Final Examination

The brief

A two-hour, in-person written examination covering the malware production lifecycle from idea to operational use, plus analysis, detection and operational security.

The examination is the course’s synthesis: two hours, in person, written, covering everything from Week 1’s question of what counts as malware through to Week 11’s operational-security failures. It does not test any single week in isolation; a strong answer connects motivation to architecture, execution to the evidence it leaves behind, and persistence to the operational-security cost of maintaining it.

Week 12’s own revision guidance is the best preparation available: be able to explain each lifecycle stage and its trade-offs, practise mapping a scenario onto the full production path, distinguish observed fact from inferred intent, and state confidence levels honestly when discussing attribution. The seriousness with which the course has treated its subject all semester applies here as well: this is a systems-engineering examination, assessed on reasoning rather than on recall of individual exploits.

What you submit

• Attendance for the full two hours, with only permitted materials

How it is marked

Assessed on coherent reasoning across the whole lifecycle rather than on factual recall, namely how motivation shapes architecture and operational security, which stages tend to generate detectable evidence, and whether attribution claims are made with appropriate confidence.

Key dates

• Examination: 12 November 2027