IICTI Certified Network Security Professional

Holders demonstrate that they can apply and evaluate zero trust network architecture and microsegmentation, secure routing, BGP security and control-plane protection, next-generation firewall and policy lifecycle engineering and sASE, SSE and cloud network security architecture, plus 8 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Network Security Professional.

Who it is for: Professionals working, or preparing to work, in security roles.

1. 01Zero trust network architecture and microsegmentation13% of the exam

   • Architect a zero trust network with segmentation policies that measurably contain lateral movement.
   • Scope: NIST SP 800-207 and CISA ZTMM 2.0, policy decision/enforcement points, identity-aware proxies, ZTNA vs VPN, host and workload microsegmentation, east-west traffic policy modelling.
2. 02Secure routing, BGP security and control-plane protection6% of the exam

   • Design control-plane protections that preserve routing integrity and availability under attack.
   • Scope: RPKI/ROV and ASPA, BGPsec limits, prefix filtering per MANRS, OSPF/IS-IS authentication, CoPP, route leak and hijack detection, DDoS mitigation with RTBH and FlowSpec.
3. 03Next-generation firewall and policy lifecycle engineering5% of the exam

   • Evaluate and rationalize complex firewall rule bases against risk, performance and compliance requirements.
   • Scope: Application and identity-based rules, TLS inspection trade-offs and privacy constraints, rule base optimization, shadowed and redundant rule analysis, policy-as-code and change verification.
4. 04SASE, SSE and cloud network security architecture5% of the exam

   • Architect hybrid and multi-cloud network security that enforces consistent policy across on-premises, cloud and remote users.
   • Scope: SWG, CASB, ZTNA and FWaaS convergence, SD-WAN security, cloud VPC/VNet segmentation, security groups vs NVAs, transit gateways, private endpoints and egress control.
5. 05Network detection and response and encrypted traffic analysis13% of the exam

   • Design network detection coverage and analytics that identify adversary activity in encrypted and high-volume traffic.
   • Scope: NDR, Zeek and Suricata, full packet vs flow (NetFlow/IPFIX) telemetry, JA4+ fingerprinting, encrypted traffic analytics, beaconing and DNS tunnelling detection, MITRE ATT&CK network techniques.
6. 06Modern cryptographic protocols and post-quantum migration14% of the exam

   • Evaluate cryptographic protocol deployments and plan a crypto-agile migration toward post-quantum readiness.
   • Scope: TLS 1.3 and QUIC/HTTP/3 security, IPsec/IKEv2 and WireGuard design, MACsec, certificate and key lifecycle, crypto-agility, hybrid PQC key exchange (ML-KEM, FIPS 203) migration planning.
7. 07Network access control and identity-centric networking9% of the exam

   • Design identity-driven network admission and wireless security controls for large heterogeneous estates.
   • Scope: 802.1X/EAP-TLS, RADIUS and TACACS+, NAC posture assessment, MAB risks, dynamic VLAN and SGT/TrustSec tagging, WPA3-Enterprise and wireless intrusion prevention.
8. 08DNS, DDoS and edge resilience7% of the exam

   • Architect edge and DNS defences that sustain service availability under large-scale attack.
   • Scope: DNSSEC, protective DNS, DoH/DoT governance, volumetric, protocol and application-layer DDoS, scrubbing and anycast architectures, rate limiting and WAF/API gateway placement.
9. 09OT and IoT network security4% of the exam

   • Design segmented OT/IoT networks that balance safety, availability and security requirements.
   • Scope: IEC 62443 zones and conduits, Purdue model limits, industrial protocol monitoring (Modbus, DNP3, OPC UA), unidirectional gateways, IoT device segmentation and safety-aware change control.
10. 10Network automation, policy-as-code and continuous verification3% of the exam

    • Lead automated, verifiable network security change pipelines that reduce misconfiguration risk.
    • Scope: Intent-based networking, NETCONF/RESTCONF/gNMI, Ansible and Terraform pipelines, Batfish-style formal verification, configuration drift detection and secure network CI/CD.
11. 11Network forensics and incident response9% of the exam

    • Diagnose network-borne intrusions and lead containment and recovery with defensible evidence.
    • Scope: Evidence acquisition from taps, flow and device logs, timeline reconstruction, lateral movement and exfiltration analysis, containment via segmentation and routing changes, chain of custody.
12. 12Network security governance, risk and compliance12% of the exam

    • Lead a network security programme that aligns architecture decisions with regulatory and risk obligations.
    • Scope: ISO/IEC 27001:2022 Annex A network controls, ISO/IEC 27033, NIS2 and DORA obligations, PCI DSS v4.0 segmentation testing, CIS benchmarks, architecture risk assessment and metrics.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner