IICTI Certified Cloud Security Engineer

Holders demonstrate that they can apply and evaluate cloud identity, federation and least-privilege entitlement design, multi-account landing zones and guardrail architecture, cloud network security and zero trust connectivity and data protection, key management and confidential computing, plus 7 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Cloud Security Engineer.

Who it is for: Professionals working, or preparing to work, in security roles.

1. 01Cloud identity, federation and least-privilege entitlement design15% of the exam

   • Design identity architectures that enforce least privilege across human and workload identities and eliminate escalation paths.
   • Scope: AWS IAM/SCPs/permission boundaries, Entra ID and Azure RBAC/PIM, GCP IAM and org policies, workload identity federation (OIDC, SPIFFE), CIEM, privilege-escalation paths and just-in-time access.
2. 02Multi-account landing zones and guardrail architecture7% of the exam

   • Architect multi-account or multi-subscription foundations with enforceable guardrails and controlled blast radius.
   • Scope: AWS Control Tower/Organizations, Azure landing zones and management groups, GCP resource hierarchy, preventive and detective guardrails, policy as code (OPA/Rego, Azure Policy, Sentinel), account vending and blast-radius isolation.
3. 03Cloud network security and zero trust connectivity8% of the exam

   • Evaluate and design cloud network architectures that minimise exposure and enforce zero trust access.
   • Scope: VPC/VNet segmentation, private endpoints and PrivateLink, transit gateways and hub-spoke, cloud firewalls and WAF, egress control, DNS security, identity-aware proxies and NIST SP 800-207 zero trust architecture.
4. 04Data protection, key management and confidential computing14% of the exam

   • Design key management and data protection strategies matched to data sensitivity, residency and threat model.
   • Scope: KMS/Cloud HSM, envelope encryption, BYOK/HYOK and key rotation, secrets management (Vault, Secrets Manager), data classification and DSPM, confidential VMs and enclaves, data residency and sovereignty.
5. 05Container, Kubernetes and serverless security9% of the exam

   • Architect and assess security controls for containerised and serverless workloads across build, deploy and runtime.
   • Scope: Kubernetes RBAC, Pod Security Standards, admission control (Kyverno, Gatekeeper), network policies, runtime detection (Falco, eBPF), EKS/AKS/GKE hardening, image signing (Sigstore/cosign), serverless function permissions and event-injection risks.
6. 06CNAPP, posture management and infrastructure-as-code security7% of the exam

   • Evaluate cloud posture at scale and design prioritised, attack-path-driven remediation programmes.
   • Scope: CSPM, CWPP, CIEM and CNAPP platforms, CIS Benchmarks, misconfiguration and attack-path analysis, IaC scanning (Checkov, tfsec, KICS), drift detection and automated remediation pipelines.
7. 07Secure cloud delivery pipelines and software supply chain7% of the exam

   • Design delivery pipelines that preserve integrity and provenance from source to cloud runtime.
   • Scope: CI/CD hardening, OIDC-based deploy credentials, SLSA levels, SBOMs (SPDX, CycloneDX), artifact provenance and signing, dependency and registry controls, pipeline secret exposure and poisoned pipeline execution risks.
8. 08Cloud threat detection, logging and security analytics7% of the exam

   • Design detection coverage and logging architectures that surface cloud-native attack techniques with high fidelity.
   • Scope: CloudTrail, Azure Activity/Entra logs, GCP Audit Logs, VPC flow logs, GuardDuty/Defender for Cloud/Security Command Center, SIEM/SOAR integration, detection engineering and MITRE ATT&CK Cloud Matrix mapping.
9. 09Cloud incident response and forensics8% of the exam

   • Lead investigation and containment of cloud security incidents while preserving forensic evidence.
   • Scope: Cloud IR playbooks, credential compromise containment, snapshot and memory acquisition, log preservation and chain of custody, automated isolation, NIST SP 800-61 and cloud-provider shared-responsibility constraints.
10. 10Cloud governance, risk and compliance assurance12% of the exam

    • Evaluate cloud risk and compliance posture and design continuous assurance aligned to regulatory obligations.
    • Scope: Shared responsibility models, CSA CCM and STAR, ISO/IEC 27017/27018, SOC 2, PCI DSS, NIS2 and DORA, continuous compliance and evidence automation, third-party and concentration risk.
11. 11Cloud security architecture and threat modelling leadership6% of the exam

    • Lead cloud security architecture decisions and threat modelling across engineering teams.
    • Scope: Threat modelling (STRIDE, attack trees) of cloud-native systems, reference architectures and security patterns, multi-cloud and hybrid trade-offs, security design reviews, metrics and building a cloud security programme.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner