COMP 6660 · Assessment · Final Examination
COMP 6660 · Enterprise Cybersecurity Final Examination
The final examination is the comprehensive assessment for COMP 6660. It covers all units and all course learning outcomes, and assesses your ability to recall foundational concepts, to analyse technical problems, and to reason through an integrated enterprise case study requiring risk assessment, architectural analysis, governance considerations, and strategic recommendations.
01 Overview
The final examination is the comprehensive, summative assessment for COMP 6660. It covers all six units and all nine course learning outcomes, and it requires you to demonstrate both breadth of understanding — across the foundations, technologies, threats, architecture, infrastructure, and governance material — and depth of analysis — in reasoning through an integrated enterprise case study.
The examination has three parts. Part A assesses foundational concepts and principles. Part B assesses technical analysis and problem-solving. Part C presents an enterprise case study that requires integrated analysis — risk assessment, architectural analysis, governance considerations, and strategic recommendations. The three parts together assess the full range of capabilities the course has developed.
Purpose
- To assess your understanding of the full course content — foundations, technologies, threats, architecture, infrastructure, and governance.
- To assess your ability to recall foundational concepts, to analyse technical problems, and to reason through an integrated enterprise scenario.
- To provide a summative assessment of your capability against all nine course learning outcomes.
- To demonstrate, where appropriate for professional accreditation, your capability to reason at a graduate level about enterprise cybersecurity.
Structure
- Part A — Foundational concepts and principles (20% of the examination mark).
- Part B — Technical analysis and problem-solving (40% of the examination mark).
- Part C — Enterprise cybersecurity case study (40% of the examination mark).
Weight and value
- Weight: 30% of the final course grade.
- Contribution to CLOs: All nine CLOs.
- Duration: 3 hours (plus 15 minutes reading time at the start).
- Estimated preparation: 25–35 hours of revision across the whole course.
Format
- Mode: Invigilated, closed-book examination. Online invigilation is used for distance students.
- Delivery: Written examination, in a single sitting.
- Materials permitted: None — closed-book. No notes, no textbooks, no electronic aids.
- Calculator: A basic non-programmable calculator is permitted.
How to approach the examination
Begin your revision by reviewing the syllabus, the unit overviews, and the lesson summaries — these provide the structure of the course and the key concepts from each unit. Then revisit the material in each unit systematically, taking notes and testing your recall. Pay particular attention to the concepts that recur across units — governance, risk, defence in depth, identity, resilience — because these are the concepts that the examination's integrative questions will draw on. Practice writing short analytical answers under time pressure — the examination requires both recall and the ability to structure a reasoned argument quickly. In the examination itself, use the reading time to review Part C first — the case study provides context for how you should approach the analytical questions.
02 Format and logistics
| Item | Detail |
|---|---|
| Mode | Invigilated, closed-book examination. |
| Duration | 3 hours, plus 15 minutes of reading time at the start. Total time in the examination room: 3 hours 15 minutes. |
| Sections | Part A (20%), Part B (40%), Part C (40%). |
| Materials permitted | Pen, pencil, eraser, ruler. Non-programmable calculator. No notes, no textbooks, no electronic devices (other than those required for online invigilation). |
| Answer format | Written answers, structured as directed in each question. Answers should be legible, well-organised, and clearly labelled. |
| Total marks | 100 marks. Each mark corresponds approximately to 1.5 minutes of working time. |
| Scheduling | The examination is scheduled by the university during the examination period. Distance students will receive separate examination arrangements and instructions from the examinations office. |
| Invigilation | Invigilated in person for on-campus students; online invigilation (through the university's approved platform) for distance students. |
| Special arrangements | Students requiring accommodations should contact Accessibility Services well in advance of the examination period. |
| Deferred examinations | Where a student is unable to sit the examination due to illness or other extenuating circumstances, a deferred examination may be granted in accordance with university policy. Applications must be supported by appropriate documentation and submitted within the required timeframe. |
Suggested time allocation
The following time allocation is a guide — you should adjust it to your own working speed and to the requirements of each part:
| Activity | Time | Notes |
|---|---|---|
| Reading time | 15 minutes | Read the whole examination paper. Note which questions require the most time. Familiarise yourself with the Part C case study — it provides context for Parts A and B. |
| Planning | 5 minutes | Sketch out your planned answers. Identify the concepts and evidence you will use for each question. |
| Part A | 30–35 minutes | Short-answer and definition questions. Be concise — do not over-write. |
| Part B | 65–70 minutes | Technical analysis and problem-solving. Plan before you write. Structure your answers clearly. |
| Part C | 65–70 minutes | Integrated case study. Read the case carefully. Plan your answer. Structure your analysis across the required dimensions. |
| Review | 10 minutes | Check that you have answered every question, that you have addressed every component, and that your answers are legible. |
The most common examination error
The most common error in this examination is running out of time because the candidate did not plan. Part C carries the same weight as Parts A and B combined — yet candidates frequently leave Part C until last and run out of time. Use the reading time to read Part C first, allocate your time deliberately, and move on from a question that is taking too long even if it is not completely finished. A partly answered question scores more than an unanswered one.
03 Learning outcomes assessed
The final examination assesses all nine Course Learning Outcomes (CLOs):
| CLO | Description | Where assessed |
|---|---|---|
| CLO1 | Define the scope, objectives, principles, and strategic importance of enterprise cybersecurity. | Part A and Part C — foundational concepts and strategic framing. |
| CLO2 | Analyse cybersecurity threats, vulnerabilities, risks, and attack vectors affecting enterprise environments. | Part A, Part B, and Part C — threat analysis, risk assessment, and attack vector reasoning. |
| CLO3 | Evaluate and apply cryptographic, authentication, authorization, and access-control technologies. | Part A and Part B — cryptographic, identity, and access control questions. |
| CLO4 | Design and assess enterprise cybersecurity architectures and controls. | Part B and Part C — architecture design and analysis in enterprise scenarios. |
| CLO5 | Apply cybersecurity principles to secure enterprise systems, networks, cloud environments, and digital services. | Part B and Part C — applied security design across the technology estate. |
| CLO6 | Develop cybersecurity governance, risk-management, compliance, and policy frameworks. | Part C — governance considerations in the case study. |
| CLO7 | Evaluate incident response, business continuity, disaster recovery, and cyber-resilience strategies. | Part B and Part C — incident response and resilience dimensions. |
| CLO8 | Assess emerging cybersecurity technologies, trends, and challenges. | Part B and Part C — emerging technology and trend questions. |
| CLO9 | Conduct scholarly research and communicate cybersecurity findings effectively. | All parts — the ability to structure, to support, and to communicate reasoned analysis under examination conditions. |
04 Coverage
The examination covers all units and lessons of the course. The weighting of questions across the units reflects their relative importance within the course structure, with the greatest weight given to the integrative and applied dimensions.
| Unit | Focus | Approximate coverage |
|---|---|---|
| Unit 1 | Foundations of enterprise cybersecurity — objectives, principles, threat landscape, frameworks, and case studies. | Foundational concepts throughout Part A, and strategic context in Part C. |
| Unit 2 | Core cybersecurity technologies — cryptography, PKI, identity, authentication, authorization, Zero Trust. | Technical questions in Part A and Part B — particularly cryptographic and identity content. |
| Unit 3 | Threats, risks, vulnerabilities, and attacks — risk fundamentals, threat modelling, vulnerability assessment, malware, social engineering, APTs, supply chain. | Part B — threat modelling and supply-chain analysis, and Part C — risk assessment. |
| Unit 4 | Enterprise security architectures — architecture principles, defence in depth, network security, VPNs, firewalls, IDS/IPS, SIEM/XDR/SOC. | Part B — architecture, technology comparison, and Part C — architectural analysis. |
| Unit 5 | Enterprise systems and infrastructure security — operating systems, endpoints, applications, databases, cloud, containers, mobile, IoT, critical infrastructure. | Part B — infrastructure security questions, and Part C — infrastructure dimensions. |
| Unit 6 | Governance, risk, compliance, and resilience — governance, policy, risk management, compliance, awareness, audit, incident response, continuity, resilience, emerging trends. | Part C — governance considerations and strategic recommendations, and Part B — resilience and emerging trends. |
Key concepts examined
The examination draws on the concepts that recur across the course — the concepts that describe enduring features of how enterprises manage security. These include:
- Governance, accountability, and decision rights.
- Risk management — identification, assessment, treatment, and monitoring.
- Security objectives — confidentiality, integrity, availability, and the supporting concepts of authenticity, accountability, and non-repudiation.
- Cryptography — symmetric, asymmetric, and hybrid approaches; key management; digital signatures.
- Identity and access management — authentication, authorization, RBAC, ABAC, privileged access.
- Zero Trust — verify explicitly, least privilege, assume breach.
- Defence in depth — layered controls, redundancy, diversity, isolation, graceful degradation.
- Threat modelling — approaches, methodologies, and the analysis of attack paths.
- Incident response — preparation, detection, containment, eradication, recovery, and learning.
- Business continuity and disaster recovery — recovery objectives, strategies, and testing.
- Resilience — anticipate, withstand, adapt, recover, and learn.
- Compliance — obligations, control mapping, and assurance.
- Supply chain and third-party risk — dependencies, concentration, and governance.
- Emerging technology — AI, cloud, IoT, OT — and the security and governance dimensions of each.
05 Part A — Foundational concepts and principles
Part A overview
Weight: 20% of the examination mark (20 marks).
Format: Short-answer questions — definitions, brief explanations, and concept comparisons.
Suggested time: 30–35 minutes.
What Part A assesses
Part A assesses your recall and understanding of the foundational concepts and principles of enterprise cybersecurity — the concepts that underpin all of the more applied material in Parts B and C. It asks you to define, to explain, and to distinguish — drawing on the material examined in Units 1, 2, and 6.
Sample question forms
Part A questions take one of the following forms. The examples below are illustrative — the actual questions will vary:
Form 1 — Definition
Provide a precise definition of the term, and give a brief example of its application in an enterprise context.
Example: Define residual risk, and explain why it is the appropriate measure against which risk appetite is assessed in an enterprise security programme.
Form 2 — Explanation
Explain the concept, and explain why it matters for enterprise security practice. Your answer should demonstrate understanding of both what the concept is and why it is significant.
Example: Explain the shared responsibility model in cloud security, and explain why it is frequently misunderstood in enterprise practice.
Form 3 — Comparison
Compare and contrast the two concepts. Be specific about the differences, and explain why the distinction matters in practice.
Example: Compare and contrast business continuity and disaster recovery. Explain why the distinction matters for how enterprises organise their resilience capability.
Form 4 — Principle application
State the principle, and explain how it applies to a specific enterprise security scenario.
Example: State the principle of least privilege, and explain how it applies to the management of privileged accounts in a large enterprise.
Marking criteria for Part A
| Criterion | Weight | What the marker looks for |
|---|---|---|
| Accuracy | 50% | Correct, precise definitions and explanations. Appropriate use of terminology. No significant technical errors. |
| Completeness | 30% | All components of the question addressed. Where the question asks for an explanation or a comparison, both parts are provided. |
| Application | 20% | Where the question asks for an example or an application, a specific and appropriate example is provided. The application demonstrates understanding rather than mere recall. |
Preparing for Part A
Part A rewards precise understanding. Revise the key terms and concepts systematically — the glossary entries in the course lessons are a starting point, but you should be able to explain each concept in your own words rather than merely reproduce a definition. Practice writing short answers under time pressure — one or two minutes per mark is the appropriate pace. Where a question asks for a comparison, structure your answer as a comparison — do not simply describe each concept separately.
06 Part B — Technical analysis and problem-solving
Part B overview
Weight: 40% of the examination mark (40 marks).
Format: Technical analysis and problem-solving questions — applied reasoning, technology comparison, architecture design, and analysis.
Suggested time: 65–70 minutes.
What Part B assesses
Part B assesses your ability to apply the technical material examined across the course to specific problems and scenarios. It draws on the cryptographic, identity, architecture, threat, and infrastructure material examined in Units 2–5, and on the resilience and emerging technology material examined in Unit 6. It requires you to demonstrate not only that you understand the material, but that you can use it — to compare technologies, to analyse problems, to design solutions, and to reason through trade-offs.
Sample question forms
Form 1 — Technology comparison
Compare two or more technologies or approaches, and recommend which is appropriate for a specific enterprise context, with justification.
Example: An enterprise is designing the authentication architecture for a mixed population of employees, contractors, and customers. Compare password-based authentication, TOTP-based MFA, push-based MFA, and FIDO2/passkey authentication, and recommend how the enterprise should deploy each for each population. Justify your recommendation with reference to the security properties and the usability characteristics of each mechanism.
Form 2 — Architecture design
Design a specific component of a security architecture for a defined enterprise context, and justify your design decisions.
Example: A regional manufacturer is deploying a new IoT sensor estate across its production facilities. Design the network and identity architecture for the IoT estate, ensuring that the IoT devices can communicate with the manufacturer's cloud platform while limiting the consequence of compromise. Justify your design decisions with reference to the specific characteristics of IoT devices.
Form 3 — Threat or risk analysis
Analyse a specific threat or risk scenario, and recommend the controls or treatments that address it.
Example: A financial institution is concerned that its privileged accounts present a significant risk of insider compromise. Analyse the specific ways in which privileged accounts are exploited, and recommend the controls that should be implemented. Explain the trade-offs that the institution should consider.
Form 4 — Cryptography or protocol analysis
Analyse a specific cryptographic or protocol question, and explain the implications for enterprise security practice.
Example: An enterprise is planning its transition to post-quantum cryptography. Explain the threat that quantum computing presents to RSA and ECC, and recommend how the enterprise should plan for the transition. Your answer should address the practical challenges of the transition.
Form 5 — Incident or resilience analysis
Analyse an incident response or resilience scenario, and recommend the approach the enterprise should take.
Example: A cloud service provider experienced a multi-hour outage affecting the enterprise's customer-facing services. Analyse how the enterprise should have prepared for this scenario, and recommend how the enterprise should adjust its architecture and its continuity strategy in response.
Marking criteria for Part B
| Criterion | Weight | What the marker looks for |
|---|---|---|
| Technical accuracy | 35% | Correct, precise technical understanding of the concepts addressed in each question. Appropriate use of terminology. No significant technical errors. |
| Applied reasoning | 35% | Ability to apply the concepts to the specific enterprise scenarios. Coherent analysis and design decisions, with clear justification. Reasoning that goes beyond recall. |
| Critical evaluation | 20% | Recognition of trade-offs, limitations, and alternatives. Willingness to identify where a technology or approach is not appropriate, and to note unresolved issues. |
| Communication | 10% | Clear, structured, and professional answers. Diagrams where appropriate. Correct use of terminology and notation. |
Preparing for Part B
Part B rewards applied understanding. Revise the technical material systematically, but practice applying it — work through the technical questions in the assignments, review the activities in the lessons, and practice designing solutions for realistic enterprise scenarios. Pay particular attention to the technologies that appear across multiple units — identity, encryption, segmentation, monitoring — because these are the technologies that the examination's applied questions will draw on. Practice structuring analytical answers quickly — the ability to plan and to structure an answer under time pressure is a significant element of Part B success.
07 Part C — Enterprise cybersecurity case study
Part C overview
Weight: 40% of the examination mark (40 marks).
Format: A single integrated case study requiring analysis across four dimensions — risk assessment, architectural analysis, governance considerations, and strategic recommendations.
Suggested time: 65–70 minutes.
What Part C assesses
Part C is the integrative component of the examination. It presents an enterprise scenario — a specific organisation, with a specific technology estate, facing specific cybersecurity challenges — and asks you to analyse the scenario across four dimensions. It assesses your ability to reason at a senior level about enterprise cybersecurity, drawing on the whole course, and to communicate your reasoning in a structured and compelling way.
The four analysis dimensions
Identify the principal risks the enterprise faces — expressed in the cause-event-consequence format — and assess their likelihood and impact. Determine which risks exceed the enterprise's assumed appetite. Recommend the treatments the enterprise should prioritise.
Analyse the enterprise's current architecture — the technology estate, the trust boundaries, the control environment — and identify the architectural weaknesses that contribute to the enterprise's exposure. Recommend the architectural changes that would reduce the enterprise's risk.
Analyse the enterprise's governance arrangements — the board oversight, the executive accountability, the risk appetite, the policy framework, the assurance arrangements — and identify the governance weaknesses that contribute to the enterprise's exposure. Recommend the governance changes that would improve the enterprise's security posture.
Recommend the strategic direction the enterprise should take — the priorities, the investments, the sequence, and the governance arrangements. Your recommendations should follow from your analysis and should be specific, coherent, and actionable.
Sample case study structure
Part C presents a case study of approximately 800–1,200 words. The case study describes an enterprise — its sector, its size, its technology estate, its security posture, its recent incidents, and its current challenges. The case is designed to support analysis across all four dimensions, and to require you to draw on the whole course.
The following is an illustrative summary of the kind of case study that Part C may present. The actual case study will vary:
Illustrative case study
The organisation. A national health information exchange (HIE) provides a shared platform through which hospitals, clinics, laboratories, and pharmacies exchange patient information. The HIE serves 200 healthcare provider organisations, covering approximately 4 million patients. It employs 350 staff and operates a mix of on-premises systems and cloud services.
The estate. The HIE's core platform runs on a public cloud, with integration services hosted in two on-premises data centres. The platform processes approximately 20 million transactions per day. It integrates with provider systems through APIs, through a message-broker architecture, and through a legacy file-transfer interface that several larger providers still use. Administrative access is through a mix of direct API access, jump hosts, and a legacy remote-administration interface that has been retained for compatibility.
Recent events. Over the last 18 months, the HIE has experienced three significant security events: a phishing incident that led to the compromise of an administrator's credentials and subsequent unauthorised access to a production environment; an outage of the message-broker service that disrupted integration for approximately six hours; and a data-exposure incident caused by a misconfigured cloud storage bucket containing historical patient data.
Current posture. The HIE has a documented security policy framework, an internal security team of twelve, an incident response plan that has been exercised twice, and a backup and recovery capability that has been tested for the primary platform but not for the integration services. Its privileged access is managed through a shared administrative account for legacy compatibility. Its regulatory environment includes health privacy regulation and national critical infrastructure obligations.
The task. Analyse the HIE's situation across the four dimensions — risk assessment, architectural analysis, governance considerations, and strategic recommendations — and present your analysis in a structured report.
Marking criteria for Part C
| Criterion | Weight | What the marker looks for |
|---|---|---|
| Risk assessment | 25% | Accurate identification of the principal risks the enterprise faces. Correct expression of risks in cause-event-consequence form. Sound assessment of likelihood and impact. Sensible prioritisation of treatments. |
| Architectural analysis | 25% | Accurate analysis of the enterprise's architecture. Identification of the architectural weaknesses that contribute to the enterprise's exposure. Coherent and well-justified architectural recommendations. |
| Governance considerations | 25% | Accurate analysis of the enterprise's governance arrangements. Identification of the governance weaknesses that contribute to the enterprise's exposure. Coherent and well-justified governance recommendations. |
| Strategic recommendations | 20% | Clear, coherent, and actionable strategic direction. Recommendations that follow from the analysis. Sensible prioritisation and sequencing. Awareness of trade-offs and constraints. |
| Communication | 5% | Clear, structured, and professional presentation. Effective use of headings, of structure, and — where appropriate — of diagrams. Correct use of terminology. |
Preparing for Part C
Part C rewards integrative understanding. Practice with the case studies and scenarios in the course — particularly the case studies in Unit 1, the enterprise scenarios in the assignments, and the discussion prompts in the units. Practice writing structured analyses under time pressure — the ability to structure a multi-dimensional analysis in sixty minutes is the central challenge of Part C. Remember that the four dimensions are connected — your architectural analysis should follow from your risk assessment, your governance analysis should explain why the architectural weaknesses persist, and your strategic recommendations should address both.
08 Overall marking rubric
The final examination is marked out of 100. The overall mark comprises the weighted total of the three parts, scaled to the examination weight in the course.
| Component | Weight | Marks |
|---|---|---|
| Part A — Foundational concepts and principles | 20% | 20 |
| Part B — Technical analysis and problem-solving | 40% | 40 |
| Part C — Enterprise cybersecurity case study | 40% | 40 |
| Total | 100% | 100 |
Grade descriptors
| Grade | Range | Description |
|---|---|---|
| A (Excellent) | 85–100% | Demonstrates comprehensive and precise understanding across the whole course. Original and sophisticated analysis. Clear, precise, and professional communication. Answers address the questions with insight and depth, identify trade-offs and limitations, and reach well-justified conclusions. The Part C analysis is coherent, integrated, and strategic. |
| B (Good) | 70–84% | Demonstrates strong understanding and competent analysis across the course. Clear and well-structured communication. Answers address the questions fully, though with less depth, originality, or nuance than an A-grade submission. The Part C analysis is competent and coherent, though may not fully integrate the four dimensions. |
| C (Satisfactory) | 60–69% | Demonstrates adequate understanding across the course. Basic analysis. Clear but sometimes imprecise communication. Answers address the questions but may be superficial, may not fully engage with trade-offs, or may lack original insight. The Part C analysis is adequate but may be fragmented. |
| D (Marginal) | 50–59% | Demonstrates limited understanding across the course. Weak analysis. Communication difficulties. Answers address parts of the questions but may contain technical inaccuracies, may lack justification for design decisions, or may omit key components. The Part C analysis is weak or incomplete. |
| F (Unsatisfactory) | 0–49% | Does not demonstrate understanding of the course material. Minimal or no analysis. Unclear communication. Answers do not address the questions, contain significant technical errors, or are substantially incomplete. |
Examination pass requirement
In addition to the university's standard pass requirement for the course, students must achieve a minimum of 50% on the final examination to pass COMP 6660. Students who achieve a passing grade in the coursework but do not achieve 50% on the examination may be required to sit a supplementary examination, in accordance with university policy.
09 Preparation guidance
Revision strategy
Effective revision for the final examination requires a systematic approach — the course covers a wide range of material, and the examination requires both breadth and depth. The following approach is recommended:
Begin with the syllabus, the course learning outcomes, and the unit overviews. Understand the structure of the course — the three modules, the six units, and the thirty-six lessons — and the relationship between them.
For each unit, review the learning outcomes, the lesson summaries, and the key concepts. Identify the concepts you are confident about and those you are not. Prioritise the areas where you need further work.
Use the self-check questions in each lesson to test your recall. Where you cannot answer confidently, revisit the lesson material. Repeated testing is more effective than repeated reading.
Work through the technical questions and activities in the assignments. Practice designing solutions for realistic enterprise scenarios. Practice structuring analytical answers quickly.
Practice with the case studies and scenarios in the course. Practice writing a multi-dimensional analysis of an enterprise scenario within a time limit. Develop a standard approach that you can apply to whatever case study the examination presents.
Pay particular attention to the concepts that recur across units — governance, risk management, defence in depth, identity, resilience, supply chain. These are the concepts the examination's integrative questions will draw on.
Simulate examination conditions — with a time limit, with no notes, and with the whole paper to be answered. Practice allocating your time deliberately and moving on from questions that are taking too long.
Time allocation during revision
The examination covers the whole course, but the units are not equally weighted in the examination. The following is a suggested allocation of revision time:
| Area | Suggested proportion | Reason |
|---|---|---|
| Unit 1 — Foundations | 10% | Foundational concepts recur throughout the examination. |
| Unit 2 — Core technologies | 15% | Cryptography, identity, and access control are heavily examined in Part A and Part B. |
| Unit 3 — Threats and risk | 15% | Threat modelling, risk assessment, and supply-chain analysis are examined in Part B and Part C. |
| Unit 4 — Security architecture | 15% | Architecture and technology comparison are heavily examined in Part B. |
| Unit 5 — Infrastructure security | 15% | Infrastructure security is examined in Part B and in the Part C case study. |
| Unit 6 — Governance and resilience | 20% | Governance, resilience, and emerging trends are central to Part C. |
| Integrated practice | 10% | Practice under examination conditions with the whole course in view. |
Common revision mistakes
- Reading rather than testing. Reading the material is less effective than testing your recall. Use the self-check questions.
- Focusing only on one part of the course. The examination covers the whole course — the material you avoid revising is the material you will be examined on.
- Memorising without understanding. The examination rewards understanding — the ability to apply concepts to unfamiliar scenarios — not the ability to reproduce definitions.
- Not practicing applied reasoning. The examination requires you to design, to analyse, and to reason — not only to recall. Practice these capabilities, not only the recall.
- Not practicing integrated analysis. Part C requires you to integrate the whole course into a coherent analysis. Practice this capability specifically.
- Not practicing under time pressure. The examination is time-constrained. The ability to structure an answer quickly is a significant element of success.
- Cramming. The examination requires integrated understanding, which is not produced by last-minute cramming. Distribute your revision over the weeks before the examination.
The most useful preparation
The most useful preparation is to practice reasoning about enterprise scenarios at the level the examination requires. Take a scenario — any enterprise, any sector, any technology estate — and practise analysing it across the four dimensions of Part C: risk assessment, architectural analysis, governance considerations, and strategic recommendations. Practice structuring your analysis quickly and coherently. The examination is not testing your memory of the course material — it is testing your capability to reason as a senior security professional with the course material as your foundation.
10 Examination rules
The final examination is governed by the university's examination regulations. The following rules apply specifically to this examination:
- Identification. You must bring your student identification to the examination and present it on request.
- Materials. The examination is closed-book. No notes, no textbooks, no printed material of any kind is permitted. A basic non-programmable calculator is permitted.
- Electronic devices. Mobile phones, smart watches, and other electronic devices must be switched off and placed out of reach. For online invigilation, only the approved devices and applications are permitted.
- Timing. You may not leave the examination room in the first thirty minutes or the last fifteen minutes of the examination. If you leave during the permitted window, you may not take any examination material with you.
- Answer booklets. Answers must be written in the answer booklets provided. Rough work should be clearly identified and crossed out.
- Legibility. Answers must be legible. Answers that cannot be read cannot be marked.
- Completion. At the end of the examination period, you must stop writing and return all materials. Failure to comply is a breach of examination regulations.
- Illness or emergency. If you are unable to complete the examination due to illness or emergency, inform the invigilator immediately and follow the university's procedures for deferred examinations.
Breaches of examination regulations
Breaches of examination regulations — including possession of unauthorised materials, use of unauthorised devices, communication with other candidates, or any other form of cheating — are treated as serious academic misconduct. Penalties range from a mark of zero on the examination to suspension or expulsion from the university. If you are in any doubt about what is permitted, ask the invigilator before the examination begins.
11 Academic integrity
The final examination must be your own work. You must not:
- Copy from another candidate. Communication with other candidates during the examination is not permitted.
- Use unauthorised materials. The examination is closed-book. No notes, textbooks, or printed material of any kind are permitted.
- Use unauthorised electronic devices. Mobile phones, smart watches, and other electronic devices are not permitted.
- Obtain assistance. Assistance from any other person — including through unauthorised communication — is not permitted.
- Impersonate another candidate. Sitting the examination on behalf of another person, or having another person sit it on your behalf, is a serious breach of academic integrity.
- Use generative AI. Generative AI tools are not permitted in any form during the final examination.
All examination scripts will be checked through plagiarism detection and marking analysis. Suspected cases of academic misconduct will be handled in accordance with the university's academic integrity policy.
Integrity as professional practice
Academic integrity in the examination is a rehearsal for professional integrity in practice. The examination conditions — closed book, no assistance, defined time — test your capability as a security professional to reason from first principles. In professional practice, you will frequently face situations where you must make a judgement under time pressure, with incomplete information, and without the ability to consult. The examination is a rehearsal for that experience — and the integrity with which you approach the examination is a rehearsal for the integrity with which you will approach your professional responsibilities.
12 Support and resources
Revision resources
- Lesson summaries — each lesson includes a summary of the key points. These summaries are a useful revision aid.
- Unit learning outcomes pages — the learning outcomes for each unit identify what you should be able to do. Use them as a revision checklist.
- Self-check questions — each lesson includes self-check questions. Use these to test your recall.
- Unit discussions — the discussion forums provide opportunities to test your understanding against your peers.
- Assignment feedback — the feedback you received on your three assignments identifies the areas where you have demonstrated strength and the areas where you could improve. Use this feedback as part of your revision.
Examination support
- Examinations office — for questions about examination scheduling, examination arrangements, and examination regulations.
- Accessibility services — for examination accommodations. These must be arranged in advance of the examination period.
- Student services — for broader support during the examination period — including academic support, wellbeing support, and stress management.
Contact
- Course instructor — for questions about the examination content or expectations. Contact through Brightspace or at the address provided in the syllabus.
- Teaching assistants — for questions about the course material or about examination preparation. Contact details are available in Brightspace.
- Examinations office — for questions about scheduling, arrangements, and examination regulations.
Getting help early
If you have questions about the examination or about your preparation, ask early — the instructor and teaching assistants are here to help. If you are struggling with the material, or with any aspect of the examination preparation, contact the instructor or the support services before the examination — not after. Exam-related accommodations and deferred examinations must be arranged in advance, so if you anticipate any difficulty, make arrangements early.
13 Preparation checklist
Use the checklist below to plan and to verify your preparation. It is not exhaustive, but it identifies the principal requirements.
Early preparation (weeks before)
- Read the examination brief in full.
- Review the course structure — the syllabus, the CLOs, and the unit overviews.
- Identify the concepts you are confident about and those you are not.
- Plan your revision — allocate time across all six units and across integrated practice.
- Collect your revision resources — lesson summaries, learning outcomes, self-check questions, assignment feedback.
- Arrange any necessary examination accommodations with Accessibility Services.
Active revision
- Review each unit's key concepts systematically.
- Test your recall using the self-check questions.
- Practice applied reasoning with the technical questions and activities in the assignments.
- Practice integrated analysis with the case studies and scenarios in the course.
- Revise the recurring concepts — governance, risk, defence in depth, identity, resilience, supply chain.
- Practice under time pressure — simulate examination conditions.
Immediately before the examination
- Confirm the examination date, time, and location (or online arrangements).
- Confirm what materials are permitted (pen, pencil, eraser, ruler, calculator).
- Confirm what identification you need to bring.
- Get adequate rest the night before.
- Arrive at the examination location (or join the online session) in good time.
- Ensure that all electronic devices are switched off and placed out of reach.
During the examination
- Use the reading time to review the whole paper — and to read Part C first.
- Plan your time allocation — and stick to it.
- Plan each answer before you write it.
- Answer every question — a partly answered question scores more than an unanswered one.
- Move on from a question that is taking too long — even if it is not completely finished.
- Use diagrams where appropriate — particularly in Parts B and C.
- Leave time to review your answers — check that you have answered every question, addressed every component, and written legibly.
A final note
The final examination is the summative assessment of your learning in COMP 6660. It is an opportunity to demonstrate, in a single sitting, the breadth and depth of your understanding of enterprise cybersecurity — and the capability you have developed to reason about enterprise cybersecurity at a graduate level. Approach it as you would approach a significant professional task — with preparation, with organisation, and with confidence in the capability you have developed over the course. The examination is not designed to catch you out — it is designed to give you the opportunity to demonstrate what you have learned.