IICTI Certified Kubernetes Administrator

Holders demonstrate that they can apply and evaluate control plane architecture, etcd operations and HA topologies, advanced scheduling and workload placement, resource management, autoscaling and capacity engineering and cluster networking, eBPF CNIs and Gateway API, plus 8 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Kubernetes Administrator.

Who it is for: Professionals working, or preparing to work, in cloud roles.

1. 01Control plane architecture, etcd operations and HA topologies10% of the exam

   • Architect highly available control planes and recover them safely from quorum loss or data corruption.
   • Scope: Stacked versus external etcd, Raft quorum and defragmentation, etcd backup and restore, API Priority and Fairness, version skew policy and kubeadm upgrades.
2. 02Advanced scheduling and workload placement6% of the exam

   • Design placement policies that meet availability, performance and specialised hardware requirements.
   • Scope: Node and pod affinity, topology spread constraints, taints and tolerations, priority and preemption, scheduler profiles, Dynamic Resource Allocation for GPUs, descheduler.
3. 03Resource management, autoscaling and capacity engineering8% of the exam

   • Evaluate workload resource profiles and design autoscaling strategies that balance reliability and cost.
   • Scope: Requests, limits and QoS classes, LimitRange and ResourceQuota, HPA v2, VPA, in-place pod resize, Cluster Autoscaler, Karpenter and KEDA.
4. 04Cluster networking, eBPF CNIs and Gateway API15% of the exam

   • Design and troubleshoot cluster networking for secure, performant east-west and north-south traffic.
   • Scope: CNI internals, Cilium eBPF dataplane, kube-proxy iptables/IPVS/nftables modes, NetworkPolicy, Gateway API, ambient service mesh and CoreDNS tuning.
5. 05Storage architecture and stateful workload operations9% of the exam

   • Architect resilient storage for stateful workloads with tested backup and recovery procedures.
   • Scope: CSI drivers, StorageClasses and topology-aware provisioning, volume snapshots and expansion, database operators and Velero backup and restore.
6. 06Cluster security hardening and admission policy enforcement12% of the exam

   • Design layered cluster security controls and evaluate compliance against recognised hardening benchmarks.
   • Scope: Least-privilege RBAC, Pod Security Admission, ValidatingAdmissionPolicy (CEL), Kyverno and OPA Gatekeeper, KMS v2 secrets encryption, CIS Kubernetes Benchmark, NSA/CISA hardening guidance.
7. 07Runtime security and software supply chain integrity4% of the exam

   • Evaluate runtime and supply chain risks and implement controls that enforce workload integrity end to end.
   • Scope: seccomp, AppArmor and user namespaces, Falco and Tetragon runtime detection, Sigstore cosign image signing, admission-time verification, SBOM and SLSA.
8. 08Multi-tenancy, operators and platform engineering4% of the exam

   • Design multi-tenant platform architectures that provide safe self-service with strong isolation.
   • Scope: Namespace and cluster tenancy models, vCluster, CRDs and operator patterns, internal developer platforms and self-service platform APIs.
9. 09GitOps, progressive delivery and cluster lifecycle management9% of the exam

   • Lead declarative delivery and upgrade processes that keep fleets current with minimal risk.
   • Scope: Argo CD and Flux, Helm and Kustomize, Argo Rollouts and Flagger, Cluster API, upgrade orchestration and deprecated API migration.
10. 10Observability and SLO-driven Kubernetes operations5% of the exam

    • Design observability and alerting that ties cluster health to user-facing service objectives.
    • Scope: Prometheus and kube-state-metrics, OpenTelemetry, events and audit logs, control plane metrics, SLOs and multi-window burn-rate alerting.
11. 11Advanced troubleshooting and incident response in Kubernetes14% of the exam

    • Diagnose complex cluster and workload failures across control plane, node, network and storage layers.
    • Scope: Node pressure and evictions, kubelet and containerd/CRI diagnostics, ephemeral debug containers, network path tracing and control plane degradation analysis.
12. 12Multi-cluster resilience, disaster recovery and FinOps4% of the exam

    • Architect multi-cluster strategies that meet resilience objectives while controlling platform cost.
    • Scope: Fleet management, Multi-Cluster Services API, cross-region failover, RPO/RTO design, DR exercises, OpenCost and FinOps cost allocation.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner