Module 6 Overview

Theme

Testing response automation

Essential Question

How can automation be validated before incidents?

Module Components

• Book prose: conceptual framing, domain scenario, methods, and failure modes

• Assignment: evidence-backed production of a specific artifact

• Slides: presentation sequence for seminar or lecture delivery

• Narration: spoken version of the slide flow

• Instructor notes: facilitation plan, discussion prompts, and grading cues

• Rubric: criteria for evaluating the module artifact

• Notebook: executable lab aligned with the module theme using synthetic incident records with severity, confidence, blast radius, containment option, and approval outcome

Module Artifact

automated response playbook with approval gates, rollback plan, and post-incident learning loop focused on testing response automation: Create a simulation test plan.

Professional Setting

Students work as if advising an incident response team deciding which containment actions can be automated safely. Their work must be intelligible to incident commander, security engineer, legal/compliance reviewer, and affected service owner.