• VA CTE: complete program of study; portfolio development.
• NICE Workforce Framework: foundational competencies across SP, OM, AN, IN.

Learning objectives

By the end of this unit, students can:

1. Demonstrate proficiency across all EHE domains via practice exam.
2. Assemble a portfolio that documents lab work, findings, and reflection.
3. Complete and present one capstone of their choice.
4. Articulate a personal next-step plan: certifications, postsecondary, work-based learning.

Capstone options (pick one)

Option A - Secure-a-Small-Business

Students take a fictional business profile (5–15 employees, e.g., a local accounting firm) and produce:

• An asset inventory (10–20 items).
• A risk register (5+ risks scored).
• Three policy documents (AUP, password policy, incident response).
• A 10-item hardening checklist tailored to the business.
• A one-page executive summary.

Deliverable: PDF report (10–20 pages) + 5-minute oral presentation.

Option B - Beginner Penetration Test

Students conduct an authorized engagement against the lab range:

• Written RoE.
• Recon notes.
• Scan output (annotated).
• 3+ findings, each as a one-page write-up.
• An executive summary.

Deliverable: PDF report (8–15 pages) + 5-minute oral briefing.

Option C - Cyber Hygiene Assessment

Students assess a fictional or volunteer organization's cyber hygiene against a defined checklist (CIS IG1 subset works well):

• Interview / questionnaire results.
• Gap analysis.
• Prioritized recommendations (P0/P1/P2).
• A "what would a $5,000 budget buy first" memo.

Deliverable: PDF report (8–12 pages) + 5-minute presentation.

Option D - EHE Review Project

For students focused on credential attainment:

• Build a study guide covering all EHE domains (one section per domain).
• Annotate with personal lab evidence (screenshots from Units 3–9).
• Take 3 full practice exams; document scores and growth.
• Tutor one peer for one practice session.

Deliverable: Study guide PDF (15–25 pages) + scored practice exams + peer-tutoring reflection.

Pacing - full unit (6 days)

| Day | Focus | Notes | | ----- | ----------------------------------------- | ------------------------------------------ | | Day 1 | Review session 1 - Units 1–4 | Cold-call vocabulary, scenario quick-fire. | | Day 2 | Review session 2 - Units 5–7 | Phishing, crypto, hardening drills. | | Day 3 | Review session 3 - Units 8–9 | Recon-to-report, web/cloud/IoT. | | Day 4 | EHE practice exam (full length) | Time-boxed, exam-conditions. | | Day 5 | Capstone work session | Teacher conferences with each student. | | Day 6 | Capstone presentations + portfolio submit | Peer review with rubric. |

Day 1–3 - Review structure

Each review day follows the same shape:

1. Vocabulary cold-call (10 min). Pull cards. Wrong answers go to the bottom; revisit at end.
2. Scenario quick-fire (15 min). "Authorized or not? Defend in one sentence." Use Unit 1 scenarios + new ones written to fit the day's units.
3. Hands-on review (25 min). Re-run one signature lab from each covered unit, briefly. Snapshot, demo, restore.
4. Practice questions (10 min). 5–8 EHE-style questions, debrief.

Day 4 - Practice exam

Use a teacher-prepared 75-question, 90-minute practice exam mirroring EHE structure. Single-best-answer multiple choice. Score, review wrong answers as a class. Identify the two weakest domains for each student and assign targeted study before the real attempt.

Safety / fairness note: practice exams use only EHE-aligned questions written by the instructor or licensed from the credentialing partner. Do not source from leaked exam dumps; the program disqualifies students for use of dump material.

Day 5 - Capstone work session

Schedule 6-minute conferences with every student:

• Are they on track? What's the deliverable look like right now?
• One concrete fix they can make today.
• One question they're stuck on.

End-of-day check-in: every student has a draft.

Day 6 - Presentations + portfolio submission

Each student presents 5 minutes; 2 minutes Q&A. Peer-rubric scored (collected and averaged with teacher score).

Portfolio submission checklist

• [ ] Signed Lab Safety Agreement copy
• [ ] Unit 1 scenario rationales (graded)
• [ ] Unit 3 lab build screenshots (clean-install snapshot)
• [ ] Unit 4 Wireshark annotated capture
• [ ] Unit 6 hash + cert inspection deliverables
• [ ] Unit 7 hardening checklist completion
• [ ] Unit 8 nmap output + finding write-up
• [ ] Unit 9 Juice Shop deliverables
• [ ] Capstone PDF
• [ ] One-page reflection: what changed about how you see technology this year?

EHE preparation (the honest version)

• The exam is multiple choice and tests breadth more than depth.
• The biggest weak spot for students is terminology precision (e.g., difference between vulnerability and threat; between authentication and authorization).
• Read each question twice. If two answers seem right, pick the one most aligned with vendor (EC-Council) language, even if you'd phrase it differently in real life.
• Practice exams predict outcomes well - students who score 75%+ on the practice typically pass.

Career connection - close-of-program

Project the following on the screen for the final class:

You started this year not knowing what cybersecurity was.

You finished it able to:

• Read a network capture
• Harden a Linux server
• Recognize phishing
• Run a port scan and write the report
• Profile a threat actor
• Inspect a TLS certificate
• Articulate the difference between threat, vulnerability, and risk
• Speak the language of a profession

A SOC analyst on day one of their career does these things. So do you.

Homework / continuation

• Sign up for the EHE attempt (program partner / teacher to coordinate).
• For students continuing to Cyber II: complete the Cyber II prep packet over summer (provided).
• For students not continuing: enroll in a CompTIA Security+ self-study or community college Intro to Networking. Don't lose the year.

Teacher reflection prompts (for next year's planning)

1. Which unit had the highest re-teach rate? What changed about how it was delivered?
2. Which capstone option produced the strongest student outcomes? Why?
3. Which student surprised you most? What did you do that worked? What can you do for them in Cyber II?
4. What broke about the lab build process? Document and fix in the syllabus packet.