There seems to be a bit of misinformation going around regarding what is expected for the final. Just to be clear our options are to either do: ASP.NET Final Project or complete your site and do a penetration test. Do we do one or both?