IICTI Certified Cloud Solutions Architect

Holders demonstrate that they can apply and evaluate enterprise landing zones and multi-account governance, cloud network architecture and hybrid connectivity, cloud identity, federation and least-privilege access and multi-region resilience and disaster recovery architecture, plus 8 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Cloud Solutions Architect.

Who it is for: Professionals working, or preparing to work, in cloud roles.

1. 01Enterprise landing zones and multi-account governance5% of the exam

   • Design a scalable landing zone and account structure that enforces governance without blocking delivery teams.
   • Scope: AWS Organizations and Control Tower with SCPs/RCPs, Azure Landing Zones, management groups and Azure Policy, Google Cloud resource hierarchy and organization policies, account vending and preventive/detective guardrails.
2. 02Cloud network architecture and hybrid connectivity9% of the exam

   • Architect secure, resilient multi-region and hybrid network topologies with predictable routing and cost.
   • Scope: Hub-and-spoke and Transit Gateway, Azure Virtual WAN, Cloud WAN, PrivateLink and Private Service Connect, Direct Connect/ExpressRoute/Interconnect, IPAM, hybrid DNS resolution and centralized egress inspection.
3. 03Cloud identity, federation and least-privilege access5% of the exam

   • Design identity and authorization models that enforce least privilege across humans, workloads and accounts.
   • Scope: IAM policy evaluation logic, permission boundaries, workload identity federation, ABAC, Entra ID PIM, IAM Access Analyzer and CIEM-driven entitlement right-sizing.
4. 04Multi-region resilience and disaster recovery architecture16% of the exam

   • Architect workloads that meet defined availability and recovery objectives under zonal and regional failures.
   • Scope: Well-Architected reliability pillars, AZ and regional failure modes, RTO/RPO-driven DR patterns, active-active and pilot light, cell-based architecture, static stability and fault injection (AWS FIS, Azure Chaos Studio).
5. 05Compute, container and serverless platform selection12% of the exam

   • Evaluate compute options and select platforms that optimize performance, operability and cost per workload.
   • Scope: VMs, managed Kubernetes (EKS, AKS, GKE), serverless (Lambda, Cloud Run, Azure Functions), ARM-based compute, autoscaling with Karpenter and event-driven scaling, and cold start and concurrency trade-offs.
6. 06Cloud data, storage and analytics architecture11% of the exam

   • Design cloud data platforms that balance consistency, latency, scale and regulatory placement.
   • Scope: Managed relational and distributed databases (Aurora, Spanner, Cosmos DB), storage tiering and lifecycle, lakehouse formats (Iceberg, Delta), streaming (Kinesis, Event Hubs, Pub/Sub) and data sovereignty constraints.
7. 07Cloud security architecture and data protection9% of the exam

   • Architect layered cloud security controls that protect data and workloads and support rapid detection and response.
   • Scope: Shared responsibility, CNAPP/CSPM, KMS and HSM with BYOK/HYOK, encryption and confidential computing, native threat detection (GuardDuty, Defender for Cloud, Security Command Center) and secure baselines.
8. 08Large-scale migration and modernization9% of the exam

   • Lead portfolio-level migration programs that minimize risk and deliver modernization value.
   • Scope: 7Rs disposition, discovery and assessment (Azure Migrate, AWS Migration Evaluator), wave planning, database migration and replication, mainframe and legacy options, and cutover and rollback planning.
9. 09FinOps and cloud economics7% of the exam

   • Evaluate cloud spend drivers and design a cost governance model that ties consumption to business value.
   • Scope: FinOps Framework and FOCUS cost data specification, unit economics, Savings Plans, Reserved Instances and CUDs, rightsizing, tagging and allocation, showback/chargeback and carbon-aware optimization.
10. 10Infrastructure as code and policy-as-code automation7% of the exam

    • Design reusable, governed IaC platforms that make compliant infrastructure the default path.
    • Scope: Terraform/OpenTofu, CloudFormation and CDK, Bicep, Pulumi, module and state design, OPA and Sentinel policy as code, GitOps and drift detection.
11. 11Cloud compliance, sovereignty and exit strategy5% of the exam

    • Evaluate regulatory and sovereignty requirements and architect compliant cloud estates with credible exit plans.
    • Scope: CSA CCM v4, ISO/IEC 27017 and 27018, SOC 2, EUCS, DORA ICT third-party requirements, EU Data Act switching rights, sovereign cloud options and continuous compliance evidence.
12. 12Multi-cloud, hybrid and edge architecture5% of the exam

    • Architect hybrid and multi-cloud solutions where portability and placement are justified by business and technical drivers.
    • Scope: Azure Arc, GKE Enterprise, AWS Outposts and local zones, portability versus cloud-native trade-offs, cross-cloud identity and networking, and edge workload placement.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner