IICTI Certified Network Administrator

Holders demonstrate that they can apply and evaluate enterprise routing design with OSPF, IS-IS and BGP policy, campus and data centre fabrics with EVPN-VXLAN, iPv6 deployment and IPv6-only transition strategy and dDI architecture: DNS, DHCP and IPAM at scale, plus 8 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Network Administrator.

Who it is for: Professionals working, or preparing to work, in networking roles.

1. 01Enterprise routing design with OSPF, IS-IS and BGP policy11% of the exam

   • Architect scalable, policy-driven routing domains with predictable convergence and secure external peering.
   • Scope: Area and level design, summarisation, BGP path selection and communities, route filtering, RPKI route origin validation, BFD and convergence tuning.
2. 02Campus and data centre fabrics with EVPN-VXLAN11% of the exam

   • Design resilient switching fabrics that scale Layer 2 and Layer 3 services with contained failure domains.
   • Scope: Spine-leaf topologies, EVPN-VXLAN control plane, anycast gateway, MLAG and ESI multihoming, STP risk containment and MTU planning.
3. 03IPv6 deployment and IPv6-only transition strategy8% of the exam

   • Lead dual-stack and IPv6-only migrations with secure first-hop controls and minimal service disruption.
   • Scope: Enterprise addressing plans, SLAAC and DHCPv6, RA Guard and first-hop security, NAT64/DNS64, 464XLAT and DHCP option 108 (RFC 8925).
4. 04DDI architecture: DNS, DHCP and IPAM at scale8% of the exam

   • Design highly available core network services with authoritative, auditable address and name management.
   • Scope: DNSSEC, split-horizon and resolver design, DoT/DoH policy, DHCP failover, IPAM as source of truth (NetBox) and address lifecycle governance.
5. 05WAN, SD-WAN and SASE integration7% of the exam

   • Evaluate and design WAN architectures that balance performance, cost and security for distributed enterprises.
   • Scope: MPLS L3VPN, SD-WAN overlay and application-aware routing, IPsec underlay/overlay design, SSE/SASE integration and cloud on-ramps.
6. 06QoS engineering and traffic management6% of the exam

   • Design end-to-end QoS policies that protect critical and real-time traffic under congestion.
   • Scope: DiffServ and RFC 4594 service classes, LLQ/CBWFQ queuing, shaping versus policing, trust boundaries and real-time media requirements.
7. 07Network access control and infrastructure hardening11% of the exam

   • Architect identity-based access and hardened device baselines that reduce the network attack surface.
   • Scope: IEEE 802.1X and MAB, RADIUS and TACACS+, dynamic VLAN and group-based policy, control plane policing, management plane isolation, CIS Benchmarks.
8. 08Enterprise wireless design and RF engineering7% of the exam

   • Design high-density wireless networks that meet coverage, capacity, roaming and security requirements.
   • Scope: Wi-Fi 6E and Wi-Fi 7 (802.11be), 6 GHz planning, WPA3-Enterprise, predictive and validation surveys, 802.11k/v/r roaming and capacity planning.
9. 09Network automation and source-of-truth driven operations6% of the exam

   • Lead the transition to automated, intent-validated network operations with version-controlled configuration.
   • Scope: NETCONF/YANG, RESTCONF, gNMI, Ansible and Nornir, NetBox, GitOps workflows, CI pipelines and pre-change validation with Batfish.
10. 10Network observability and streaming telemetry7% of the exam

    • Design observability platforms that provide actionable, near real-time insight into network health and behaviour.
    • Scope: gNMI streaming telemetry, SNMPv3, NetFlow/IPFIX and sFlow, syslog pipelines, synthetic monitoring, baselining and anomaly detection.
11. 11Advanced troubleshooting and root cause analysis11% of the exam

    • Diagnose complex multi-layer network incidents and drive them to verified root cause.
    • Scope: Structured troubleshooting methods, packet capture analysis with Wireshark/tshark, PMTUD and MTU issues, asymmetric routing, control-plane versus data-plane faults.
12. 12Network resilience, change governance and capacity planning7% of the exam

    • Lead network change and capacity governance that sustains availability targets as demand grows.
    • Scope: High availability and failure domain design, ITIL 4 change enablement, maintenance and rollback planning, capacity forecasting and DR testing.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner