Educators often ask me how I grade assignments. Hands-on instruction and assessment do not seem to lend themselves to clear articulation of assigning grades, as do multiple-choice exams.   This is a brief discussion of my background, including how I was assessed and how I turned that into what I do in the classroom. I’ll also include examples of homework assignments.

I spent 13 years as an enlisted member of the United States Air Force, where, as a Ground Radio Communications Repair Specialist, I was responsible for repairing over 30,000 pieces of electronic equipment. Everything from the field phone you see in old war movies, walkie-talkies, 10,000-watt radios, and Air Traffic control equipment. Each person in this career field had a training record that specified the tasks for which they were qualified. A more experienced person (master) would instruct the less experienced person (apprentice) in the task. The master would have the apprentice perform the task repeatedly until the apprentice could do it perfectly, at which point the master would ‘sign off’ on the apprentice’s training record, indicating they were qualified to accomplish the task unsupervised.

When I joined the ranks of academia, I had a difficult time with grading. Oh, it was easy, so long as I stuck to slides and multiple-choice exams. However, I felt that this was not providing the cyber professionals that are critically needed. I first encountered this when I had students who couldn’t plug a wire into a switch, or, even more memorably, when I had two students who couldn’t operate a Phillips-head screwdriver. I wanted to change how I taught classes and assessed students’ work. When I trained, there was no “well, it works 70% of the time” (a C-grade). The equipment either worked according to specifications or it didn’t. The specifications that didn’t function correctly were documented, work orders were generated, and efforts were made to bring them into compliance with the specifications.

However, I was being swamped with all the grading. We utilized excellent instructional materials from various vendors that included videos, exercises, self-tests, and hands-on activities. I spent hours every week grading students. How much of the video did they watch? How much of the exercise did they complete? What did they score on the self-test? Did they participate in the in-class activities? I also took attendance in my classes (more on that later).

My 10-year-old daughter wanted to try a college class, so I said she could sit in on an introductory 101 class on Microsoft Office (Word, Excel, PowerPoint). In this class, I would walk students through various Word operations. “Left click on this, right click on that”, “bold this word”, and “apply the headline format.” The students were supposed to watch me perform the actions on the big screen, and then I would have to take frequent breaks to assist students who couldn’t grasp what we were doing. After a couple of weeks, my daughter asked me, “Is this really a college class?” At midterms, I approached students who had attended every class but never submitted their work to discuss their strange behavior. They were uninterested and unconcerned. Needless to say, she passed the course, but I had a 30% failure or drop rate among the college students. By the way, students were surprised to learn that they had failed the course, despite attending every day.

During summer break, I reviewed three years of student performance and discovered some interesting connections. This was revolutionary to me, but for more seasoned educators, there was probably nothing earth-shattering in my findings.

• A-level students completed every homework assignment, watched every video, and completed every task
• B-level students completed most tasks
• C-level students completed some tasks
• D-level students completed very few tasks

This level of effort was reflected in their test scores:

• A-students generally scored above 90%
• B-students 80%
• C-students 70%
• D-students 60%

I was wasting time trying to grade every single item. It took me just as much time to record an ‘F’ as it did to record an ‘A’. Students were self-selecting their outcomes based on the effort they put into the class. So there was no need to grade every individual item. My first clumsy attempt at changing grading styles, I called “Binary Grading”. The students either accomplished the work or didn’t. This approach worked reasonably well. I would assign groups of assignments (readings, videos, exercises, etc.), and if the students completed all of them, I would record a “1”; if they didn’t, I would record a “0”. The grade distribution didn’t change; I still had the same number of As, Bs, Cs, Ds, and Fs, but I saved a significant amount of time. The quibbling over grades was also squashed, which saved me an incredible amount of time. I no longer had students arguing for an 82% instead of a 71% on individual assignments. I just pulled up the electronic report of activities completed, and their efforts were recorded irrefutably in black and white.

I also discovered that students who missed more than three classes were 64% likely not to pass the course. I reviewed the data again, and none of these students earned an A or a B either. Tracking attendance, calculating grades, and making attendance a component of the final grade was also a waste of my time. The student’s behavior of learning effort (attending class and completing tasks) was already a predictor of their final grade.

I hear you thinking, “I had one student that…”, yes, me too. For example, I had one student who expertly mastered the course material, but would freeze on any test I gave. I made their tests hands-on evaluations instead of multiple-choice, and they performed skillfully. However, for the most part, the students who couldn’t hold a conversation with me in class, such as the one who asked, “Professor, the instructions keep telling me to tab…what is that?” (a genuine question), were assessed correctly. However, being a teacher of a group of hundreds of students involves using mechanisms that work for most of them and then adjusting to the exceptions.

I read “Specifications Grading: Restoring Rigor, Motivating Students, and Saving Faculty Time” by Linda B. Nilson, and I had already reached many of the same conclusions. However, it opened up my eyes to refining my grading. It also brought to my attention a remaining issue that I had been unable to reconcile. In my first teaching job, I was blessed to teach classes across all grades from Freshman to Senior. I found myself re-teaching material that I had covered many times in earlier courses, and students still weren’t grasping it.

In Specifications Grading, Nilson addressed this issue. With multiple-choice exams, the instructor has no way of knowing if students are completing all the learning objectives or failing to complete one or more objectives repeatedly. For example, say a course has five learning objectives. Is a B-student, ‘mostly’ satisfying all learning objectives or expertly satisfying four learning objectives and not understanding the fifth one at all? Both instances would reveal an overall grade of 80-90% of understanding. The latter example explains why I found myself reteaching material to well-performing students over the years.

I know this is lengthy, but I’m getting to the point. I changed all my course assignments to hands-on work and assessments. I created rubrics, which I am still adjusting as I gain student and peer feedback, and I combine these assignments into a picture of overall understanding. My leadership still insists on multiple-choice exams, but I am trying to drift away from those. What I present in the following sections is what I am doing today; however, tomorrow is not certain, as I listen to feedback and adjust. However, the comments are 87% positive, so I feel as if I am on the right track.

Much of the course requirements do not directly apply to the labs in this book. However, you can see that the D students can demonstrate the course objectives by completing the labs. Using specifications grading, every student who passes has demonstrated subject matter mastery through lab completion.

HOMEWORK: Weekly Lab Report Template

Student Name

Lab Performed

Purpose
In 3-5 sentences, describe the purpose of the lab. Sure, this can be redundant; after all, you didn’t choose the assignment. However, the purpose of this section is to get you to think about the activity you are about to engage in, rather than whizzing through steps. This purposeful writing will help you retain what you do and help prepare you for the final hands-on exam.

Materials
This is where you would simply list the materials used in the lab. Often, you will be using the baseline environment from Chapter 42. In this case, a single bullet is acceptable. However, you will need to change or add materials as necessary.

• The baseline environment is as prescribed in Chapter 42.

Discussion of Results
In 3-5 sentences, describe your results. The assigned homework results will vary between students. Describe what worked well for you and what didn’t. When describing your results, include screenshot references (e.g., Figure 1, Figure 2) and append them to the next page.

Lessons Learned
In 3-5 sentences, describe the lessons that you learned. This will vary between students. There is no wrong answer to this section because everyone comes pre-equipped with various skills developed and then uses them in unique ways to master the lab’s goals. Thinking about what you learned and how you learned it will help prepare you for the final hands-on exam.

Screenshots
Place your screenshots in this section. In preparation for expert report writing, your screenshots need to reflect the content you are writing about. They should be framed, centered, and have a caption. The caption requires an identifier (Figure 1) and a one-sentence description.

As you can see, students do not have to write extensively, and their answers can vary significantly. Furthermore, the answers are short enough that it does not take much effort to grade the results. Nobody is ‘counting commas’, and everyone is focused on the course goals: learning the material.

Before I show example assignments and their rubrics, here are some FAQs:

• What if the student uses ChatGPT?
  Please ensure they cite it so that you don’t have to report them for plagiarism.

• How can I tell from the screenshots that they accomplished the tasks?
  Teachers are experts in this field. You can tell at a glance if they did the homework lab or not. If the screenshots are not reflective of the tasks or are unreadable, send the report back as unsatisfactory and explain why it is inadequate.

• I don’t usually teach this course, so I’m not an expert. What do I do?
  The labs are designed for a teacher to lead students through the individual components of each lab. The homework accounts for approximately 80% of what was covered in class, with some additional exercises designed to encourage students to think critically and apply concepts. Save what you did when leading the class, and you have a good idea of what screenshot they should be submitting. The homework deliverables are very similar.

• How can I tell if they cheated and someone else completed the lab for them?
  You really can’t. However, I grade all assignments at once, so if screenshots are reused, I can usually spot the people involved. Each party is equally responsible for plagiarism or cheating. As you complete the labs in this book, you can see that the student would have to find someone willing to complete the same lab twice, and there are very few people who have time for that.

• With the same IP addresses being used, how can I tell if a student’s work is their own?
  If this becomes a problem in my class, I assign an IP address pool to each student. However, I prefer not to do this because students should be able to ask their peers for assistance, and keeping the IP addresses the same facilitates this practice.

• How can I tell if a ping is working from a screenshot?
  You can’t really. It is conceivable that students made configuration changes to allow connectivity to ‘spoof’ the screenshot. If you think this is a problem, in the next lab report, you will just need to require trace route screenshots instead of ping.

• What if a student gets caught up on a step in a lab and can’t complete it?
  I give full credit to students who make an honest effort in completing the lab. How can I tell if they made a sincere effort? I read their report and compared their screenshots. They will discuss their frustrations and troubleshooting efforts in their lab discussion and lessons learned. Oftentimes, they are reporting the same issues you encountered when you first learned the material. It’s a judgment call you can make.

• How can I….
  Look, I can’t account for every measure. But keep in mind that cheaters are pretty lazy. The first time they cheat, they make a great effort not to be caught, but as the course progresses and the lab’s complexities reveal themselves, they will no longer expend the effort, or they become too lazy to cheat effectively. Cheaters won’t pass the exams, which keeps them in the D student category. Spend your time teaching effectively, knowing the cheaters always reveal themselves. Talk to your students; if they can’t hold a conversation about the lesson at hand, write their name down to double-check their homework assignments that week. My office is covered in lists. Even if they cheat their way to a degree, they won’t be able to cheat their way through a cyber job interview. I used to tell my freshmen that if they think a few pieces of paper is all college is, then they should visit one of many websites where, for $700, they can get a degree with transcripts and start applying for jobs. Good luck.

CHAPTER 33 – NETWORK HARDENING -PFSENSE INTRANET

Average example

Purpose
This chapter teaches us how to install a pfSense server and will act as our DHCP server. We will then open all the firewall ports to monitor network activity and place firewall rules in place to assess their impact on our enterprise network. We will configure the network and create firewall rules to regulate IPv4 traffic, and then observe the results through Wireshark.
Materials

• Chapter 31: Networking Hardening – pfSense Intranet

Discussion of Results
In Figure 1, it is shown that the GNS3 environment was successfully set up and is fully running. This follows up with Figures 2 and 3, where the pfSense firewall was successfully set up with all the correct firewall rules from the textbook. This is then proven in Figures 5 and 6 because with the correct firewall rules, PC 1 can ping the web server, and the web server can ping the external PC, and the external PC CANNOT ping the web server with the Wireshark capture shown below. However, as I got towards the end of the lab in Figures 7-9, management, VLAN, and Web server all had open ports, which is correct, but in Figure 10, IPS had open ports, which was not supposed to happen. I still do not know why that is, and will continue troubleshooting until I figure it out.
Lessons Learned
In this lab, I learned the importance of troubleshooting network connectivity issues, particularly when working with firewalls within a virtual environment such as GN3. Setting up pfSense again reminded me of my time in CI 120. Also, it reinforced my understanding of firewall rules and routing configurations, as a minor misconfiguration can block communication between the devices. I also realized, as I was finishing the lab, that I want to test for connectivity early to catch potential issues early. Finally, this lab helped me regain hands-on experience with pfSense again as it has been 2 years since I last used it, which was nice because it is helpful with configuring and securing real-world networks.

List of Figures

Student Comments: Hello Prof. HVH.  I was able to complete everything. No network gateway errors like those that happened earlier in class today. However, I ran into another error in the nmap on the Kali VM management, web, and the VLAN PCs. They had open ports, which is correct, but the IPS had open ports when they were supposed to be closed. I ran out of time to trouble this last portion.

Dr. HVH Comments: Good effort! I’m giving you full credit because you’re about 95% of the way there. You’ve come a long way since the earlier roadblocks.

Below Average example

Purpose
In this lab, the purpose was to add a pfSense server to the enterprise network. We also had to configure the pfSense server to act as the DHCP server. This lab also showed us what goes on “behind-the-scenes” without a firewall.

Materials

• Mastering Enterprise Networks – Chapter 31
• GNS3
• GNS3 VM
• ISP
• Ubuntu Server
• Ubuntu Desktop
• Kali Linux
• pfSense

Discussion of Results
In this lab, I got an interesting result that differs from a lot of other people’s results. When I finished the main lab, everything worked as it should, I could see what was going on without the firewall, but once the firewall was put up again, pings would time out. But once I finished assignment 1, all my open ports are opposite of what should be as described in assignment 1. In figure 1, the ISP ports are open, while in figures 2 – 4, all ports in Management, DMZ, and LAN are closed.
Lessons Learned
I learned that sometimes things just happen, and no one might know how to help you. I tried to get help with the end since I got something different. I had two people check over my configurations and lab, but they didn’t know what was wrong. Although, I did learn how tedious it can be to set up the pfSense firewall.

List of figures

Student Comments: none.

Dr. HVH Comments: Exceeded the maximum number of grammar errors. The screenshots you supplied are accurate, but they do not reflect the successful completion of the parts of the lab that you said worked. Keep at it and resubmit. You need the lab to function to complete next week’s lab.