IICTI Certified Network Engineer

Holders demonstrate that they can apply and evaluate advanced IGP design and fast convergence engineering, bGP architecture, policy and Internet edge engineering, segment Routing, MPLS and service provider transport and data centre fabric design with EVPN-VXLAN, plus 7 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Network Engineer.

Who it is for: Professionals working, or preparing to work, in networking roles.

1. 01Advanced IGP design and fast convergence engineering7% of the exam

   • Design IGP topologies and tune convergence mechanisms to achieve sub-second failure recovery at scale.
   • Scope: OSPF and IS-IS area/level design, LSA flooding control, SPF and LSP throttling, BFD, LFA/rLFA and TI-LFA, graceful restart and NSR, microloop avoidance.
2. 02BGP architecture, policy and Internet edge engineering7% of the exam

   • Architect BGP policy and edge design that delivers deterministic traffic flow and resilient, secure inter-domain routing.
   • Scope: iBGP scaling with route reflectors and confederations, path attributes and communities, traffic engineering, BGP ADD-PATH and PIC, multihoming, RPKI/ROV and MANRS routing security.
3. 03Segment Routing, MPLS and service provider transport7% of the exam

   • Design traffic-engineered transport and VPN services that meet SLA, scale and operational simplicity requirements.
   • Scope: MPLS L3VPN and EVPN services, SR-MPLS and SRv6, SR-TE policies and Flex-Algo, PCE/PCEP, QoS DiffServ and hierarchical shaping across transport.
4. 04Data centre fabric design with EVPN-VXLAN7% of the exam

   • Design and validate scalable multi-tenant data centre fabrics including high-bandwidth AI/ML cluster networking.
   • Scope: Clos/leaf-spine architecture, BGP underlay (RFC 7938), EVPN route types, symmetric IRB, anycast gateway, multihoming with ESI, multi-site DCI and lossless RoCE fabrics for AI workloads.
5. 05SD-WAN, SASE and enterprise WAN architecture11% of the exam

   • Evaluate and design enterprise WAN and SASE architectures balancing performance, security and cost.
   • Scope: SD-WAN overlay and application-aware routing, transport independence, SASE and SSE components, cloud on-ramps, IPsec and WireGuard overlays, WAN optimisation trade-offs.
6. 06Cloud and hybrid network architecture7% of the exam

   • Architect hybrid and multi-cloud connectivity with consistent segmentation, routing and resilience.
   • Scope: AWS/Azure/GCP VPC/VNet design, transit gateways and hubs, private connectivity (Direct Connect, ExpressRoute), cloud routing and NAT, multi-cloud networking and IP address management.
7. 07Zero trust network security and segmentation16% of the exam

   • Design segmentation and infrastructure protection controls that enforce least privilege and defend the network's own control plane.
   • Scope: NIST SP 800-207, macro- and micro-segmentation, 802.1X and NAC, MACsec, control-plane policing and infrastructure ACLs, DDoS mitigation (RTBH, FlowSpec) and device hardening (CIS benchmarks).
8. 08Network automation, source of truth and intent-based operations6% of the exam

   • Lead the automation of network change with model-driven configuration, validation and compliance drift detection.
   • Scope: NetDevOps with Git and CI/CD, Ansible, Nornir and Terraform, NETCONF/RESTCONF, gNMI/gNOI, YANG/OpenConfig models, NetBox source of truth, pre/post-change validation with Batfish.
9. 09Streaming telemetry and network performance analysis14% of the exam

   • Diagnose complex performance and intermittent faults using telemetry, flow and packet-level evidence.
   • Scope: gNMI streaming telemetry, sFlow/IPFIX, TWAMP and synthetic probing, buffer and microburst analysis, packet capture forensics, PMTUD/MTU and TCP behaviour analysis.
10. 10IPv6 deployment and transition architecture6% of the exam

    • Design and plan an IPv6 adoption strategy that moves the network toward IPv6-only operation safely.
    • Scope: IPv6 addressing and prefix planning, SLAAC/DHCPv6, NDP security (RA Guard), dual-stack, NAT64/DNS64, 464XLAT and IPv6-only design, IPv6 in routing and security policy.
11. 11Network resilience, change governance and capacity planning12% of the exam

    • Lead network operations governance that controls change risk and plans capacity against business growth.
    • Scope: High-availability design (ISSU, MC-LAG, redundancy models), failure domain analysis, capacity forecasting, change risk assessment, ITIL 4 change enablement and post-incident review.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner