Confidence with basic diagrams and section terminology
Outcomes
Explain feature security review pack in your own words and apply it to a realistic scenario.
The goal is a small pack you can defend: risks, controls, tests, and evidence.
Check the assumption "Evidence is part of the deliverable" and explain what changes if it is false.
Check the assumption "Trade-offs are written down" and explain what changes if it is false.
Practice
Work through one scenario and justify the decision with evidence
Compare two options and name the trade-off clearly
Artefact and failure modes
A one-page decision note with assumption, evidence, and chosen action
Docs without verification. A document that nobody can test becomes a comfort blanket.
Controls without owners. If ownership is unclear, controls decay and the pack becomes outdated.
Optional
Planning and evidence
Objectives, timing, and CPD tracking
Show
If you want to start learning now, leave this closed. Come back when you want to plan your practice or keep evidence for CPD. This is guidance and it is not endorsed by awarding bodies. Standards mapping lives on the course overview page.
Learning objectives
What you will be able to do
1. Apply basic threat modelling to a small system, identifying assets, actors, and likely threats.
Threat modelling turns fear into structured choices you can defend.
2. Explain how authentication, authorisation, sessions, and cookies interact in common web flows.
Auth flows are where most real attacks aim, so you must understand them.
3. Analyse simple log signals and relate them to likely misuse or attack paths.
Logs are evidence, and evidence drives response under pressure.
4. Evaluate trade offs between controls when constraints (cost, usability, risk) conflict.
Trade offs are real, so you need to justify control choices clearly.
What comes next
Next we step into governance and response because that is where organisations succeed or fail.
Each level is independent but clearly deeper than the last. This panel makes the jump explicit.
Assessment intent
Applied
Scenario based judgement, common failure modes, and trade-offs between controls.
Style
scenario
18 questions
30 min timed
Pass standard
80%
Not externally certified
▸Evidence you can save (CPD friendly)
A one page threat model for a small product: abuse cases, controls, and what you would log.
An attack surface inventory: what is exposed, what can be removed, what must be protected, and why.
A short risk trade-off write-up: two controls, one constraint, and a defensible choice.
Learning contract
Applied outcomes
About 8 hours
Read the explanation first, then use the tools to test the idea. Skip any tool that is not useful for your goal.
Apply basic threat modelling to a small system, identifying assets, actors, and likely threats.
Explain how authentication, authorisation, sessions, and cookies interact in common web flows.
Analyse simple log signals and relate them to likely misuse or attack paths.
Evaluate trade offs between controls when constraints (cost, usability, risk) conflict.
Loading content...
Next step
Practise this level, then take the timed assessment
I recommend you start with the practice assessment for Applied. It is not timed and it helps you write a clear CPD reflection before the full assessment.
18
Questions
30
Minutes
80%
Pass mark
Practice assessment
Start the practice assessment for Applied
It is designed for confidence and evidence, and you can retry as often as you need.
Sign in to save progress and keep your pass record
You can complete the course while signed out, and your progress saves in this browser. Sign in before assessments so your pass record is attached to your account.
Courses and assessments are free. There is no paywall for the learning path, practice questions, or formal assessments. Optional donations support hosting, maintenance, and ongoing updates.
During timed assessments, copy and the context menu are restricted to reduce casual cheating. Passed assessments are recorded in your account as evidence.
Course materials are protected by intellectual property rights.View terms
