IICTI Certified Platform Engineer

Holders demonstrate that they can apply and evaluate platform as a product: strategy, team topology and adoption, developer portal, software catalog and platform orchestration, golden paths, template lifecycle and self-service platform APIs and kubernetes multi-tenancy, scheduling and fleet operations, plus 6 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Platform Engineer.

Who it is for: Professionals working, or preparing to work, in cloud roles.

1. 01Platform as a product: strategy, team topology and adoption10% of the exam

   • Lead a platform as an internal product, setting strategy, team interactions and adoption plans that measurably reduce developer cognitive load.
   • Scope: Platform product management, Team Topologies interaction modes and cognitive load, thinnest viable platform, user research, roadmapping, voluntary adoption, deprecation and the CNCF Platforms white paper and Platform Engineering Maturity Model.
2. 02Developer portal, software catalog and platform orchestration10% of the exam

   • Architect an internal developer platform's portal, catalog and orchestration layers with clear ownership, integration and API boundaries.
   • Scope: Backstage software catalog model, entity providers, scaffolder, TechDocs, plugins and permissions; platform orchestrators, the Score workload specification and reference architecture planes (developer control, integration and delivery, resource).
3. 03Golden paths, template lifecycle and self-service platform APIs10% of the exam

   • Design golden paths and self-service APIs that stay maintainable across their lifecycle while preserving stream-aligned team autonomy.
   • Scope: Paved roads and escape hatches, template versioning and update propagation, declarative self-service APIs (CRDs, Crossplane claims, Kratix promises) following Kubernetes API conventions, day-2 operations and elimination of ticket-driven provisioning.
4. 04Kubernetes multi-tenancy, scheduling and fleet operations10% of the exam

   • Architect and operate multi-tenant Kubernetes fleets, evaluating isolation, scheduling, autoscaling and upgrade trade-offs under real workload constraints.
   • Scope: Namespace, virtual-cluster and dedicated-cluster tenancy; quotas, priority and preemption, QoS and eviction, CPU throttling; HPA, VPA, KEDA and Karpenter; Cluster API, version skew, upgrades and API deprecations; Gateway API.
5. 05Declarative infrastructure as code and control-plane composition10% of the exam

   • Design IaC and control-plane compositions that scale safely, evaluating state boundaries, refactoring paths and drift remediation strategies.
   • Scope: Terraform/OpenTofu state boundaries, refactoring with moved, import and removed blocks, lifecycle meta-arguments, ephemeral values and write-only arguments, testing and drift; Crossplane XRDs, compositions, functions, management and deletion policies.
6. 06GitOps, CI/CD architecture and progressive delivery at scale10% of the exam

   • Design and troubleshoot delivery pipelines and GitOps reconciliation that promote changes safely across fleets of clusters and environments.
   • Scope: OpenGitOps principles, Argo CD and Flux (ApplicationSets, sync waves, pruning, drift), environment promotion, CI pipeline architecture and caching, OIDC federation from CI to cloud, Argo Rollouts and Flagger canary analysis, OpenFeature feature flags.
7. 07Workload identity, secrets management and zero-trust connectivity10% of the exam

   • Architect identity-based access for workloads and humans that removes long-lived credentials and enforces least privilege end to end.
   • Scope: SPIFFE/SPIRE, cloud workload identity federation and bound service account tokens, Vault dynamic secrets and leases, External Secrets Operator and Secrets Store CSI, cert-manager, service mesh mTLS including Istio ambient, Kubernetes RBAC escalation paths.
8. 08Software supply chain security and policy-as-code guardrails10% of the exam

   • Evaluate and enforce supply chain and policy guardrails that block unverified or non-compliant artifacts without stalling delivery.
   • Scope: SLSA v1.0 build levels, in-toto attestations, Sigstore (cosign, Fulcio, Rekor), SPDX and CycloneDX SBOMs, VEX, NIST SSDF; Kyverno, OPA Gatekeeper and ValidatingAdmissionPolicy, Pod Security Standards, audit-to-enforce rollout and exceptions.
9. 09Platform observability, SLOs and reliability engineering10% of the exam

   • Design observability and reliability practices that let platform and product teams detect, diagnose and budget for failure.
   • Scope: OpenTelemetry Collector topologies, sampling and semantic conventions, metric cardinality and telemetry cost, SLIs and SLOs with multi-window burn-rate alerting, error budget policies, incident response and chaos experiments for platform services.
10. 10Platform effectiveness metrics, FinOps and governance10% of the exam

    • Evaluate platform impact and cost with sound metrics, and govern spend and compliance without creating perverse incentives.
    • Scope: DORA metrics including rework rate, SPACE and DevEx frameworks, developer surveys and Goodhart risks, adoption and onboarding metrics; FinOps cost allocation, FOCUS specification, showback and chargeback, unit economics and compliance evidence automation.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner