IICTI Certified DevOps Engineer

Holders demonstrate that they can apply and evaluate software supply chain security and SLSA build provenance, progressive delivery and deployment safety engineering, gitOps and fleet-scale multi-cluster reconciliation and infrastructure as code architecture and policy as code, plus 7 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for DevOps Engineer.

Who it is for: Professionals working, or preparing to work, in software development roles.

1. 01Software supply chain security and SLSA build provenance8% of the exam

   • Architect an end-to-end software supply chain that produces verifiable, policy-enforced build provenance from source to runtime.
   • Scope: SLSA v1.0 build levels, in-toto attestations, Sigstore/cosign keyless signing, SBOM (SPDX, CycloneDX) and VEX, OpenSSF Scorecard, hermetic and reproducible builds, admission-time signature and provenance verification.
2. 02Progressive delivery and deployment safety engineering8% of the exam

   • Design release strategies that minimise blast radius and automatically halt or reverse unsafe changes.
   • Scope: Canary, blue-green and ring deployments, automated canary analysis (Argo Rollouts, Flagger), traffic shifting via service mesh and Gateway API, feature flags (OpenFeature), automated rollback, expand/contract database migrations.
3. 03GitOps and fleet-scale multi-cluster reconciliation7% of the exam

   • Architect a GitOps operating model that keeps hundreds of clusters and environments consistent, auditable and recoverable.
   • Scope: Argo CD and Flux architecture, ApplicationSets, environment promotion models, drift detection and sync waves, Helm/Kustomize overlay strategy, secret delivery (External Secrets Operator, SOPS), multi-cluster and edge fleet management.
4. 04Infrastructure as code architecture and policy as code13% of the exam

   • Evaluate and design IaC codebases and policy guardrails that scale across teams without sacrificing safety or velocity.
   • Scope: Terraform/OpenTofu module and state design, state locking and partitioning for blast-radius control, drift remediation, Crossplane control-plane IaC, OPA/Rego, Conftest and Sentinel plan-time guardrails, IaC testing (Terratest, terraform test).
5. 05Kubernetes platform internals, scaling and multi-tenancy12% of the exam

   • Diagnose and resolve complex Kubernetes capacity, scheduling and isolation problems in shared production platforms.
   • Scope: Control-plane and scheduler behaviour, requests/limits and QoS, HPA/VPA/KEDA and Karpenter node autoscaling, Pod Security Standards, NetworkPolicy, admission controllers and ValidatingAdmissionPolicy (CEL), tenant isolation models (namespaces, vCluster).
6. 06Observability engineering with OpenTelemetry8% of the exam

   • Design a vendor-neutral telemetry architecture that enables rapid root-cause analysis at controlled cost.
   • Scope: OpenTelemetry SDKs, Collector pipelines and semantic conventions, tail-based sampling, metric cardinality control, exemplars and trace-metric-log correlation, eBPF-based continuous profiling, Prometheus/Mimir, Loki and Tempo backends.
7. 07SLO engineering and multi-window burn-rate alerting7% of the exam

   • Design SLOs and alerting policies that align reliability investment with user impact and business risk.
   • Scope: SLI selection and measurement, error budgets and error-budget policies, multi-window multi-burn-rate alerting, OpenSLO specifications, Sloth/Pyrra tooling, alert-fatigue reduction and symptom-based paging.
8. 08Incident command, resilience engineering and chaos experiments7% of the exam

   • Lead incident response and resilience programmes that measurably reduce the frequency and impact of production failures.
   • Scope: Incident Command System roles, blameless post-incident reviews and contributing-factor analysis, chaos engineering (Chaos Mesh, LitmusChaos, AWS FIS), game days, RTO/RPO and disaster recovery, cell-based and static-stability architecture.
9. 09Pipeline identity, secrets and runtime security controls11% of the exam

   • Evaluate and implement DevSecOps controls that eliminate long-lived credentials and detect runtime threats without blocking delivery.
   • Scope: OIDC workload identity federation for CI runners, Vault dynamic secrets, SAST/SCA/DAST/IaC scanning gates, hardened and minimal base images (distroless), runtime detection (Falco, Tetragon), CIS Benchmarks for Kubernetes and hosts.
10. 10Internal developer platforms and platform engineering8% of the exam

    • Lead the design and adoption of an internal developer platform that reduces cognitive load and standardises paved roads.
    • Scope: Platform-as-a-product operating model, CNCF Platform Engineering Maturity Model, Backstage software catalog and golden-path templates, service scorecards, Team Topologies interaction modes, self-service infrastructure APIs.
11. 11Delivery performance analytics and cloud FinOps governance11% of the exam

    • Evaluate delivery and cost performance data to prioritise engineering investments and justify them to leadership.
    • Scope: DORA metrics including rework rate, SPACE and DX Core 4 frameworks, value stream mapping, FinOps Framework phases, Kubernetes cost allocation (OpenCost), unit economics, commitment and rightsizing strategies.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner