--- title: 'Professional Competency Paths' source: 'https://academia.sh/en/courses/introduction-to-cybersecurity/professional-competency-paths' course: 'Introduction to Cybersecurity' language: en updated: '2026-09-13T05:08:03+00:00' license: 'CC BY-SA 4.0' objectives: - 'Splits competency into items by what is measured: separates form, single-meaning, and consequence' - "Counts the intersection and divergence between the practical exam's and the multiple-choice certification's measured skill sets" - 'Identifies the skill the lab environment does not cover and computes the path load of the item no path measures' --- # Professional Competency Paths Separating competency paths by what they measure: in a 15-item competency set, multiple-choice certification measures 2 items, the practical exam 9, and the lab environment 6; the two exam formats agree on 2 items and diverge on 7; the three paths together measure 10 items; and the 5 items none of them measure carry 39.2% of the total path load. The previous lesson measured authority as a document: how many items it defines with a single meaning, how many it opens to dispute, and how many paths it makes testable. Once the text is written, the work becomes executable; what remains is how the person **able** to do that work is told apart. An organization hands this question to three separate measurements. A **multiple-choice certification** measures recognizing an answer in an exam room. A **practical exam** measures reaching an end state within a set time. A **lab environment** lets a person work through a setup they build themselves, one with no real consequence, again and again. All three measure something, but not the same thing. This lesson separates the three on a single question: **how many of the competency items this course requires do they measure.** ## Writing Competency as an Item - **FR25.** The competency set is 15 items, drawn from the work the course's fifteen lessons genuinely required: counting paths, adding a layer, narrowing privilege, choosing which step to cut, and the like. - **FR26.** Each item has three properties. **Form:** is the item demonstrated by knowledge (`k`) or by practice (`p`). **Single meaning:** is there a single correct end state that can be tested. **Consequence:** does getting it wrong carry a real cost — legitimate work stops, another team is affected. - **FR27.** Multiple-choice certification measures only an item whose form is knowledge and which has a single meaning. The practical exam measures every item with a single meaning; it cannot grade one with no defined end state. The lab environment covers every item with no real consequence; an item with a real consequence does **not** occur in a lab. - **FR28.** Each item's **path load** is the number of paths, in this course's 30-path model, that cannot close without that item. Loads can be summed, but the same path is counted under more than one item; the total is a **load**, not a distinct path count. - **FR29.** The model is fictional; there is no real exam, certification, organization, or lab product. ```js // competency/measure.mjs — the 15 competency items this course requires and the coverage of the // three measurement pathways (MODEL). There is no real exam, certification, organization, or lab. // form: k = demonstrated by knowledge, p = demonstrated by practice // single: is there a testable single correct end state | cost: does being wrong have a real cost // path: in this course's 30-path model, the number of paths that cannot close without this item const ITEM = ` term-separation k yes no 30 risk-ranking k yes no 12 path-counting p yes no 30 layer-adding p yes yes 22 privilege-narrowing p yes yes 17 bulkhead-design p yes yes 14 default-review p yes no 8 log-analysis p yes no 6 incident-response p yes yes 5 environment-setup p no no 0 step-selection p no yes 22 legit-work-cost p no yes 22 inventory-keeping p no yes 19 scope-writing k no yes 22 boundary-recognition k no yes 8` .trim().split("\n").map((r) => { const [name, form, single, cost, path] = r.trim().split(/\s+/); return { name, form, single: single === "yes", cost: cost === "yes", path: Number(path) }; }); // Three measurement pathways, defined as predicates over item properties. const WAY = { "multiple-choice": (k) => k.form === "k" && k.single, // a recognizable single right answer "practical-exam": (k) => k.single, // a testable end state "lab": (k) => !k.cost, // an item with a real cost does not occur here }; const NAME = Object.keys(WAY); const write = (g, ...s) => console.log(s.map((v, i) => (g[i] < 0 ? String(v).padEnd(-g[i]) : String(v).padStart(g[i]))).join("")); const load = (s) => s.reduce((a, k) => a + k.path, 0); const TOTAL = load(ITEM), share = (x) => `${((x / TOTAL) * 100).toFixed(1)}%`; console.log(`competency MODEL: ${ITEM.length} items, total path load ${TOTAL} ` + `(the same path is counted under more than one item; this is a load total, not a distinct path count).`); const T = [-26, 18, 20, 16]; console.log("\n1. how many items each measurement pathway measures"); write(T, "measure", ...NAME); for (const [ad, f] of [["item measured", (b) => `${ITEM.filter(WAY[b]).length}/${ITEM.length}`], ["path load measured", (b) => load(ITEM.filter(WAY[b]))], ["share of path load", (b) => share(load(ITEM.filter(WAY[b])))]]) write(T, ad, ...NAME.map(f)); const both = ITEM.filter((k) => WAY["multiple-choice"](k) && WAY["practical-exam"](k)); const onlyOne = ITEM.filter((k) => WAY["multiple-choice"](k) !== WAY["practical-exam"](k)); const none = ITEM.filter((k) => !NAME.some((b) => WAY[b](k))); const union = ITEM.filter((k) => NAME.some((b) => WAY[b](k))); const W2 = [-38, 10, 13]; console.log("\n2. where the two exam formats agree, where they diverge"); write(W2, "set", "items", "path load"); for (const [ad, s] of [["measured by both", both], ["measured by only one", onlyOne], ["measured by neither", ITEM.filter((k) => !k.single)], ["not covered by the lab", ITEM.filter((k) => k.cost)], ["measured by the three together", union], ["measured by none of them", none]]) write(W2, ad, s.length, `${load(s)} (${share(load(s))})`); console.log("\n3. items no measurement pathway measures"); write([-26, 8, 8], "item", "path", "form"); for (const k of none) write([-26, 8, 8], k.name, k.path, k.form); console.log(`what these ${none.length} items share: no single correct end state, ` + `and being wrong has a real cost.`); ``` ``` competency MODEL: 15 items, total path load 237 (the same path is counted under more than one item; this is a load total, not a distinct path count). 1. how many items each measurement pathway measures measure multiple-choice practical-exam lab item measured 2/15 9/15 6/15 path load measured 42 144 86 share of path load 17.7% 60.8% 36.3% 2. where the two exam formats agree, where they diverge set items path load measured by both 2 42 (17.7%) measured by only one 7 102 (43.0%) measured by neither 6 93 (39.2%) not covered by the lab 9 151 (63.7%) measured by the three together 10 144 (60.8%) measured by none of them 5 93 (39.2%) 3. items no measurement pathway measures item path form step-selection 22 p legit-work-cost 22 p inventory-keeping 19 p scope-writing 22 k boundary-recognition 8 k what these 5 items share: no single correct end state, and being wrong has a real cost. ``` The first table lines the three pathways up by coverage. Multiple-choice certification measures **2** of the 15 items and covers 17.7% of the total path load. The practical exam covers **9 items** and 60.8% of the load. The lab environment covers **6 items** and 36.3%. The gap between the two exam formats is not a difference of degree. The two items multiple-choice certification measures — term separation and risk ranking — sit **inside** the nine the practical exam measures. The second table's first row writes this: the intersection is 2 items, the divergence is 7, and all seven of the diverging items sit on the practical-exam side. These two measurements are not siblings; they are **nested**: one measures a narrow subset of what the other measures. ## What the Lab Does Not Cover The lab environment diverges on a different axis from the two exams. Which items it covers is not chosen by whether they have a single meaning, but by whether they **carry a consequence**. The `not covered by the lab` row writes 9 items and **63.7%** of the total load. The reason is in the lab's own definition. A lab environment carries no legitimate traffic; no one uses the billing system, so a wrongly cut step never stops anyone. There is no other team; a handoff done or skipped never has a consequence. There is no scope; stepping outside a boundary carries no cost. A lab is an environment **where being wrong is free**, and that is exactly why it cannot measure items that carry a cost. The lab's value is in repetition, not in the reality of the outcome. Taken together, the three cover 10 items and 60.8% of the load. The lab's only addition is `environment-setup`, and its path load is **0**: the lab contributes the most on the item that carries the least path load. ## The Five Items Nothing Measures The third table is this lesson's central finding. The three measurement pathways together **never measure 5 items**, and these five carry **39.2%** of the total path load. What the five share is in the output's last line: no single correct end state, and being wrong carries a real cost. The two properties together push an item outside all three measurements at once. With no single correct answer, it cannot be graded; with a real cost, it does not occur in a lab. Reading the items one by one sharpens the table further. `step-selection` and `legit-work-cost` are this course's two central jobs, and both carry **22 paths**: what gets measured from this course's first lesson to its last is which step gets cut and how much legitimate work that cut stops. `inventory-keeping` carries 19 paths — the count of paths the defense did not know about in the first lesson. `scope-writing` carries 22, `boundary-recognition` 8. All five are items this course **measures**; none of them are items this course can be **assessed on**. This does not mean the three pathways are worthless. Certification genuinely measures term separation, and without term separation no path can be named; the practical exam covers 60.8% of the load, and that is no ordinary threshold. The measurement says only this: **the area a competency measure does not cover does not mean that measure is invalid; it means that area stays unmeasured.** A certificate or an exam result carries exactly as much information as the path load it covers — no more, no less. ## Matching the Measure to the Role When the three pathways' coverage is dropped onto the five roles separated in the second lesson, the question turns into one of matching. The ten items measured are weighted heavily toward the **close** duty: adding a layer, narrowing privilege, designing a bulkhead, running an incident. The five unmeasured items fall into the **track** and **sustain** duties: keeping the inventory, writing the scope, recognizing the boundary. The same gap that turned up separately in two lessons is here again: every one of the responsibility matrix's seven unowned cells sat in these same two columns, and here too the five unmeasured items in the competency count fall into the same two columns. **Organizations know how to both name and measure the hand that does the work; naming and measuring the hand that keeps the list and checks the outcome is the part they skip in both.** The practical takeaway is not a ranking — it is a **pairing**. A practical exam shows that a candidate can do the work of cutting; it does not show which step should be cut or how much legitimate work that cut will stop. Those two items are **purple work itself**, the very thing the first lesson measured: it shows up only when the defense and the testing side walk the same set of paths together, and there too it is measured not by an exam score but by the ratio of closed paths to stopped legitimate requests. The unmeasured part of competency is not unmeasurable; **it is measured on top of the work itself, with this course's own three columns.** ## Summary - In the 15-item competency set, multiple-choice certification measures 2 items, the practical exam 9, and the lab environment 6; the path-load share they cover is 17.7%, 60.8%, and 36.3% respectively. - The two exam formats are not siblings, they are nested: the intersection is 2 items, the divergence is 7, and all seven diverging items sit on the practical-exam side. - The lab environment does not cover 9 items, and they carry 63.7% of the total load. The reason is the environment's own definition: with no legitimate traffic, no other team, and no scope boundary, being wrong carries no cost. - The three pathways together measure 10 items; the lab's only addition carries a path load of 0. - The 5 items no pathway measures carry 39.2% of the load, and what they share is identical: no single correct end state, and being wrong has a real cost. Two of them are this course's central jobs, and each carries 22 paths. ## Course Wrap-Up | Lesson | How many paths | Closed paths | Legitimate-work cost | |---|---|---|---| | Confidentiality, Integrity and Availability | 8 assets × 3 axes | 6 decisions: 27 increases, 22 decreases | confidentiality −6 in the net-zero decision | | Asset, Threat and Vulnerability | 19 valid out of 576 triples | 5 vulnerabilities, 12 triples | 3, 2, 1, 0 triples as the zone narrows | | Risk Definition | 12 items, 176.05 units | 4-item budget, 77.00 units | 9.40 units by scoring format | | Exploit and Payload | 12 chains, 53 steps | single step, up to 8 chains | middle steps broken, 1 chain remains | | Attack Surface | 35 paths, 21 edges | first three removals 68.6% | 7 jobs, 24 jobs for the remaining 4 paths | | Defense in Depth | 55 paths | 52 close, 3 remain | 63 managed items, 1,793 extra steps | | Least Privilege | 55 paths | 43 paths, 15 free | from 11 requests a day to 3,502 | | Isolation | 14 nodes, 4 assets | assets reached 4 → 2.8 | 20 gateways, 3,513 requests a day | | Zero Trust | 55 paths | 5 by location, 35 at every step | 7,019 verifications a day, +2.00 steps | | Authentication and Authorization Distinction | 55 paths, two request types | 0 at the wrong layer, 35 at the right one | 2.57 per request; 0 paths at +1.43 steps | | Secure Defaults | 22 items, 20 paths | one forgotten item opens 12 paths | 319 a day when closed, 1,440 at worst | | Blue, Red, and Purple Teams | 30 paths | 17 → 22 | from 2,764 requests a day to 2,037 | | Security Roles | 30 paths | 28 → 30 | from 2,321 requests a day to 2,135 | | Legal Framework and Ethics | 30 paths | 8 → 22 testable | 4,607 requests a day, 4 windows | | Professional Competency Paths | 237 path load | 144 measured (60.8%) | 5 items, 93 load unmeasured | The course's rule is the same across all fifteen rows: **defense is not a list of prohibitions; it is the narrowing of a countable set of paths, and a defense whose cost is never written down counts as unmeasured.** Without the middle column, the left column is an inventory listing; without the right column, the middle column is a claim of success. The right column collapses into four families across the fifteen rows. **Legitimate work stopped** repeats in six lessons (least privilege, isolation, secure defaults, and the last three): the cost lands directly in front of the user, which is why it is the family noticed fastest. **A step added to every request** shows up in three lessons (defense in depth, zero trust, authentication versus authorization): unnoticed, but paid on every single request. **A manually managed item** shows up in three lessons (63 managed items, 20 gateways, 4 test windows): no one counts it until an incident happens. **A cost stated as a raw number** appears in the first four lessons, measured before the path unit even existed. The left column tells its own story. The first four lessons never use the path unit at all: what gets counted there is an axis, a triple, an item, a chain. The unit is established in the fifth lesson and never changes across the ten lessons that follow. The path count itself is not constant, though — 35, 55, and 30 — because the number depends on how the graph is drawn, how many entry points and how many targets are defined. **A path count is not a fact; it is a model's output**, and for it to be comparable, the graph itself has to be written down too. The middle column, in two lessons, writes that defense **falls short**. Defense in depth closes 52 of fifty-five paths, and the remaining three paths are the legitimate channel itself: adding a layer does not close them. Zero trust verifies at every step and leaves twenty paths open, and the source of those twenty paths is not a missing control — it is the design of four internal flows. A set of paths is never zeroed out; what gets written is **why** what remains, remains. Paths were counted, principles were measured, and who measures within which boundary was written down. Still, all fifteen of these lessons treated paths as abstract nodes and steps. **M24/K02 Information Technology and Systems Fundamentals** opens that abstraction: what components build the **machine itself** that every one of these paths runs across, what boundary an operating system draws between one user and another, how a file permission can cut a step, and how sturdy a wall virtualization puts between a guest and a host.