NetApp Certified Hybrid Cloud Architect: Earn One Cert First

Why does NS0-604 require a hyperscaler certification first?

NetApp requires proof of at least one hyperscaler certification before you can take NS0-604, the NetApp Certified Hybrid Cloud Architect exam. The accepted exams are AWS SAA-C03, Microsoft AZ-104, Microsoft AZ-305 and the Google Associate Cloud Engineer. The exam tests your ability to analyze, position and design NetApp hybrid cloud solutions on one of those three public clouds, so NetApp wants the cloud half proven in advance.

You need one of the four, not all of them. Pick the cloud your employer actually runs, because the design scenarios on the exam let you reason from any of the three providers and your answers will be sharper on the one you know.

What NetApp recommends but does not require

The official credential page also lists the NetApp Hybrid Cloud Administrator exam, NS0-305, as highly recommended, along with fundamental NetApp knowledge and NetApp courses. Two low cost accreditation exams, NetApp Cloud Native Associate and NetApp Hybrid Cloud Associate, are suggested as warm ups. None of these is a gate. The hyperscaler certification is.

The task list on the NetApp credential page reads like an architect’s job description rather than an administrator’s: determine business requirements, architect and position a solution, document it, run a proof of concept, support customer success and future proof the design. That is the person NS0-604 is written for, and it explains why the questions are scenarios rather than command syntax.

What does the NetApp Certified Hybrid Cloud Architect exam look like?

NS0-604 has 60 questions in 120 minutes with an 80 percent passing score, delivered through Pearson VUE. NetApp’s price list since 1 May 2025 sets certification exams at 200 USD and Expert level exams at 250 USD, and NetApp places Hybrid Cloud Architect at the Expert level of its Hybrid Cloud path. The credential stays active for 24 months once earned.

Do the arithmetic before you book. Eighty percent of 60 is 48 correct answers, which leaves you 12 misses. Two hours across 60 questions is two minutes each, which is generous for a fact and tight for a scenario that asks you to compare three placement options. Most candidates find the time is fine and the 80 percent bar is the real obstacle.

Retakes and the account you need first

NetApp’s retake rules are stated on its certification policies page. A first failure can be retaken straight away. After further failures you wait 14 days. After a pass you wait 12 months before sitting the same exam again. One practical detail catches people out: every NetApp exam needs a NetApp account, and a new account takes between 4 and 24 hours to create, so set it up before you try to schedule.

Which eight domains does NS0-604 test, and why are there no weightings?

NS0-604 covers eight domains: Customer Requirements, NetApp Hybrid Cloud Solutions, Hybrid Cloud Architecture, Business Continuity and Data Protection, Networking, Sizing and Scale, Security, and Monitoring. Neither NetApp nor the NWExam syllabus page publishes a percentage for any of them. You plan by objective, not by weight, and there are only 15 objectives in total.

Without weightings, the only safe assumption is that every domain can appear and none can be skipped. If you lose half the marks in any two domains, you have probably spent your 12 misses. The third column above is not published by NetApp. It comes from reading the objectives against the shape of the questions, and the quickest way to calibrate that yourself is to work through a set of NS0-604 sample questions before you study, so you can see which objective each scenario is really testing.

Notice what the objectives do not say. There is no ONTAP command line, no SnapMirror configuration syntax, no cluster setup. Those belong to the administrator and implementation exams lower in the path. Here the verbs are position, design and consider.

How does the NetApp Console change the architecture questions?

The Hybrid Cloud Architecture and Security domains of NS0-604 revolve around the NetApp Console, the control plane NetApp formerly called BlueXP, and the agent it deploys into each environment. NetApp’s documentation now calls that agent the Console agent; older material, including the sample questions, still calls it the Connector. Both names refer to the same component, and the exam expects you to know what it does and does not touch.

Control plane and data path are separate

The design point that keeps recurring is separation. The Console orchestrates provisioning and lifecycle actions. Client reads and writes go directly to the storage service and never pass through the Console or its agent. A candidate who believes the agent proxies application traffic will get the placement, the security and the availability questions wrong in one go, because all three follow from that separation.

NetApp’s own description of the Console agent architecture makes the boundaries explicit: the agent is a lightweight component installed in your network, it initiates every connection to the Console rather than the other way round, it uses TLS 1.3, and it acts on cloud resources using only the permissions it has been granted.

One agent per environment

Placement follows from permissions. When a design spans two public clouds, the expected answer is an agent aligned to each cloud, holding locally scoped permissions and the network reachability that cloud needs. Routing every cloud’s control operations through one central agent, or embedding the agent inside a volume, are the distractors, and they read as plausible until you remember the permission boundary.

The Monitoring domain sits on the same platform. When a scenario asks for one service that ingests telemetry from on-premises systems and several public clouds and correlates resource relationships across all of them, it is describing the observability service in the Cloud Controls portfolio rather than the health and risk telemetry of the support tooling, and the difference between those two is exactly what the question is checking.

Designing for availability and durability: what NS0-604 expects

The Business Continuity and Data Protection domain of NS0-604 has two objectives, designing for availability and designing for durability, and the exam treats them as different problems. Availability is about surviving the loss of a zone or a region while still serving. Durability is about keeping a restorable copy that survives an attacker with administrative credentials. A single mechanism rarely covers both.

Zones for local resilience, replication for the region

The canonical availability design is a file service deployed across availability zones in the primary region, replicated with SnapMirror to a second region. Two instances in the same zone do not survive a zone loss. Two regions with no replication relationship do not survive anything, because nothing moves the data. Expect the wrong answers to be built from exactly those two mistakes.

Cascade or fan-out

When one dataset must feed a disaster recovery replica in a second region and a reporting copy in a third, the choice is between a fan-out, where the primary sends to both destinations over separate wide-area links, and a cascade, where the primary replicates once to the second region and that copy forwards to the third. If the requirement is to carry the source across the wide-area link only once, the cascade is the answer. Fan-out is not wrong in general, it is wrong for that requirement, and reading the requirement is the skill.

Three requirements, three mechanisms

A favourite question shape gives you three needs for one volume and asks you to map a mechanism to each:

• Same-day rollback of accidental edits: local snapshots on the source.
• A cross-region copy for site loss: SnapMirror replication.
• Restorable copies kept for ninety days on independent storage: backup and recovery to an object store.

The trap is the answer that uses one mechanism for all three, or swaps the roles around. Snapshots on the same storage do not survive a site loss, and a replica is not a ninety day retention policy.

Ransomware changes the durability question

Following a ransomware tabletop exercise, the design has to guarantee a clean copy even when the attacker holds primary administrator credentials. Three design choices meaningfully improve recoverability: enough historical restore points to go back to before the encryption started, an independent backup copy in an object store whose deletion authority is separated from the primary administrators, and at least one immutable copy that cannot be altered or deleted during its retention period. Anything that consolidates copies or widens delete rights makes the position worse.

How do networking and private connectivity show up on the exam?

The Networking domain of NS0-604 tests two things: the network requirements NetApp hybrid cloud services impose, and the topologies used to connect on-premises systems to the cloud. In practice that means hub and spoke behaviour inside a cloud and the choice between a VPN over the internet and a dedicated private circuit between sites.

The hub and spoke question is the one most people get wrong on first sight. Spoke A is peered to a hub, spoke B is peered to the same hub, both peerings are healthy, and hosts in A still cannot reach hosts in B. The reason is that peering is non-transitive. Traffic from A to B does not flow through the hub by default, and the fix is a transit gateway or hub transit rather than a security group change or a public-facing hub.

The private connectivity question is about predictability. A financial customer replicating continuously from on-premises ONTAP to a cloud file service wants low, consistent latency and dedicated throughput unaffected by internet congestion, and accepts the lead time of a physical circuit. A site-to-site VPN encrypts the traffic but still rides the public internet. A private endpoint keeps the address private but not the path. The dedicated circuit, Direct Connect on AWS or ExpressRoute on Azure, is what the requirement describes.

Why the definition matters

Every one of those scenarios is a hybrid cloud in the sense the NIST definition uses, and the wording is worth having in your head because the Customer Requirements domain asks you to talk about cloud solutions in general before it asks about NetApp’s. NIST’s definition of cloud computing puts it this way:

“The cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load balancing between clouds).”

The phrase to hold on to is bound together by technology that enables portability. On this exam, SnapMirror, the Console agent and the private circuit are that technology, and the questions are about choosing the right one for the requirement in front of you.

Where does NS0-604 sit in NetApp’s Hybrid Cloud path?

NetApp’s certification catalogue places the Hybrid Cloud Architect at the Expert level, the top of a Hybrid Cloud path that runs through Technology Solutions Professional, Data Administrator ONTAP, Hybrid Cloud Administrator, StorageGRID Administration and Hybrid Cloud Implementation Engineer. NS0-604 is the only exam in that path with a prerequisite from another vendor, and the only one at the Expert tier.

The path is a recommendation, not a ladder you must climb rung by rung. NetApp does not require the Administrator or Implementation Engineer credentials before the Architect exam. It does say the Administrator exam is highly recommended, and there is a good reason: the Administrator syllabus is where you learn what the services do, while the Architect syllabus assumes you know and asks where to put them. If you are weighing the two, this site’s guide to the NS0-305 Administrator exam shows how much lower the design content sits at that level.

Why the architect role is in demand now

NetApp is a Leader in the 2026 Gartner Magic Quadrant for Enterprise Storage Platforms and ranked first for the Hybrid Cloud Storage use case in the 2026 Gartner Critical Capabilities report, a position NetApp attributes to native storage services across all three major public clouds. Writing about that result on the NetApp Platform blog, the head of NetApp’s platform engineering organisation described what customers are asking for:

“customers today want their hybrid, often multicloud storage to function as one unified platform, with a consistent operating model across data infrastructure, managed and protected via a single interface”

That sentence is the Architect exam in miniature. One platform across clouds is Domain 2. A consistent operating model is Domain 3. Managed and protected through a single interface is the Console and the Security and Monitoring domains. The person who can design that is the person NS0-604 certifies.

How should you prepare for the NetApp Certified Hybrid Cloud Architect exam?

Prepare for NS0-604 in the order NetApp’s own requirements imply: secure the hyperscaler prerequisite first, learn the NetApp services as an administrator would, then practise design decisions by objective across all eight domains until you can defend a placement, a replication topology and a connectivity choice from the requirement alone. Book when timed practice sits comfortably above 48 out of 60.

1. Confirm you hold one of SAA-C03, AZ-104, AZ-305 or Google ACE, and pass it first if you do not, because NetApp will not register you for NS0-604 without it.
2. Work through the Hybrid Cloud Administrator material, or sit NS0-305, so that every service in the Cloud Storage, Cloud Services and Cloud Controls portfolios is familiar before you are asked to position one.
3. Write the 15 objectives down and rate yourself on each, since NetApp publishes no weightings and any of them can carry a question.
4. Study the NetApp Console and its agent until the control plane and data path separation is second nature, and learn the current names alongside the older BlueXP and Connector terms.
5. Practise the protection designs on paper: zones plus a replicated region, cascade against fan-out, snapshot against SnapMirror against backup, and the three ransomware safeguards.
6. Sit timed sets of 60 questions in 120 minutes and stop booking only when you are consistently above 48 correct.

The older resource pages on this site are still useful for the topic map. The NS0-604 essential topics page lists the same eight domains and links out to practice material, and it makes a reasonable checklist to work down once you have the prerequisite and the administrator knowledge in place.

Two things not to spend time on: memorising ONTAP command syntax, which this exam does not test, and hunting for domain percentages, which do not exist. Every hour spent there is an hour not spent on the design decisions the paper is actually made of.

Frequently Asked Questions

How many questions are on the NS0-604 exam?

NS0-604 has 60 questions and a 120 minute time limit, which works out at two minutes per question.

What is the passing score for the NetApp Certified Hybrid Cloud Architect exam?

The passing score is 80 percent. On 60 questions that means 48 correct answers, so you can miss 12.

Do I need another certification before NS0-604?

Yes. NetApp requires proof of at least one of AWS SAA-C03, Microsoft AZ-104, Microsoft AZ-305 or the Google Associate Cloud Engineer before you can take the exam. The NetApp Hybrid Cloud Administrator exam, NS0-305, is highly recommended but not required.

How much does the NS0-604 exam cost?

NetApp’s price list since 1 May 2025 sets certification exams at 200 USD and Expert level exams at 250 USD, and NetApp lists Hybrid Cloud Architect at the Expert level of its Hybrid Cloud path. The fee shown when you register at Pearson VUE is the one that applies.

Does NetApp publish weightings for the NS0-604 domains?

No. Both NetApp and the NWExam syllabus page list eight domains with their objectives and no percentages. Plan by objective and treat every domain as examinable.

How long is the NetApp Certified Hybrid Cloud Architect certification valid?

NetApp certifications are active for 24 months once earned. After a pass you must wait 12 months before retaking the same exam.

What is the retake policy if I fail NS0-604?

A first failure can be retaken immediately. After multiple failures you must wait 14 days between attempts.

Is NS0-604 the current NetApp Hybrid Cloud Architect exam?

Yes. NS0-604 replaced the earlier NS0-603, and NetApp’s catalogue lists the Hybrid Cloud Architect credential as active at the Expert level with no retirement notice.

What is the difference between the NetApp Console and BlueXP?

They are the same product. NetApp renamed BlueXP to NetApp Console, and the Connector component is now called the Console agent. Older study material and sample questions still use the earlier names.

Conclusion

The prerequisite is the point. NetApp Certified Hybrid Cloud Architect is the one NetApp credential that starts with another vendor’s exam, because the paper assumes the cloud and tests the design: where the Console agent sits, how a file service survives a zone and then a region, when a cascade beats a fan-out, and why a private circuit rather than a VPN answers a latency requirement.

The numbers are simple. NS0-604 is 60 questions in 120 minutes at an 80 percent bar, eight domains with no weightings, 24 months of validity, and a fee set by NetApp’s Expert tier price list rather than the older figure still circulating.

Hold the hyperscaler certification, learn the services as an administrator, then practise the design decisions until you can name the objective behind every scenario. When your timed scores stay above 48, schedule the exam.