IICTI Certified Cloud Administrator

Holders demonstrate that they can apply and evaluate multi-account landing zones and resource hierarchy design, cloud identity federation and privileged access engineering, policy-as-code governance and continuous compliance and infrastructure as code at scale and GitOps operations, plus 7 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Cloud Administrator.

Who it is for: Professionals working, or preparing to work, in cloud roles.

1. 01Multi-account landing zones and resource hierarchy design4% of the exam

   • Design a multi-account landing zone and resource hierarchy that enforces isolation, guardrails and delegated administration at enterprise scale.
   • Scope: AWS Organizations and Control Tower, Azure management groups and CAF landing zones, GCP folder hierarchy, account/subscription vending, SCPs, RCPs and organization policy guardrails.
2. 02Cloud identity federation and privileged access engineering12% of the exam

   • Architect federated identity and least-privilege access models, including just-in-time privileged access and non-human identity controls.
   • Scope: SAML/OIDC federation, IAM Identity Center and Entra ID, workload identity federation, PIM/JIT elevation, permission boundaries, IAM Access Analyzer, break-glass accounts and CIEM.
3. 03Policy-as-code governance and continuous compliance4% of the exam

   • Design and operate policy-as-code controls that prevent, detect and auto-remediate non-compliant cloud configurations.
   • Scope: Azure Policy, AWS Config conformance packs, GCP Organization Policy, OPA/Gatekeeper and Kyverno, HashiCorp Sentinel, CIS Benchmarks, automated drift detection and remediation.
4. 04Infrastructure as code at scale and GitOps operations7% of the exam

   • Lead an infrastructure-as-code operating model that delivers repeatable, reviewable and auditable change across many accounts and regions.
   • Scope: Terraform/OpenTofu state management and module registries, Bicep, CloudFormation StackSets, Pulumi, plan review pipelines (Atlantis, Spacelift), drift reconciliation and safe change rollout.
5. 05Cloud network architecture and hybrid connectivity13% of the exam

   • Architect and troubleshoot secure, scalable hybrid and multi-region cloud networks with controlled ingress and egress.
   • Scope: Hub-and-spoke and Transit Gateway/Virtual WAN topologies, PrivateLink and Private Service Connect, hybrid DNS resolution, Direct Connect/ExpressRoute/Interconnect, IPv6, egress filtering and segmentation.
6. 06Cloud security posture and cryptographic key management9% of the exam

   • Evaluate cloud security posture and design encryption and key management controls proportionate to data sensitivity.
   • Scope: CSPM/CNAPP (Defender for Cloud, Security Hub, Security Command Center), KMS/Key Vault with CMK, BYOK/HYOK and HSMs, envelope encryption, key rotation, secrets management and attack-path analysis.
7. 07Container and serverless platform administration17% of the exam

   • Administer and upgrade managed container and serverless platforms safely while maintaining isolation, capacity and security baselines.
   • Scope: EKS/AKS/GKE lifecycle and version upgrades, node pools and Karpenter autoscaling, IRSA/Workload Identity, admission control, Lambda/Functions concurrency, quotas and service limits.
8. 08Cloud observability, SLO operations and incident response8% of the exam

   • Design an observability and incident response capability that detects, triages and resolves cloud service degradation against defined SLOs.
   • Scope: CloudWatch, Azure Monitor and Cloud Operations, OpenTelemetry, centralized logging (organization trails, Log Analytics), SLOs with multi-window burn-rate alerting, runbook automation and cloud incident forensics readiness.
9. 09Cloud resilience, backup and multi-region recovery11% of the exam

   • Evaluate workload resilience and design recovery architectures that meet stated RTO/RPO targets under regional and ransomware failure scenarios.
   • Scope: Multi-AZ and multi-region patterns, AWS Backup and Azure Site Recovery, cross-account immutable vaults, AWS Resilience Hub, fault injection (AWS FIS, Azure Chaos Studio), Well-Architected reliability pillar.
10. 10FinOps engineering and cost optimization9% of the exam

    • Lead cost governance and optimization that ties cloud spend to business units and unit economics without compromising reliability.
    • Scope: FinOps Framework and FOCUS cost data specification, tagging and cost allocation, Savings Plans, Reserved Instances and CUDs, rightsizing, unit economics, budgets and anomaly detection.
11. 11Cloud compliance, audit and data sovereignty6% of the exam

    • Evaluate cloud estates against regulatory and certification requirements and design controls for data residency, sovereignty and audit evidence.
    • Scope: Shared responsibility model, ISO/IEC 27001, 27017 and 27018, CSA CCM v4, SOC 2, GDPR, NIS2 and DORA obligations, EU Data Boundary and sovereign cloud offerings, audit evidence automation.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner