IICTI Certified Container Security Specialist

Holders demonstrate that they can apply and evaluate container isolation internals and threat modeling, secure image engineering and base image governance, image vulnerability management and VEX-driven triage and supply chain integrity: signing, provenance and SBOM, plus 8 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Container Security Specialist.

Who it is for: Professionals working, or preparing to work, in security roles.

1. 01Container isolation internals and threat modeling7% of the exam

   • Evaluate isolation boundaries of containerized workloads and build threat models for container platforms.
   • Scope: Linux namespaces, cgroups v2, capabilities, seccomp, SELinux/AppArmor, user namespaces, container escape vulnerability classes, and the MITRE ATT&CK Containers and Kubernetes threat matrices.
2. 02Secure image engineering and base image governance10% of the exam

   • Design an image build and base image governance standard that minimizes attack surface across teams.
   • Scope: Minimal and distroless images, multi-stage and reproducible builds, non-root and read-only filesystems, base image curation and update cadence, and registry hygiene.
3. 03Image vulnerability management and VEX-driven triage7% of the exam

   • Evaluate image vulnerability findings and design a triage process that focuses remediation on exploitable risk.
   • Scope: Trivy and Grype scanning, CVSS v4.0 and EPSS, OpenVEX and CSAF VEX statements, reachability analysis, registry and admission-time thresholds and exception handling.
4. 04Supply chain integrity: signing, provenance and SBOM9% of the exam

   • Architect an end-to-end artifact integrity chain from source to cluster with enforceable verification.
   • Scope: Sigstore cosign, Fulcio and Rekor keyless signing, Notary Project (Notation), SLSA v1.0 build provenance, in-toto attestations, SPDX and CycloneDX SBOMs and verification at deploy time.
5. 05Kubernetes control plane and node hardening7% of the exam

   • Assess and harden cluster control planes and nodes against compromise and misconfiguration.
   • Scope: API server and etcd protection including KMS v2 encryption, kubelet authentication and authorization, CIS Kubernetes Benchmark, NSA/CISA hardening guidance, kube-bench and managed service shared responsibility.
6. 06Kubernetes RBAC, workload identity and secrets management14% of the exam

   • Design identity and secret delivery for workloads that eliminates static credentials and excessive permissions.
   • Scope: Least-privilege RBAC and privilege escalation paths, bound service account tokens, IRSA, EKS Pod Identity and GKE/Azure Workload Identity, External Secrets, Secrets Store CSI and Vault integration.
7. 07Policy as code and admission control10% of the exam

   • Design and roll out admission policies that enforce security baselines without disrupting delivery.
   • Scope: Pod Security Standards and Pod Security Admission, Kyverno, OPA Gatekeeper, ValidatingAdmissionPolicy with CEL, mutation, policy testing and exception governance.
8. 08Network segmentation and service mesh security11% of the exam

   • Architect zero trust network controls for east-west and egress traffic in multi-service clusters.
   • Scope: Kubernetes NetworkPolicy, Cilium and Calico L3-L7 policies, Istio and Linkerd mTLS including ambient mode, SPIFFE/SPIRE workload identity and egress control.
9. 09Runtime threat detection, response and container forensics9% of the exam

   • Design runtime detection and incident response capabilities and investigate container compromises to root cause.
   • Scope: Falco, Tetragon and eBPF-based detection, Kubernetes audit log analysis, drift and anomaly detection, response actions, evidence preservation and container forensics workflows.
10. 10Sandboxed runtimes and multi-tenant isolation4% of the exam

    • Evaluate tenancy models and select isolation technologies that match workload trust levels.
    • Scope: gVisor, Kata Containers and Firecracker microVMs, confidential containers, RuntimeClass, namespace-based versus cluster-based tenancy, vCluster and noisy-neighbor controls.
11. 11CI/CD and GitOps pipeline security6% of the exam

    • Assess delivery pipelines and design controls that prevent pipeline compromise from reaching production clusters.
    • Scope: OWASP Top 10 CI/CD Security Risks, pipeline and runner hardening, ephemeral runners, OIDC federation for cloud access, Argo CD and Flux security models and secret handling in pipelines.
12. 12Container security governance and compliance6% of the exam

    • Lead a container security program with measurable controls and audit-ready compliance evidence.
    • Scope: NIST SP 800-190, NIST SP 800-204 series, CIS Benchmarks, PCI DSS v4.0 in containerized environments, KSPM/CNAPP continuous compliance, metrics and program ownership models.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner