What Is the Linux Foundation Certified System Administrator Exam?

The Linux Foundation Certified System Administrator exam, code LFCS, is a vendor-neutral, online, proctored test of everyday Linux administration. Instead of answering questions, you solve 17 to 20 tasks on live hosts from the command line within 2 hours, and you need 67 percent to pass. The exam costs $445, has no prerequisites, and the certification stays valid for two years.

The Linux Foundation pitches it at an intermediate level: someone who already runs Linux systems and wants a credential that proves it without tying them to one vendor’s distribution. Its own LFCS certification page lists the full set of domains and competencies, and every figure below matches it.

How Do the 17 to 20 LFCS Tasks Actually Work?

Each LFCS task is a short problem tied to a named host. You read the task, connect to that host over SSH from the base system, gain root with sudo, make the change, confirm it works, and exit back to base before the next task. The 17 to 20 tasks are scored on the end state of each machine, and 67 percent of the marks is the pass line.

The detail matters because the exam environment has rules that a careless habit can break. The Linux Foundation’s candidate instructions for LFCS spell them out, and they are worth reading before exam day, not during it.

The base system and the task hosts

You start on a machine called base. An infobox at the top of every task names the host where the work must happen, and you reach it with a command such as ssh followed by the node name. Nested SSH is not supported, so you always return to base first and then connect to the next host. The base system deliberately has none of the editors installed, which is a gentle push to do the work where it belongs.

• Every task host comes with Emacs, Git, Nano, Sudo and vim already installed and configured.
• You can become root on any host with sudo -i, or run single commands through sudo.
• You must not block incoming ports 8080, 4505 and 4506, including through a distribution’s default firewall configuration, and you must not stop the process that runs the exam terminal.
• In the remote desktop terminal, copy and paste use Ctrl+Shift+C and Ctrl+Shift+V, and Ctrl+Alt+W replaces Ctrl+W.

That last point sounds trivial until a reflexive Ctrl+W closes a browser tab halfway through a task. Practising on a setup that mirrors the real one removes that kind of surprise, which is where an LFCS practice exam earns its place alongside hands-on lab time.

What you can and cannot look up

Resources are limited to what you can reach from inside the exam terminal: man pages, the documentation a distribution installs under /usr/share and its subdirectories, and packages that belong to the distribution. Nothing outside the terminal is allowed. Installing packages is not required to finish any task, but if you choose to, the instructions recommend knowing the standard package managers apt, dpkg, dnf and yum.

How Is the LFCS Syllabus Weighted?

The LFCS syllabus has five weighted domains: Operations Deployment and Networking at 25 percent each, Storage and Essential Commands at 20 percent each, and Users and Groups at 10 percent. Together they hold 34 named competencies, from kernel parameters and SELinux to LVM, static routing, Git basics and LDAP accounts. Half of the exam sits in the first two domains.

The weights tell you where the marks are, but not how many tasks each domain gets. The Linux Foundation publishes no task count per domain, so plan by weight: Networking weighs two and a half times as much as Users and Groups.

Why Do Operations Deployment and Networking Carry Half the Marks?

Operations Deployment and Networking are each worth 25 percent of the LFCS exam because they cover the work a Linux administrator does every week: keeping services, packages, containers and virtual machines running, and keeping hosts reachable, routed and secured. Between them they list 16 competencies, so most of your practice time belongs here.

Operations Deployment, 25 percent

This domain is the broadest in the exam. Its eight competencies are:

• Configure kernel parameters, persistent and non-persistent
• Diagnose, identify, manage, and troubleshoot processes and services
• Manage or schedule jobs for executing commands
• Search for, install, validate, and maintain software packages or repositories
• Recover from hardware, operating system, or filesystem failures
• Manage Virtual Machines (libvirt)
• Configure container engines, create and manage containers
• Create and enforce MAC using SELinux

The phrase persistent and non-persistent is the trap in the first item. Setting a value for the running kernel and making it survive a restart are two separate jobs, and the kernel’s own sysctl kernel documentation is the clearest reference for what each tunable under /proc/sys/kernel actually does.

SELinux is the other item that catches people who have spent their careers on systems where it was switched off. Mandatory access control means labels, booleans and policy, not just file permissions. The SELinux userland project is where the libraries and tools that distributions ship are maintained.

Networking, 25 percent

Networking asks you to make hosts talk to each other correctly and safely:

• Configure IPv4 and IPv6 networking and hostname resolution
• Set and synchronize system time using time servers
• Monitor and troubleshoot networking
• Configure the OpenSSH server and client
• Configure packet filtering, port redirection, and NAT
• Configure static routing
• Configure bridge and bonding devices
• Implement reverse proxies and load balancers

Packet filtering deserves extra care because of the port rule in the exam instructions. A firewall task done too aggressively can block the ports the exam itself relies on, so practise writing rules that do exactly what the task asks and nothing broader.

What Do Storage, Essential Commands and Users and Groups Ask?

The remaining 50 percent of LFCS splits into Storage at 20 percent, Essential Commands at 20 percent and Users and Groups at 10 percent. Storage is about volumes, filesystems, swap and mounts; Essential Commands mixes Git, services, performance and SSL certificates; Users and Groups covers accounts, environment profiles, limits, ACLs and LDAP.

Storage, 20 percent

• Configure and manage LVM storage
• Manage and configure the virtual file system
• Create, manage, and troubleshoot filesystems
• Use remote filesystems and network block devices
• Configure and manage swap space
• Configure filesystem automounters
• Monitor storage performance

LVM and mounts reward the same habit as kernel parameters: a change that works now but is gone after the next boot is half a change. Get used to checking that your fstab entries and volume layout are written down, not just active.

Essential Commands, 20 percent

• Basic Git Operations
• Create, configure, and troubleshoot services
• Monitor and troubleshoot system performance and services
• Determine application and service specific constraints
• Troubleshoot diskspace issues
• Work with SSL certificates

Git and SSL certificates look out of place in a sysadmin exam until you remember how much configuration now lives in repositories and how many services refuse to start over a bad certificate.

Users and Groups, 10 percent

• Create and manage local user and group accounts
• Manage personal and system-wide environment profiles
• Configure user resource limits
• Configure and manage ACLs
• Configure the system to use LDAP user and group accounts

It is the smallest domain, but LDAP integration is the one item here that many administrators have never configured by hand. Spend an evening on it.

Which Linux Distribution Does the LFCS Exam Use?

LFCS is independent of distribution-specific tasks. Since the Linux Foundation updated the exam on 11 May 2023, candidates no longer choose a platform in the exam preparation checklist, and the tasks are written so that general Linux skill solves them. What matters is knowing the standard tools well, not one vendor’s wrappers around them.

The Linux Foundation explained the change in its LFCS update announcement, which also introduced the current domain list. In practice, this means you should be comfortable on both a Debian style and a Red Hat style system. The allowed resources hint at the same thing: the instructions mention apt and dpkg alongside dnf and yum.

LFCS or RHCSA: Which Hands-On Exam Fits You?

LFCS and Red Hat’s RHCSA are both performance-based Linux administration exams, so the choice is about scope rather than difficulty style. LFCS is vendor-neutral and distribution independent. RHCSA, exam EX200, is built on the skills that underpin system administration across Red Hat products, so it suits people who work mainly on Red Hat Enterprise Linux.

Red Hat describes the RHCSA EX200 exam as a hands-on, practical test of real-world tasks, where configurations must persist after a reboot without intervention and notes and books are not allowed. The two exams overlap heavily in what they ask you to do at the keyboard; they differ in whose platform they certify.

• Pick LFCS if you administer a mix of distributions, work in cloud or container environments, or want a credential that does not depend on one vendor.
• Pick RHCSA if your employer standardises on Red Hat Enterprise Linux and asks for Red Hat credentials by name.

Neither choice wastes effort. The underlying skills, services, storage, networking, users and security policy, transfer directly between the two.

What Does the LFCS Fee Include?

The LFCS exam costs $445 on its own. That price covers 12 months to schedule and sit the exam, two exam attempts so one retake is included, two sessions on an exam simulator, a PDF certificate and digital badge, and a certification valid for two years. Bundles add a subscription or the LFS207 course for a higher price.

The Killer.sh simulator

Enrolment unlocks an exam simulator provided by Killer.sh. You get two simulation attempts, each with 36 hours of access from the moment you activate it. The simulator holds 20 to 25 questions that are identical for every attempt and every user, unlike the real exam, and it returns graded results. Treat it as a rehearsal of the environment rather than a preview of the tasks.

If you want background on how LFCS fits a wider career in Linux administration, our earlier look at LFCS and sysadmin careers covers the career side that this article leaves aside.

How Should You Prepare for the LFCS Exam?

Prepare for LFCS by doing, not reading. Build two lab machines from different distribution families, work through every competency by weight, practise making each change survive a reboot, rehearse the exam’s SSH and sudo workflow, then use the simulator to test your speed. The clock is part of what you practise: 120 minutes covers all 17 to 20 tasks.

1. Set up two practice virtual machines, one Debian style and one Red Hat style, so no tool or package manager surprises you.
2. Work through the 25 percent domains first, Operations Deployment and Networking, then Storage and Essential Commands, then Users and Groups.
3. Reboot after every practice change and confirm it is still there, because persistent configuration is a recurring theme across kernel parameters, mounts and services.
4. Practise the exam routine of reading a task, connecting to the named host over SSH, running sudo -i, solving, checking and exiting back to base.
5. Learn to find answers in man pages and /usr/share/doc quickly, since those are the only references you will have.
6. Use the first Killer.sh session about two weeks before your exam date and the second a few days before, and fix every weak area it exposes.

Time is the hidden constraint. Skip a task that is not yielding after a few minutes, finish the ones you know, and come back. Leaving a hard task to the end protects the time you need for the ones you can finish.

Where LFCS Leads After You Pass

LFCS is a foundation credential, and the most common next step is into Kubernetes. The Linux Foundation’s performance-based Kubernetes exams use the same style of live terminal tasks, so the habits you build for LFCS, working fast on remote hosts and checking your results, carry straight over.

Administrators who move on to container platforms often aim at Kubernetes security next, and our guide to the CKS Kubernetes security exam explains what that later step involves. Remember that LFCS itself is valid for two years, so plan the renewal of your foundation credential alongside any new ones.

Frequently Asked Questions

How many questions are on the LFCS exam?

LFCS has no multiple choice questions. It consists of 17 to 20 performance-based tasks that you solve on live Linux hosts from the command line within 120 minutes.

What is the LFCS passing score?

You need a score of 67 percent or above to pass the Linux Foundation Certified System Administrator exam.

How much does the LFCS exam cost?

The exam alone costs $445. A bundle with the THRIVE-ONE annual subscription costs $625, and a bundle with the LFS207 course costs $645.

Does the LFCS fee include a retake?

Yes. The purchase includes two exam attempts, so one retake is covered, and you have 12 months to schedule and take the exam.

Which Linux distribution is used in the LFCS exam?

The exam is independent of distribution-specific tasks, and since the May 2023 update you no longer choose a platform. Being comfortable with both apt and dnf style systems is sensible preparation.

Is LFCS better than RHCSA?

Neither is better in general. LFCS is vendor-neutral and distribution independent, while RHCSA centres on Red Hat systems. Choose the one that matches the platforms you work on and the credentials employers ask for.

What resources can I use during the LFCS exam?

Only resources reachable from the exam terminal: man pages, documentation installed under /usr/share, and packages that are part of the distribution.

How long is the LFCS certification valid?

The Linux Foundation Certified System Administrator certification is valid for two years.

Does LFCS come with a practice simulator?

Yes. Enrolment includes two Killer.sh simulator sessions with 36 hours of access each, using 20 to 25 fixed questions with graded results.

Conclusion

The Linux Foundation Certified System Administrator exam is a working session, not a quiz. You get 17 to 20 tasks, two hours, and live hosts, and you need 67 percent of the marks. Half of them come from Operations Deployment and Networking, and persistent configuration runs through every domain. The $445 fee covers a retake, two simulator sessions and a credential valid for two years, on any distribution you like.

So prepare the way the exam is scored. Build two lab machines, work through the competencies by weight, reboot to check your changes, and rehearse the SSH and sudo routine until it is automatic. Then book the exam with time in hand to use your retake if you need it.

What Does the Databricks ML Professional Certification Actually Test?

The Databricks ML Professional certification tests whether you can run machine learning on Databricks at enterprise scale, not just train a model. Its three sections cover building and tuning models with SparkML, Ray, Optuna, MLflow and the Feature Store; operating them through testing, bundles, retraining and monitoring; and deploying them with rollout strategies and custom model serving.

Databricks’ own description of the candidate is specific. Someone who passes should be able to build scalable ML pipelines with SparkML, run distributed training and hyperparameter tuning, use the advanced features of MLflow, automate feature pipelines with Feature Store concepts, apply testing strategies, manage environments, automate retraining, detect drift with monitoring, and manage how new models roll out. Read that list as a job description and the weighting makes sense: more than half of it happens after a model exists.

That is the key difference from the associate level. The ML Associate exam checks that you can use the platform to explore data, engineer features and train a model. The Professional exam assumes you can already do that and asks what happens next, when the model has to be reproducible, testable, observable and replaceable without an outage.

Who the exam is written for

The guide’s recommended experience is one year of hands-on work on the Databricks platform with the topics in the exam outline. In practice that describes machine learning engineers and senior data scientists who own models in production, MLOps engineers who build the pipelines around them, and platform engineers who support data science teams on Databricks. A data scientist who has only ever handed a notebook to someone else will find the MLOps section the hardest part of the paper.

How Is the Exam Run: Questions, Time, Fee, Passing Score and Validity?

The exam has 59 scored multiple choice questions and a 120 minute time limit, and it costs $200 plus any local taxes. It is delivered online with a proctor or at a test center, in English only, with no test aids allowed. The credential is valid for 2 years, and CertFun lists the passing score as 70 percent.

The unscored items matter for pacing. If all 10 appear you are reading up to 69 questions in 120 minutes, which leaves a little over a minute and a half for each one. The items are scenario led: a team, a constraint and four plausible answers, where usually two would work and only one meets every stated requirement. Working through the ML Professional sample questions before you book is the quickest way to get used to that style, because the wrong answers are rarely absurd; they are the option that is slower, more manual or less safe.

Recertification is a full retake. The official certification page says the credential must be renewed every two years by passing the current version of the exam, so a pass in late 2026 means sitting whatever version is live in late 2028. The same page notes that any SQL in the exam follows ANSI SQL standards.

Which Tool Names Have Changed Since the Exam Guide Was Written?

Two names in the exam outline now appear differently in the Databricks documentation. Databricks Asset Bundles are documented as Declarative Automation Bundles, and the old Lakehouse Monitoring documentation now opens on the data profiling page under data quality monitoring. The exam objectives still use the original names, so learn both.

This matters more than it looks. The exam guide tells candidates to study the official documentation because it is the most current source, and the documentation has moved on from some of the guide’s wording. A candidate searching only for the old names finds older blog posts; a candidate reading only the current docs may not recognize the objective when it appears with its original wording.

Bundles

The bundles documentation describes Declarative Automation Bundles as formerly known as Databricks Asset Bundles: a way to describe Databricks resources as source files so a project can be version controlled, reviewed, tested and deployed through CI/CD. The certification page itself now uses the new name, while the objective still reads “Define and configure Databricks ML assets using DABs (Databricks Asset Bundles): model serving endpoints, MLflow experiments, ML registered models.” Same tool, same job.

Monitoring

The data profiling documentation describes the same three analysis types the exam names: time series profiles for tables with a timestamp column, inference profiles for tables that hold a model’s inputs and predictions, and snapshot profiles for everything else. It also explains the baseline table, which is how drift is measured against a known good distribution. If an objective mentions Lakehouse Monitoring, read the data profiling pages to answer it.

What Does the 44 Percent Model Development Section Expect You to Build?

Model Development is worth 44 percent and has four parts: using Spark ML, scaling and tuning, advanced MLflow usage, and advanced Feature Store concepts. Its 22 objectives are about doing familiar work at a scale where single-node tools stop working, and choosing correctly between distributed and single-node approaches.

Spark ML is about judgement, not syntax

The first objective in the section is “Identify when SparkML is recommended based on the data, model, and use case requirements,” and that sets the tone. You should know how estimators, transformers and pipelines fit together, because the exam guide’s own sample question asks which encoding and assembly approach still works when the data grows to hundreds of millions of rows. The Apache Spark pipelines guide explains exactly that model of transformers, estimators and stages, and it is worth reading once from the project itself rather than through a summary.

Scaling and tuning has the most objectives

Seven objectives sit here, and they mix three frameworks. You need to know how Optuna trials are distributed across a cluster and logged to MLflow, how Ray does the same job, when Ray is the better choice than Spark for distributing training, and how the pandas Function API trains one model per group, such as one forecast per store. The trade-off objectives, vertical against horizontal scaling and model against data parallelism, are reasoning questions: given the model size and the data size, which approach fails first.

MLflow and the Feature Store

MLflow appears in six of the exam’s 47 objective lines, across all three sections. Here the focus is nested runs, where a parent run holds a whole search and child runs hold each configuration, and on logging custom artifacts in code. The Feature Store objectives turn on one idea above all: point-in-time correctness, so that a training row only sees feature values that existed at its timestamp. Get that wrong and the model learns from the future, which is the data leakage the objective names.

“It is inspiring to see the rapid adoption of the project. In terms of contributor count, MLflow achieved in 9 months what Apache Spark took 3 years to achieve.”

Why Is MLOps Weighted as Heavily as Model Development?

MLOps carries 44 percent because Databricks treats running a model as hard as building one. Its five parts are model lifecycle management, validation testing, environment architectures, automated retraining, and drift detection and monitoring. Ten of its 20 objectives are about monitoring alone, which makes monitoring the single largest topic on the exam.

Lifecycle and environments

The lifecycle objectives ask you to describe the architecture of pipelines that move work between environments under the deploy code strategy, and to map Databricks features to each lifecycle activity. Deploy code means the code, not a trained model artifact, is promoted from development to staging to production, and each environment trains its own model on its own data. The MLOps workflow documentation lays this architecture out stage by stage, and it is the clearest single reference for this part of the syllabus. The environment objectives then ask you to define serving endpoints, MLflow experiments and registered models in bundles, so the whole setup is reproducible across workspaces.

Testing a machine learning system

Four objectives cover testing, and they are practical. You write unit tests for individual functions in Databricks notebooks, identify which tests belong in development, test and production stages, design an integration test that runs through feature engineering, training, evaluation, deployment and inference, and weigh the ways of organizing functions and their tests. Expect questions that change one thing, such as a hyperparameter, and ask which integration tests must run again as a result.

Retraining and monitoring

The retraining objectives connect directly to monitoring: a workflow is triggered by drift or by falling performance, and a strategy decides which retrained model wins. The monitoring objectives cover the statistical tests in the drift metrics table, choosing the right table type and feature for a use case, building a monitor on a snapshot, time series or inference table, alerting when drift crosses a threshold, comparing against a baseline or between time windows, tracking model performance over time from an inference table, custom metrics, slicing by feature, and endpoint health such as latency, request rate, error rate, CPU and memory.

The selection step is where the exam is most demanding. The right metric depends on how predictions are used. When a business acts on predicted probabilities at fixed confidence thresholds, a metric that rewards well calibrated probabilities beats one that only scores hard labels or ranking, and the guide includes exactly that kind of scenario. Know what each common metric measures, not just its name.

How Does the Model Deployment Section Test a Rollout?

Model Deployment is the smallest section at 12 percent, with five objectives in two parts. Deployment strategies asks you to compare approaches such as blue-green and canary for high traffic applications and to implement a rollout with Databricks Model Serving. Custom model serving asks you to register a custom PyFunc model in Unity Catalog and query and deploy it.

A blue-green rollout keeps two complete versions running and moves all traffic from one to the other at once, keeping the old one ready if something goes wrong. A canary rollout adds the new model alongside the old and raises its share of traffic in steps while you watch its metrics. On Model Serving the canary pattern means a second served entity on the same endpoint with a traffic split you adjust over time. For a business critical model where a bad release costs money, the safer answer is usually the gradual one, combined with scale-out for the traffic itself.

Custom PyFunc models

The custom serving objectives are about wrapping logic that a standard model flavor cannot express, such as preprocessing or real-time feature lookups, inside a PyFunc model, logging its artifacts, registering it in Unity Catalog, and then calling it. You should know the three ways to deploy one (the MLflow Deployments SDK, the REST API and the user interface) and the two ways to query it, the REST API and the MLflow Deployments SDK. The MLflow source and its documentation live in the official MLflow repository, which is useful when you want to see exactly what a deployments client does with an endpoint name and an input payload.

Is the Databricks ML Professional Certification Worth It for You?

The Databricks ML Professional certification is worth it if your work includes owning models in production on Databricks, because more than half of the exam is MLOps and deployment that the job already requires. It is weaker value if you mainly build models in notebooks and hand them on, since the paper will test skills you do not use and the credential lapses in two years.

Three questions settle it. First, does your team run machine learning on Databricks? The exam is platform specific: Feature Store, Model Serving, Unity Catalog, bundles and data profiling are Databricks features, and the knowledge transfers to other platforms only as concepts. Second, do you already deploy and monitor models? If you do, preparation is mostly closing gaps; if you do not, the MLOps section is new territory and a year of hands-on time, as the guide recommends, is realistic. Third, will you keep it current? A $200 fee every two years is modest, but each renewal is a full exam on whatever the current version is.

Professional or Associate first?

There is no prerequisite, so you can go straight to the Professional exam. The associate level still makes sense for anyone whose Databricks experience is mostly data preparation and model training, because it covers that ground without the operational load. If you are deciding between the two, the Machine Learning Associate path shows what the lower credential covers, and the gap between the two is almost exactly the MLOps and deployment material described above.

What it signals to an employer

The value of a professional level vendor credential is the specificity of its claim. This one says you can test, ship, monitor and retrain models on one named platform, which is the exact gap many hiring managers worry about when a strong data scientist moves into an engineering role. It does not replace evidence of production work, but it is a credible summary of it.

How Should You Prepare for the Exam?

Prepare in the order of the weightings and the dependencies: model development first, because MLOps assumes it, then MLOps with monitoring given the most time, then deployment. Databricks recommends two courses, Machine Learning at Scale and Advanced Machine Learning Operations, and the hands-on practice matters more than reading, since the items describe real platform behaviour.

Free Edition is enough for most of the practice. The exam guide points candidates to it and to the AI Prep Guide, which suggests a short list of hands-on tasks mapped to the objectives. Combine that with the official documentation, which Databricks calls the most current and authoritative source, and use the renamed tools under their new names while remembering the old ones.

A preparation order that follows the weightings

1. Read the current exam guide end to end and mark every objective you have not done yourself on Databricks.
2. Build one SparkML pipeline with an encoder, an assembler and an estimator, tune it, and score it in batch and in a stream.
3. Run a distributed Optuna search and a Ray search, log both to MLflow with nested runs, and compare them in the MLflow UI.
4. Create a feature table with a timestamp key, train from a point-in-time lookup, and publish features for online serving.
5. Put the project in a bundle with an experiment, a registered model and a serving endpoint, and deploy it to two targets.
6. Profile an inference table against a baseline, set an alert on a drift metric, and trigger a retraining job from it.
7. Register a custom PyFunc model in Unity Catalog, serve it, query it through the MLflow Deployments SDK, and shift traffic to a second served entity in steps.
8. Finish with timed practice, then reread the exam guide to find any objective you still have not touched.

Steps two to four cover the 44 percent development section, steps five and six the 44 percent MLOps section, and step seven the deployment section. Give step six the most time, because monitoring alone accounts for ten objectives. For a topic by topic review of this same exam from an earlier version, the ML Professional key topics page is useful background, but check every point against the current guide, since the outline was rebuilt in the September 2025 version.

On exam day

Online delivery needs the system check Databricks asks for before the exam, and nothing may be used during it. Read each scenario for its constraint words, such as minimal setup, high traffic, reproducible or real time, because those words decide between two otherwise valid answers.

Frequently Asked Questions

How many questions are on the Databricks ML Professional exam?

There are 59 scored multiple choice questions, and up to 10 unscored items may also appear. The time limit is 120 minutes, which already includes extra time for the unscored items.

What is the passing score?

CertFun lists the passing score as 70 percent. Databricks does not display a passing score on its certification page or in the exam guide.

How much does the Databricks ML Professional certification cost?

The registration fee is $200, plus any taxes required by local law. Each recertification is a new exam at the current fee.

Is the Databricks ML Professional certification worth it?

It is worth it for engineers and data scientists who run machine learning in production on Databricks, because 56 percent of the exam is MLOps and deployment. It is less useful for people who only build models in notebooks or who do not work on Databricks.

Do I need the Machine Learning Associate certification first?

No. There is no prerequisite. Databricks recommends related training and about one year of hands-on experience with the exam topics.

How long is the certification valid?

Two years. To recertify you take the current version of the exam again.

What are the three exam sections and their weights?

Model Development at 44 percent, MLOps at 44 percent, and Model Deployment at 12 percent.

Are Databricks Asset Bundles still on the exam?

Yes. The objective still names Databricks Asset Bundles, and the current documentation calls the same tool Declarative Automation Bundles. Learn both names.

Can I take the exam online?

Yes. It is delivered online with a proctor or at a test center, in English, with no test aids allowed.

Conclusion

The Databricks ML Professional certification rewards the work that starts after training. Model Development still carries 44 percent, but MLOps carries the same again and deployment adds 12, so testing, bundles, retraining, monitoring and controlled rollouts decide most of the result. The facts are simple: 59 scored questions, 120 minutes, $200, English only, a 70 percent pass mark according to CertFun, and two years of validity before a full retake. Learn the tools under both their exam guide names and their current documentation names, build every objective at least once in Free Edition, and spend the most time on monitoring. Start with the sample questions to see the scenario style, then work through the guide in the order of its weightings.

Is it CSSA, PCSSA or CPSSA?

The current name is Certified Pega Senior System Architect, abbreviated CPSSA, and the current exam code is PEGACPSSA25V1. PCSSA is the abbreviation Pega used on its version 8 exam, which it lists as retired on April 30, 2021. CSSA is the older short form that candidates still search for, and it leads to the same credential.

The word order is the easiest way to date a page. Pega’s version 8 exam page reads Pega Certified Senior System Architect, hence PCSSA. Its current pages put Certified first: Certified Pega Senior System Architect, hence CPSSA. The exam code follows the name, so PEGAPCSSA80V1_2019 belongs to the old order and PEGACPSSA25V1 to the new one.

This matters for more than tidiness. A study guide headed CSSA or PCSSA is very likely describing a different topic list, and as the comparison later in this article shows, the version 8 exam spread its questions across nine topics where the current exam has six. Before you trust any resource, find the exam code it was written for.

The two digits in the code are the platform release. PEGACPSSA25V1 applies to Pega Platform ’25, and Pega’s own description of it is that the certification validates the ability to design and build for reusability across multiple lines of business, with best practices, debugging, performance tuning, system maintenance and security or access requirements all inside its scope.

What does the PEGACPSSA25V1 exam look like?

The Certified Pega Senior System Architect ’25 exam has 60 questions, runs for 1 hour 30 minutes and needs a score of 70 percent to pass. It is offered in English and Japanese, is proctored by Pearson VUE at a test centre or online, and costs US$190 according to the ProcessExam syllabus page.

The duration, pass mark, fee and format come from the ProcessExam syllabus page. The question count, languages, level, platform release and retirement status come from the official CPSSA exam page on Pega Academy, which agrees with the syllabus page on every field the two share. Pega’s page does not display a price, so confirm the fee in your own currency when you book.

What the numbers mean in the room

Sixty questions in 90 minutes is 90 seconds a question. A 70 percent pass mark is 42 correct answers out of 60, so you can miss 18. That margin is narrower than it was one level down, where the System Architect exam asks for 65 percent, and the questions here assume you already build on the platform. To gauge the wording before you plan your study time, try a set of CPSSA sample questions and note which topics slow you down.

Booking

Pega does not run the exam itself. You create a Pearson VUE account if you do not have one, register through the Pearson VUE Pega page, and choose between a test centre and online proctored delivery, which Pega describes as a quiet, uninterrupted room at home or in the office watched by webcam.

Where does Senior System Architect sit in the Pega certification path?

Certified Pega Senior System Architect is the second of three levels in Pega’s System Architect path. It sits above Certified Pega System Architect, which is a stated prerequisite, and below Pega Certified Lead System Architect, which in turn requires the Senior System Architect certification before you can earn it.

Same length, same question count, a higher bar and a different centre of gravity. The System Architect exam is weighted towards case management and carries small topics for Insights, DevOps and Pega GenAI. The Senior exam drops those and moves the weight to application structure: class hierarchy, rule resolution, rulesets and reuse. Pega describes the senior certification as being for Certified Pega System Architects who want to increase their Pega skills.

The step after: Lead System Architect

Pega calls Lead System Architect the top level of certification, and it is a different kind of assessment. Candidates pass a written Architecture Exam and then a hands on Application Exam in which they design and build an application on Pega Platform. The architecture exam on its own awards no certificate. The whole ladder, including the decisioning, robotics and business architect tracks, is laid out on Pega’s page of Pega certification paths.

Which six topics does the Pega Senior System Architect exam cover?

The Pega Senior System Architect exam covers six topics: Application Development at 30 percent, Case Management and Data and Integration at 20 percent each, System Administration at 15 percent, Security at 10 percent and User Experience at 5 percent. On a 60 question exam that is roughly 18, 12, 12, 9, 6 and 3 questions.

Topic names, objectives and weights are taken from the ProcessExam syllabus page and match Pega’s exam page line for line. One gap is worth knowing about: the syllabus page shows no weight beside User Experience, and the 5 percent in the table is the figure Pega displays.

Application Development (30%)

Twelve objectives, and nearly a third of the exam. They fall into three groups. The first is structure: define the class hierarchy, describe the purpose of modular architecture and enterprise reuse, and create an application with the New Application wizard. The second is rule behaviour: describe the rule resolution process and adjust rule availability, identify how circumstancing affects application behaviour, and circumstance rules on a single variable or multiple variables.

The third group is what runs and what ships. You differentiate between a queue processor and a job scheduler, identify the role and elements of activities in case processing, and automate actions when a property value changes. Then come versioning and delivery: the role and impacts of application versioning, ruleset skimming, configuring and validating application rulesets, and migrating an application with product rules.

Case Management (20%)

Five objectives, all about cases that more than one person or process touches. Differentiate between work groups, work queues and organizational structures. Configure parallel processing for cases. Manage concurrent case access and locking strategies. Configure flow action pre and post processing. Extend service level agreement configurations.

Data and Integration (20%)

Validate data against a pattern, identify use cases for keyed data pages, exchange data with other applications, address integration errors in connectors, and configure a field value rule. The connector error objective rewards people who have watched an integration fail in a real environment and had to decide what the case does next.

User Experience (5%)

The smallest topic is the newest in content. It asks you to configure custom portals for different customer requirements, use Pega Web Embed to place Pega applications inside existing client websites, explain how Constellation SDKs use Constellation DX components to bring Constellation into alternative design systems, group fields in views, and initiate request and response calls between a Constellation application and Constellation DX API REST endpoints. Pega’s Constellation SDK documentation is the primary source for the third of those.

System Administration (15%)

Six objectives in two halves. Performance: measure system performance with the performance related tools, debug system performance, and review log files while distinguishing system events from performance events. Settings: explain why Application Settings need configuring to integrate external systems, describe the Application Settings configuration, and add resource settings for an integration.

Security (10%)

Four objectives: distinguish between role based, attribute based and client based access control, organize and manage case attachments, secure data with data encryption, and track and audit changes to data. If attribute based access control is new to you as a concept, the NIST guide to ABAC explains the model independently of any product, which makes Pega’s implementation easier to place.

What changed since the version 8 exam?

The version 8 exam, PEGAPCSSA80V1_2019, divided its questions across nine topics, and the current PEGACPSSA25V1 exam uses six. Reporting, Mobility, Deployments, Data Modeling, Information Exchange and User Interface no longer exist as topic names, and Application Development has grown from 20 percent to 30 percent. Question count, duration and pass mark are unchanged.

Three shifts stand out. Security has more than tripled, from 3 percent to 10, and now names three access control models where the old list had a single line on access control. Mobility has gone entirely: the version 8 list had mobile apps and offline processing, and the current one has neither. And the interface topic has shrunk from 14 percent to 5 while changing its vocabulary from Pega Web Mashup to Pega Web Embed and Constellation.

Some content moved without disappearing. Ruleset configuration and application migration sat under Deployments in version 8 and now sit inside Application Development. Log file review and performance analysis were Application Development items and are now the core of System Administration. A candidate using old material will therefore meet familiar subjects in the wrong proportions, and will be missing Constellation completely.

The foundation level went through its own shift between releases, which this site covered in its System Architect exam breakdown. Read the two together and the direction of the whole track is clear.

Which version should you sit: ’23, ’24 or ’25?

Pega Academy currently lists three Senior System Architect exams side by side: PEGACPSSA23V1, PEGACPSSA24V1 and PEGACPSSA25V1. Each has 60 questions and none shows a retirement date. Sit the version that matches the platform release you work on, and choose ’25 if you have no constraint, because it is the newest.

The reasoning is practical. The exam asks about behaviour you configure, and features such as Constellation have moved between releases. If your project runs on an earlier release and your training environment matches it, the matching exam tests what you actually see. If you are learning from scratch on current Pega Academy material, the ’25 exam is the natural pair.

Two cautions. First, a newer platform release usually brings a newer exam, and older codes do eventually receive retirement dates, as the version 8 exam did, so check the exam page again before you pay. Second, practice material is tied to a code. Search demand for PEGACPSSA23V1 questions is still higher than for the ’25 code, which tells you how much of what circulates was written two releases ago.

How should you prepare for the CPSSA exam?

Prepare for the CPSSA exam by working through Pega’s Senior System Architect mission in a live environment, then revising by exam weight: Application Development first, the two 20 percent topics next, System Administration and Security after that, and User Experience last. Finish with timed sets of 60 questions in 90 minutes.

1. Confirm that your Certified Pega System Architect certification is in place, because Pega states it as the prerequisite for the senior credential.
2. Complete the Senior System Architect mission on Pega Academy for the platform release that matches your exam code, doing every challenge in the exercise environment.
3. Study Application Development until you can trace rule resolution by hand for a circumstanced rule across two ruleset versions.
4. Build one case type that uses parallel processing, a locking strategy and flow action pre and post processing, then break its connector and handle the error.
5. Review a real log file and a performance tool readout, and configure Application Settings for one external integration.
6. Compare role based, attribute based and client based access control on the same case, then cover the five User Experience objectives.
7. Sit two timed sets of 60 questions in 90 minutes and revise any topic where you score below 70 percent.

Why the mission comes before any question set

Pega describes the Senior System Architect mission as building on the System Architect mission and focusing on the tasks a Senior System Architect performs, going beyond low code configuration in App Studio. That last phrase describes the exam well. Many objectives start with configure, circumstance, migrate or debug, and those verbs are learned by doing them. The mission page has a release selector, so set it to the release in your exam code before you begin.

Spend your hours where the questions are

With roughly 18 questions, Application Development alone can use up your entire margin of 18 wrong answers. User Experience, at about three questions, cannot decide the result by itself. Candidates coming from a project that is heavy on interface work tend to over prepare the 5 percent topic and under prepare rule resolution and rulesets. An older page on this site lists CPSSA exam resources if you want more reading once the mission is done.

Frequently Asked Questions

What does CSSA stand for in Pega?

CSSA is the older short form for Pega’s Senior System Architect certification. Pega’s version 8 exam used the abbreviation PCSSA, and the current credential is Certified Pega Senior System Architect, or CPSSA, with the exam code PEGACPSSA25V1.

How many questions are on the Pega Senior System Architect exam?

The PEGACPSSA25V1 exam has 60 questions and lasts 1 hour 30 minutes, which is 90 seconds a question.

What is the passing score for the CPSSA exam?

The passing score is 70 percent, which is 42 correct answers out of 60.

How much does the Pega CSSA certification cost?

The exam fee is US$190 according to the ProcessExam syllabus page. Pega’s exam page does not display a price, so check the amount in your currency when you register with Pearson VUE.

Is there a prerequisite for Certified Pega Senior System Architect?

Yes. Pega states that you must be a Certified Pega System Architect to earn the Senior System Architect certification.

Which topic carries the most weight on the CPSSA exam?

Application Development at 30 percent. Case Management and Data and Integration follow at 20 percent each, then System Administration at 15, Security at 10 and User Experience at 5.

Can you take the Pega Senior System Architect exam online?

Yes. Pearson VUE proctors the exam, and you can take it at a test centre or through online proctored delivery in a quiet room with a webcam.

What languages is the CPSSA exam available in?

Pega lists English and Japanese for PEGACPSSA25V1.

What comes after Certified Pega Senior System Architect?

Pega Certified Lead System Architect, which Pega calls its top level of certification. It requires the Senior System Architect certification and has two parts, a written Architecture Exam and a hands on Application Exam.

Conclusion

Whatever abbreviation brought you here, the exam is PEGACPSSA25V1: 60 questions, 90 minutes, 70 percent to pass, English or Japanese, booked through Pearson VUE, and open only to people who already hold the Certified Pega System Architect certification.

Its six topics are weighted towards how an application is structured and shipped. Application Development is 30 percent, case management and integration take 20 each, and the interface topic that once filled 14 percent of the version 8 exam is now 5 percent and speaks Constellation.

Check the code on every resource you use, match the exam version to the platform release you work on, complete the Senior System Architect mission in a live environment, and put most of your revision into rule resolution, circumstancing and rulesets. Then book the exam.

What does the base SAS certification exam test?

The base SAS certification exam, A00-231, tests four content areas: Access and Create Data Structures at 20 to 25 percent, Manage Data at 35 to 40 percent, Error Handling at 15 to 20 percent, and Generate Reports and Output at 15 to 20 percent. Across them SAS lists 23 main objectives, and states that every one of the 23 appears on every exam.

The credential it leads to is the SAS Certified Specialist: Base Programming Using SAS 9.4. SAS describes the holder as someone who can read and create data files, build basic detail and summary reports with Base SAS procedures, manipulate and transform data, and find and correct both syntax errors and programming logic errors. The table below groups the 23 main objectives under their content areas, in the wording of the syllabus.

23 main objectives, 72 expanded ones

Count the rows and the split is 6, 10, 2 and 5. Under those 23 headings the exam content guide sets out 72 expanded objectives, the individual statements, options and functions a question can be built from. SAS is precise about the difference: the 23 are guaranteed on every exam, while the 72 are given as extra explanation and define the whole domain that could be tested.

In practice the 23 are your coverage checklist and the 72 are your revision list. You cannot predict which expanded item will carry a main objective on your form, whether PROC IMPORT arrives with the GUESSINGROWS statement or with the DELIMITER statement, but you do know that importing data will be there in some shape.

How long is A00-231, and what score passes it?

A00-231 gives you 135 minutes for 40 to 45 questions, and the passing score is 725 on a scale that runs from 200 to 1,000 points. The fee is US$180, charged in US dollars in every country, and the exam is administered by SAS and Pearson VUE. It is based on SAS 9.4 M5.

These figures come from the AnalyticsExam syllabus page for A00-231 and match what SAS displays on its own Base Programming Specialist page, which adds the 200 to 1,000 score range and the software release. Spread evenly, 135 minutes across 45 questions is 3 minutes each, and across 40 questions a little under 3 and a half.

A scaled score, not a percentage

The 725 is a point on a 200 to 1,000 scale, so it should not be read as 72.5 percent of the questions. SAS publishes no conversion between raw answers and scaled points, and no pass rate for the exam. A practice result expressed as a percentage tells you how you did on that practice set and nothing firmer than that.

Retakes, discounts and expiry

The SAS certification FAQ allows up to five attempts at an exam in a 12 month period, with a minimum of 14 days between attempts and the fee charged each time. Once you pass, no further attempts at that exam are allowed. Students, educators and staff of degree-granting institutions can request a voucher that brings an exam to US$75, and it has to be requested before you register.

On expiry, SAS says that some of its credentials expire and that the Exam Details section of each credential page states it when one does. It adds that the absence of an expiry statement means the certificate does not currently expire. The Base Programming Specialist page carries no such statement.

What does performance-based mean on A00-231?

On A00-231, performance-based means the exam is not answered by recognition alone. SAS describes its 40 to 45 questions as multiple choice and short-answer, and its official practice exam for the same code contains performance-based projects that cannot be completed without access to SAS software. Some answers have to be produced, not picked.

That is all SAS puts in writing about the format on its public pages, and it is enough to plan around. A short-answer question has no list of options to eliminate. If the task is to work out how many observations a step writes or what value a variable holds after a BY group ends, the reliable route is to write the program, run it, read the log and the output, and enter what you find. Reading code fluently helps. Writing it under time pressure is the skill being measured.

This is also why the format of your practice matters more here than on most vendor exams. Material that only asks you to choose among four options trains half of the exam. Before you commit to a study plan, look at a set of A00-231 sample questions to see how the objectives turn into tasks, then check that whatever you practise with includes work you must do in a SAS session.

What the 135 minutes are really for

Three minutes a question sounds generous until a question needs a program. Typing a DATA step, fixing the semicolon you missed, rerunning it and reading the result takes longer than choosing an option, so the time you save on recognition questions is what pays for the ones you must run. Candidates who can write a merge or a PROC FREQ call without looking anything up have far more of the clock left for the questions that need thought.

Manage Data: where 35 to 40 percent of the exam sits

Manage Data is the largest content area of the base SAS certification exam at 35 to 40 percent, and it holds 10 of the 23 main objectives. It covers sorting, conditional logic, assignment statements, variable attributes, running totals, SAS functions, type conversion, DO loops, PROC TRANSPOSE and macro variables. Nearly all of it is DATA step work.

DATA step logic

Five of the ten objectives are about how a DATA step executes. Expect IF-THEN/ELSE with DO and END groups, assignment statements that create a variable or overwrite one, and attributes set with the RENAME= data set option and the LABEL, FORMAT and LENGTH statements. The objective on sub-totals is the one that catches people: BY statement processing with first. and last. variables, combined with the RETAIN and SUM statements. If you cannot say, for a sorted data set, when first.variable is 1 and what a retained total holds at that moment, start there.

Functions and conversion

The syllabus names its functions, which makes this the most learnable part of the area. For character data it lists SCAN, SUBSTR, TRIM, COMPRESS, UPCASE and LOWCASE. For numbers: SUM, MEAN, RAND, SMALLEST, LARGEST, ROUND and INT. For dates: MDY, TODAY, DATE and TIME to create values, YEAR, QTR, MONTH and DAY to extract parts, and INTCK, INTNX and YRDIF for intervals. A separate objective covers conversion, both the automatic kind SAS performs for you and the explicit kind with the INPUT and PUT functions.

Know which direction each conversion function works in. INPUT turns character values into numeric ones and PUT turns numeric values into character ones, and the syllabus expects you to explain what SAS does when you leave the conversion to it. Variable lists belong here too: the OF operator and the colon, hyphen and double hyphen forms.

Loops, reshaping and macro variables

The last three objectives are small and specific. DO loops appear in iterative, conditional and nested forms. PROC TRANSPOSE is tested through the VAR, ID and BY statements and the OUT=, PREFIX= and NAME= options. Macro coverage stops at macro variables: creating them with %LET, using them inside a program, and ending a macro variable name with the dot delimiter. Macro programs are not on this syllabus, so do not let a general macro course eat your study time.

Why do error handling and reporting decide close results?

Error Handling and Generate Reports and Output are each worth 15 to 20 percent of A00-231, so together they carry 30 to 40 percent of the exam, as much as Manage Data. Candidates who spend all their time on DATA step logic give away marks in two areas that are narrower, more predictable and quicker to learn.

Error handling: two objectives, one habit

Error Handling has only two main objectives, yet it carries the same weight as an area with five. The first is logic errors: using the PUTLOG statement to write a variable, a formatted value or every variable to the log, using PUTLOG inside conditional logic, and using the automatic variables the guide lists as N and ERROR, which you write in code as _N_ and _ERROR_. The second is syntax errors: misspelled keywords, unmatched quotation marks, missing semicolons and invalid options, diagnosed from the log.

Both objectives reward one habit, which is reading the log before the output. A program that runs and produces a table can still be wrong, and the note or warning that says so is in the log. Build that habit in every practice session and this area becomes the cheapest 15 to 20 percent on the exam.

Reports and output: procedures with named options

The reporting area lists its procedures and options as plainly as the functions list does. PROC PRINT with the VAR, SUM, WHERE, ID and BY statements and the NOOBS and LABEL options. PROC FREQ for one-way and two-way tables, with NLEVELS and ORDER=, and as a way to validate data. PROC MEANS with the WAYS, CLASS, VAR and OUTPUT statements. PROC UNIVARIATE for extreme and missing values. PROC FORMAT with the VALUE statement and the CNTLIN= option.

Output Delivery System questions cover the destinations and the creation of HTML, PDF, RTF, XLSX, PPTX and CSV files, with the STYLE= option for a template. Export closes the area: PROC EXPORT with the csv, jmp, tab and dlm identifiers, and the SAS/ACCESS XLSX engine for writing to Microsoft Excel. Every one of these is a short program you can type from memory after a few repetitions.

Where can you practise for the base SAS certification for free?

SAS offers a free practice exam for the SAS 9.4 Base Programming Performance-Based Exam, open for 180 days from activation, with no clock and unlimited re-attempts. Because it includes performance-based projects, it needs SAS software, which you can get through the virtual lab included with the practice exam, through SAS OnDemand for Academics, or from your own installation.

The details are on the page of free SAS practice exams. You choose the exam, create or sign in to a SAS profile, accept the licence agreement and begin. You can stop and resume whenever you like inside the 180 days, and the score report shows performance detail, the context for each correct answer, and every question for review.

Use the missing clock deliberately

An untimed practice exam is good for learning and poor for measuring readiness. Use the first pass slowly, with the documentation open, to find which of the 23 objectives you cannot yet do. Then time yourself on later passes with your own stopwatch set to 135 minutes, because the real exam will not wait while you look up the syntax of PROC TRANSPOSE.

Check the retake offer before you book

At the time of writing, SAS is running an offer on that page under which a candidate who schedules and sits a participating certification exam between September 29 and November 17, 2026 and does not pass gets a free retake. Terms and conditions apply and the offer covers participating exams only, so confirm that yours is included before relying on it.

Is A00-231 the right SAS programming exam for you?

A00-231 is the middle of three SAS 9.4 programming credentials: SAS Certified Associate: Programming Fundamentals Using SAS 9.4 sits below it, and SAS Certified Professional: Advanced Programming Using SAS 9.4 sits above. The base SAS certification is the one to take if you already write DATA steps and procedures and want that skill confirmed by SAS itself.

The titles tell you the order: Associate, Specialist, Professional. If you have not yet written a working program, the Associate exam is the gentler start. If merges, BY group processing and PROC FREQ are already routine for you, look at what the Professional level asks for instead. SAS also lists the Base Programming Specialist among its most popular credentials, which says something about how often it is asked for.

SAS 9.4 or SAS Viya?

SAS now runs two programming tracks. A00-231 is a SAS 9.4 exam, built on release M5, while the Viya track has its own Associate and Specialist exams. Choose by the software your employer or your target employer runs. If the programs you will maintain were written for SAS 9.4, this is the syllabus that matches them, and if you are heading towards the newer platform instead, this site’s Viya programming study guide covers the entry exam on that side.

What the credential does for a career

Kriss Harris, whose route from statistician to programmer is told in one of the SAS user stories, wanted a programming role at a pharmaceutical company and did not have the track record for it. He describes the gap this way:

“I eventually wanted to move to clinical and become a SAS programmer instead of a statistician, but I needed to learn more Base SAS, and potentially obtain the SAS Base Certification, to get there.”

That is the typical use of this credential. It is evidence, for someone moving sideways into programming, that the DATA step and the core procedures are already in hand. Clinical programming is the clearest example, since trial data is prepared to the CDISC SDTM standard and reshaping raw data into a fixed structure is exactly what sorting, merging, transposing and formatting are for. The exam does not test SDTM. It tests the tools that work is done with.

How should you prepare for A00-231?

Prepare for A00-231 by turning the 23 main objectives into a checklist, getting working SAS software on the first day, and writing a short program for every objective before you read about the next one. Give Manage Data the most hours, drill error handling and reporting until they are automatic, and finish with timed runs of 135 minutes.

1. Download the exam content guide and mark each of the 23 main objectives as can do, can do slowly or cannot do, because every one of them will be on your exam.
2. Set up SAS software before you study anything, through the virtual lab that comes with the free practice exam, SAS OnDemand for Academics or your own installation.
3. Work through Access and Create Data Structures first, since reading, importing, combining and subsetting data is needed for every later task.
4. Spend the largest share of your time on Manage Data, writing a program for each of its 10 objectives and paying particular attention to first. and last. processing with RETAIN.
5. Type each named function, procedure and option from the syllabus at least once without looking it up, so that PROC TRANSPOSE, PROC FORMAT and the ODS statements cost you no thinking time.
6. Break your own programs on purpose and repair them from the log, using PUTLOG to follow a value through a DATA step.
7. Take the free practice exam untimed to find gaps, then repeat it against a 135 minute stopwatch until your result is steady.

The books and training named on the syllabus page are SAS Programming 1: Essentials, SAS Programming 2: Data Manipulation Techniques and the SAS Certification Review course for this exam. They follow the content areas in order, which makes them easy to map onto the checklist from step one.

One warning about older material. This exam is based on SAS 9.4 M5 and its objectives include items such as the SAS/ACCESS XLSX engine and ODS output to XLSX and PPTX. Notes written for earlier generations of the base exam can miss those and spend pages on topics that are no longer listed. For a shorter orientation on the credential itself, see this site’s earlier page on the Base Programming Specialist path, then come back to the 23.

Frequently Asked Questions

How many questions are on the base SAS certification exam?

A00-231 has 40 to 45 questions, which SAS describes as multiple choice and short-answer, and you have 135 minutes to complete them.

What is the passing score for A00-231?

The passing score is 725 on a scale from 200 to 1,000 points. It is a scaled score, not a percentage, and SAS does not publish how raw answers convert to it.

How much does the SAS base programming exam cost?

The exam fee is US$180, charged in US dollars in all countries. Students, educators and staff of degree-granting academic institutions can request a discount voucher that brings an exam to US$75.

Are all topics on the syllabus tested?

Yes at the level of main objectives. The SAS exam content guide states that all 23 main objectives will be tested on every exam, while the 72 expanded objectives define the full domain that could be tested.

Which SAS version is A00-231 based on?

SAS states that the exam is based on SAS 9.4 M5.

How many times can you retake a SAS certification exam?

SAS allows up to five attempts at an exam in a 12 month period with at least 14 days between attempts, and the fee is charged for each attempt. After a pass, no further attempts at that exam are allowed.

Does the base SAS certification expire?

SAS says a credential that expires is marked as such in the Exam Details section of its page, and that no expiry statement means the certificate does not currently expire. The Base Programming Specialist page carries no expiry statement.

Is there a free practice exam for A00-231?

Yes. SAS offers a free practice exam for the SAS 9.4 Base Programming Performance-Based Exam with 180 days of access, no clock and unlimited re-attempts. It needs SAS software for its performance-based projects.

Does A00-231 test macro programming?

Only macro variables. The syllabus covers creating them with %LET, using them in programs and the dot delimiter. Macro programs are not listed in the A00-231 objectives.

Conclusion

The base SAS certification exam is unusually open about what it will ask. Four content areas, 23 main objectives that all appear every time, and a list of named functions, procedures and options underneath them. With 40 to 45 questions in 135 minutes and 725 needed on a 200 to 1,000 scale, there is time to run code, as long as the routine programs come without effort.

Put most of your hours into Manage Data, and do not neglect the 30 to 40 percent that sits in error handling and reporting. Get SAS software running on day one, use the free practice exam first to learn and then against the clock, and check the retake rules before you book. Then work down the 23, one program at a time.

Why does passing the CGEIT exam not make you certified?

ISACA separates the CGEIT exam from the CGEIT certification. The exam is open to anyone interested in IT governance, but certification requires a passed exam within the last five years, a one time US$50 application fee, and a verified minimum of five years of professional experience managing, advising on or otherwise supporting the governance of the IT related contribution to an enterprise.

The experience rule has three parts, and all three are checked on the application. The five years must cover at least three of the four CGEIT domains. At least one of those years must relate to Domain 1, Governance of Enterprise IT. And every year counted must fall within the ten years before the date you apply. Your supervisor or manager confirms the experience, so the role you describe has to be one somebody else recognises as governance work.

The full list sits on ISACA’s page of CGEIT certification requirements, which also binds every holder to the ISACA Code of Professional Ethics and to the Continuing Professional Education policy: at least 120 CPE hours in each three year reporting period, with a minimum of 20 hours in any single year. Hours that count for another ISACA credential can count here too.

The clocks that run before and after the pass

Registration is continuous, so there is no exam window to wait for. Once you have paid, you can schedule an appointment as early as 48 hours later, and your eligibility to sit the exam lasts six months from registration. Appointments open 90 days in advance, and you can reschedule without penalty as long as you do it at least 48 hours before the booked slot. After a pass, the application clock starts: you have five years to submit the experience application, pay the US$50 fee and receive the designation.

Read together, those rules describe the intended candidate. ISACA expects you to be working in governance already, to sit the exam while you are, and to apply once your years add up. Someone early in their career can pass and bank the result, but the credential itself waits until the experience exists, and the five year application window is the limit on how long it can wait.

What does the CGEIT exam look like?

The CGEIT exam has 150 questions, a duration of 240 minutes and a passing score of 450 out of 800. It costs US$575 for ISACA members and US$760 for non members, and it is delivered at authorised PSI test centres worldwide or as a remotely proctored exam. The figures below come from the EduSum syllabus page and are matched against ISACA’s own CGEIT pages.

Do the arithmetic once and then stop worrying about the clock. Four hours across 150 questions is 96 seconds a question, which is comfortable for a knowledge item and adequate for a scenario that asks which governance action a board should take first. The 450 mark is a scaled score rather than a percentage, so a raw count of correct answers on a practice set does not translate directly into a pass or a fail.

Member or non member

The membership gap on the exam fee alone is US$185. ISACA’s CGEIT certification page also states that members save on CPE, renewals and exam fees across the programme, and that the member only Engage study groups are part of the preparation offer. Whether joining pays for itself depends on how many ISACA credentials you intend to hold, which is a question worth settling before you pay the exam fee rather than after.

Where the exam facts come from

ISACA’s public CGEIT pages display the 150 question count, both exam fees, the US$50 application fee and the registration and scheduling rules. The 240 minute duration and the 450 out of 800 pass mark are published on the EduSum syllabus page and sit in ISACA’s exam candidate guide, which is a downloadable document rather than a web page. Nothing in the two sources disagrees, which is not something every certification can say.

Which four domains does CGEIT test, and why is one worth 40 percent?

CGEIT tests four job practice domains: Governance of Enterprise IT at 40 percent, IT Resources at 15 percent, Benefits Realization at 26 percent and Risk Optimization at 19 percent. The first domain is the largest because it holds the framework itself, the strategy that the framework must serve, and the governance of information as an asset, which are three subjects rather than one.

Forty percent of 150 is 60 questions on Domain 1 alone, and the subtopic list explains why. Sixteen named subtopics sit under three headings, from the components of a governance framework through enterprise architecture to the classification and handling of information. The EduSum page that lists the CGEIT syllabus topics carries the same four headings and the same weightings as ISACA, down to the order of the subtopics, so either source works as a checklist.

Why older guides list five domains

Search for the exam and you will still find pages describing five CGEIT domains: Framework for the Governance of Enterprise IT at 25 percent, Strategic Management at 20, Benefits Realization at 16, Risk Optimization at 24 and Resource Optimization at 15. That was the job practice before July 2020, when ISACA moved to the current four domain outline and added information governance, big data and data privacy to the first domain. Any study material built on the five domain split is describing an exam that no longer exists, and the quickest test of a resource is whether its weights add up to 40, 15, 26 and 19.

Tasks, not just topics

Beneath the subtopics, the official exam content outline publishes a list of supporting tasks, and they are written as actions: establish the objectives for the governance framework, incorporate a strategic planning process, ensure that a business case and benefits realization process exists, establish roles and accountabilities for information assets, evaluate the framework and identify improvements. The questions are built from those verbs. A candidate who can recite the components of a framework but cannot say which one to establish first is studying the topic list and missing the task list.

How does COBIT fit a framework agnostic IT governance certification?

ISACA describes CGEIT as framework agnostic and as the only IT governance certification for the individual, which means the exam does not require COBIT and does not test COBIT process references. COBIT is ISACA’s own governance framework, and its thinking is visible throughout the content outline, but a question is answered from governance principles rather than from a specific framework’s numbering.

The clearest example is in the supporting tasks. Several of them read “evaluate, direct, and monitor”, applied to IT strategic planning and to stakeholder engagement. Those three verbs are the governance cycle that COBIT uses to separate what a board does from what management does: the board evaluates options, directs management, and monitors the result. You can learn that cycle from ISACA’s COBIT framework resources or from any other governance standard that uses the same separation, and the exam will accept either route as long as you can apply it to a scenario.

Framework agnostic in practice

Look at the Risk Strategy subtopic and it says Risk Frameworks and Standards, plural. No subtopic anywhere in the four domains names a single framework. What the exam does assume is that you know what a framework is for: a governance framework defines who decides, who is accountable, how decisions are communicated and how their outcomes are measured. Questions tend to present an enterprise with a gap in one of those four things and ask what the governance body should do about it.

That is also why candidates who arrive from an audit or security background sometimes find the first domain harder than they expected. Their instinct is to look for the control that is missing. CGEIT is asking a different question: whether the structures, roles and strategy exist for the enterprise to make the right technology decisions at all, and whether those decisions are aligned with what the enterprise is trying to achieve.

Benefits Realization and Risk Optimization: the 45 percent candidates underrate

Benefits Realization and Risk Optimization together carry 45 percent of the CGEIT exam, more than Domain 1 on its own. Benefits Realization at 26 percent covers IT performance, governance monitoring and reporting, and the management of IT enabled investments through business cases and benefit evaluation. Risk Optimization at 19 percent covers risk strategy, appetite and tolerance, and the risk management lifecycle.

The business case is a lifecycle, not a document

The supporting task for investments is to ensure that IT enabled investments are managed through their economic lifecycle, and the subtopics underneath are Business Case Development and Evaluation, IT Investment Management and Reporting, Performance Metrics and Benefit Evaluation Methods. In exam terms, a business case that is approved and then filed has failed. Governance expects it to be re-evaluated as the programme runs, with benefits measured against what was promised and the investment stopped or redirected when the numbers no longer hold. Questions in this domain frequently describe a project that is on time and on budget and ask what is still wrong, and the answer is usually that nobody has checked whether the benefits are being realised.

Appetite, tolerance and the standards behind them

Risk appetite is how much risk the enterprise is willing to take in pursuit of its objectives. Risk tolerance is the acceptable variation around that appetite for a specific objective. CGEIT questions test the distinction by giving you a board that has stated one and a management team acting on the other, and asking what the governance body should do. The Risk Frameworks and Standards subtopic sits behind that: enterprise risk management frameworks, and standards such as the NIST Cybersecurity Framework, give an enterprise a shared vocabulary for appetite, tolerance and the risk lifecycle, and the exam expects you to know how a framework is used to align IT risk with enterprise risk rather than to recite any one of them.

The remaining 15 percent, IT Resources, is the domain most often skimmed and the one with the shortest subtopic list: sourcing strategies, capacity planning, acquisition, asset lifecycle, human competency development and the management of contracted services. On a 150 question paper that is still around 22 questions, which is more than enough to decide a result that sits near the 450 line.

Who should take the IT governance certification, and what is it worth?

CGEIT is built for people who already direct, manage or support the governance of IT: IT directors, heads of governance, risk and compliance, enterprise architects with a governance remit, senior consultants and the advisers who report to boards and audit committees. ISACA states that more than 8,000 people have earned CGEIT since its launch in 2007, that 70 percent of holders reported on the job improvement and 22 percent a pay increase, and quotes an average annual salary above US$141,000 for holders.

Those are ISACA’s own figures, so the more useful signal comes from outside the programme. Writing on the ISACA Now blog in March 2026, the chief analyst of Foote Partners reported that CGEIT and CISA posted cash pay premium growth of 11 to 20 percent over the last six months of 2025, against a 6.5 percent average across the certifications his firm tracks, at a time when premiums for many vendor and tool certifications were falling. His explanation turns on exactly the experience rule this article opened with:

“The CISA and CGEIT differ because they are experience-based, requiring demonstrated professional backgrounds in audit, governance and enterprise oversight. That barrier protects their scarcity value in a way that mass-market certifications cannot.”

The same analysis argues that enterprise AI deployment is raising, not lowering, the value of governance roles, because regulators and insurers now ask whether controls over training data, model risk and monitoring are documented and aligned with business objectives. That is a Domain 1 and Domain 4 question in the CGEIT outline, and it is the kind of work the credential is meant to evidence.

CGEIT against CISM, CRISC and CISA

ISACA’s four established credentials divide the same enterprise between them. CISA audits whether systems and controls can be trusted. CISM runs the information security programme. CRISC owns IT risk identification and response. CGEIT sits above all three and asks whether technology is governed so that it delivers value, uses resources well and takes risk the enterprise has agreed to take. If you are weighing the audit and security routes, this site’s CISA and CISM comparison sets out how those two differ in day to day work. CGEIT is the right choice when your job is to shape the decisions those two roles then audit and secure, and the wrong one if you are still building the five years of governance experience that ISACA will ask you to prove.

How should you prepare for the CGEIT exam?

Prepare for CGEIT by confirming your experience against the three of four domain rule first, then learning the four domains from ISACA’s content outline and supporting tasks, reading the official review manual, working the question database until you can justify every answer, and sitting full length timed sets of 150 questions before you schedule. The order matters because the exam rewards judgement built on the task list, not recall of the topic list.

1. Map your own career against the four domains and the ten year window before you pay anything, because the certification needs five years across at least three domains with one year in Governance of Enterprise IT, and a pass you cannot convert within five years is a pass wasted.
2. Read the official exam content outline twice, once for the subtopics and once for the supporting tasks, since the tasks are the verbs the questions are built from.
3. Work through the CGEIT Review Manual, which ISACA sells in print and digital editions, and keep a note of every subtopic you could not explain to a board member in two sentences.
4. Subscribe to the CGEIT Questions, Answers and Explanations database, a six month subscription to a pool of 300 items that ISACA says match the difficulty of the exam, and review the explanation for every wrong answer as well as every right one.
5. Read at least one governance framework end to end, COBIT or an equivalent, so that evaluate, direct and monitor are reflexes rather than vocabulary.
6. Sit full timed sets of 150 questions in 240 minutes, flag anything you are unsure of, and book the exam only when your scores are stable and your weak areas have moved from Domain 1 to wherever is left.

One CGEIT holder who passed by self study, Adham Etoom, described his method on ISACA’s own blog: the review manual twice cover to cover, the question database after the first read, then VAL IT, RISK IT and COBIT, then a second round of questions until the gaps closed. His summary of what the exam asks of a candidate is the best single sentence of advice on it:

“Preparation for CGEIT is all about understanding the big picture and wearing the hat of a senior leader in an enterprise (i.e., CIO).”

That sentence explains most failed attempts. A technically correct answer about a control, a project or a vendor contract is frequently the wrong answer on CGEIT, because the question wanted the governance decision above it. If you want a shorter orientation before you start, this site’s earlier CGEIT overview covers the same four domains at a lighter depth and is a reasonable first read before the content outline.

Two things not to spend time on: memorising framework process numbers, which the exam does not ask for, and any resource that still describes five domains, which is describing the exam as it was before July 2020.

Frequently Asked Questions

How many questions are on the CGEIT exam?

The CGEIT exam has 150 questions with a 240 minute time limit, which works out at 96 seconds a question.

What is the passing score for CGEIT?

The passing score is a scaled 450 out of 800. Because it is scaled, a raw count of correct answers on a practice test does not convert directly into a pass or fail on the real exam.

How much does the CGEIT exam cost?

The exam fee is US$575 for ISACA members and US$760 for non members. After a pass there is a separate one time US$50 application processing fee for the certification itself.

What experience do you need for CGEIT certification?

ISACA requires five or more years of experience managing, advising on or supporting the governance of the IT related contribution to an enterprise, across at least three of the four CGEIT domains, with at least one year related to Domain 1, Governance of Enterprise IT. All of it must fall within the ten years before you apply, and a supervisor or manager verifies it.

Can you take the CGEIT exam before you have the experience?

Yes. The exam is open to anyone with an interest in IT governance. You then have five years from the passing date to submit the certification application with the required experience.

How long is CGEIT valid, and how is it maintained?

CGEIT is maintained through continuing professional education rather than retesting: at least 120 CPE hours in each three year reporting period, with a minimum of 20 hours in any one year, plus adherence to the ISACA Code of Professional Ethics.

Does CGEIT have four domains or five?

Four. Governance of Enterprise IT at 40 percent, IT Resources at 15, Benefits Realization at 26 and Risk Optimization at 19. Pages listing five domains with a 25 percent framework domain describe the job practice ISACA retired in July 2020.

Is CGEIT harder than CISM?

They test different things rather than different difficulty levels. CISM examines how an information security programme is run; CGEIT examines whether technology as a whole is governed to deliver value, use resources well and take agreed risk. Candidates from security backgrounds often find CGEIT’s first domain the harder adjustment because it asks for governance decisions rather than controls.

How do you schedule the CGEIT exam?

Registration is continuous with no fixed exam windows. After paying the exam fee you can schedule a PSI test centre or remote proctored appointment as early as 48 hours later, appointments open 90 days ahead, your eligibility lasts six months, and you can reschedule without penalty up to 48 hours before the slot.

Conclusion

CGEIT is the one ISACA credential where the paper is not the obstacle. Anyone can register, sit 150 questions in 240 minutes and clear the 450 mark; only someone with five verified years of governance work across three of the four domains can turn that pass into the letters, and they have five years to do it.

The exam itself is weighted the way a board thinks. Forty percent on the framework, strategy and information governance that make decisions possible, 45 percent on whether investments deliver value and whether risk stays within appetite, and 15 percent on the resources that carry it all out.

Check your experience against the domains before you pay, learn the content outline by its tasks rather than its topics, practise with the official question database, and book when your timed scores hold. The letters follow the experience, not the other way round.

What does the 1Z0-1110-26 exam look like on paper?

The 1Z0-1110-26 exam has 50 multiple choice questions, a 90 minute time limit, a 68 percent passing score and a price of USD 245, which may vary by country. It is the 2026 release of the Oracle Cloud Infrastructure Data Science Professional exam and replaces the 1Z0-1110-25 code. The 1Z0-1110-24 and 1Z0-1110-23 codes are earlier releases of the same credential.

The arithmetic is worth doing once. Sixty eight percent of 50 is 34, so you can miss 16 questions and still pass. Ninety minutes across 50 questions gives you 108 seconds each, which is generous for a recall item and tight for a scenario that describes a pipeline and asks what breaks it.

If you searched for 1Z0-1110-25 or 1Z0-1110-24 and landed here, you are in the right place. Oracle reissues the code every year, and the syllabus published for the current release is the one to study. The platform itself is described in Oracle’s Data Science service documentation as a fully managed, serverless platform for building, training and managing machine learning models, and that word managed is the key to how the exam is written.

Which five domains does the OCI Data Science Professional syllabus weight?

The OCI Data Science Professional syllabus has five domains. Implement end-to-end Machine Learning Lifecycle carries 45 percent, Apply MLOps Practices 20 percent, Design and set up Data Science Workspace 15 percent, and both OCI Data Science Introduction and Configuration and Use related OCI Services carry 10 percent. On a 50 question paper that is roughly 22 or 23, 10, 7 or 8, 5 and 5 questions.

The question counts are arithmetic from the published weights rather than a published split, so treat them as a planning guide. The shape is what matters. Add up everything that is not the lifecycle domain and you get 55 percent of the paper on configuration, workspace, operations and neighbouring services. A candidate who skips those because they feel like admin work has thrown away more than half the marks before the first modelling question.

The published sample questions show what that looks like in practice. One asks which autoscaling policy type uses CPU utilisation. Another asks the difference between a job and a job run. A third asks which algorithm OCI Vault does not support. Work through a set of 1Z0-1110-26 sample questions before you study anything, and you will see how few of them ask you to reason about a model.

Why is the workspace domain about conda, Vault and Git rather than models?

Design and set up Data Science Workspace is 15 percent of 1Z0-1110-26. It covers four things: creating and managing projects and notebook sessions, creating and managing conda environments, using OCI Vault to store credentials, and configuring source code in Code Repositories with Git. None of them involves a model, and all of them decide whether a model can be built at all.

Projects, notebook sessions and conda environments

A project is the container, and a notebook session is the compute you work in. Oracle describes the session as a JupyterLab based environment, so the interface will be familiar to anyone who has used notebooks elsewhere. If JupyterLab itself is new to you, the Project Jupyter site is the place to learn what a kernel, a cell and a notebook server are before you meet them inside OCI.

Conda environments are how a session gets its Python libraries. The exam expects you to know how to create one, activate it in a session and manage it over time, rather than installing packages ad hoc. The Accelerated Data Science SDK documentation has a whole section on working with conda packs, which tells you how central they are to the way Oracle expects the platform to be used.

Vault and Git are tested on fundamentals

The Vault objective is about keeping credentials out of notebooks. One published sample question asks which of SHA-256, RSA, AES and ECDSA is not a supported encryption algorithm in OCI Vault. The answer is SHA-256, because it is a hash function, not an encryption algorithm. That is the level of the question: understand what the service protects and what the algorithms are for.

The Git objective works the same way. A sample question describes a slow internet connection and asks which two operations would be delayed. Pushing to a remote and pulling from it are the network operations, so they slow down. Committing, staging and turning a local folder into a repository all happen on the notebook’s own storage. If you already use Git daily, this domain is a quick win.

What does the 45 percent machine learning lifecycle domain actually ask?

Implement end-to-end Machine Learning Lifecycle is the largest domain of the OCI Data Science Professional exam at 45 percent, about 22 or 23 questions. Its 14 objectives run from fetching data and profiling it, through training, AutoML, evaluation and explanations, to the Model Catalog and deployment, and finish with four generative AI topics: ADS with OCI Generative AI, LangChain, Operators and AI Quick Actions.

From data source to trained model

The first five objectives are the part a working data scientist already knows: use different data sources to fetch data, explore and prepare it, visualise and profile it, and create and train models with OCI and open source libraries. What the exam adds is the Oracle layer. The ADS SDK documentation covers authentication, conda packs, and running jobs, pipelines and model deployments locally, and those are the mechanics you are expected to recognise.

AutoML, evaluation and explanations

Three objectives sit here: create and use automated machine learning from Oracle AutoML, evaluate models, and obtain global and local model explanations. Global explanations tell you which features drive a model across all its predictions. Local explanations tell you why one particular prediction came out the way it did. Expect to be asked which kind answers which question, not to compute one.

The Model Catalog and deployment

Manage models using the Model Catalog, then deploy and invoke a cataloged model. This is the hinge of the whole exam, because everything in the MLOps domain assumes a model is already in the catalog. The sample questions probe the surrounding details: a model deployed through AI Quick Actions can be invoked through both the API and the CLI, and the outputs of a fine-tuning job land in an OCI Object Storage bucket, not in the catalog and not in the training instance’s local disk.

The generative AI edge

The last four objectives are discussion level: ADS and OCI Generative AI integration, LangChain application deployment to Data Science, Operators, and AI Quick Actions. Generative AI has its own Oracle exam, 1Z0-1127-26, so here the point is to know what each tool does and where its outputs go, not to engineer prompts. Oracle’s documentation defines AI Quick Actions as a set of actions for deploying, evaluating and fine-tuning foundation models from inside a Data Science notebook, starting from an explorer of models Oracle has tested and left unmodified.

“Today, we’re announcing the release of OCI Data Science AI Quick Actions, designed to enable anyone to easily deploy, fine-tune, and evaluate foundation models.”

The AI Quick Actions announcement is worth reading in full for exam purposes. It names the first supported models, recommends at least 100 records for a fine-tuning dataset, and explains that evaluation uses ROUGE and BERTScore. Operators, meanwhile, are the low code side of ADS: forecasting and anomaly detection driven by a configuration file rather than a training script.

How does MLOps show up in the exam?

Apply MLOps Practices is 20 percent of 1Z0-1110-26, about 10 questions. The objectives are the OCI MLOps architecture, creating and managing Jobs for custom tasks, scaling with OCI Data Science, autoscaling model deployments for inference, monitoring and logging with MLOps practices, and using Pipelines to automate the machine learning workflow. This is where a model stops being a notebook and becomes a service.

Jobs and job runs

The distinction the exam likes is simple once stated. A job is a template that describes a task, its code and its compute. A job run is a single execution of that template. You can run the same job many times with different arguments, which is how a training script becomes something scheduled rather than something a person clicks.

Pipelines and step dependencies

Oracle’s documentation describes a pipeline as a resource that defines a workflow of steps, where steps can depend on other steps and can run in sequence or in parallel as long as they form a directed acyclic graph. Each step is discrete, so one pipeline can mix different environments and even different languages. A sample question asks how to make sure data processing happens before training, and the answer is to set a dependency between the steps. The Pipelines documentation lays out the typical sequence of import, transform, train and evaluate.

Autoscaling, monitoring and logging

Autoscaling a model deployment means the inference endpoint adds or removes capacity on a metric. The sample question on this objective asks which policy type a team should configure to scale on CPU utilisation, and the answer is a predefined metric policy rather than a custom one. Know the difference between the two and when you would write your own metric.

Monitoring and logging are a discipline of their own in OCI, and the overlap with this objective is real. The OCI Observability Professional exam article on this site goes deep on the Logging and Monitoring services that a deployed model reports into. For this exam, you need the MLOps view: what to log from a job or a deployment, and how to notice that a model in production has drifted.

Which related OCI services make up the last 10 percent?

Use related OCI Services is the final 10 percent of the OCI Data Science Professional syllabus, about 5 questions. It names three services: creating and managing Spark applications with Data Flow from OCI Data Science, describing the OCI Open Data Service, and creating and exporting a dataset with OCI Data Labeling. Each one sits at a boundary of the data science service rather than inside it.

• Data Flow runs Spark applications, and a notebook session can connect to it when a dataset is too large for the session itself.
• Open Data is a dataset repository built for people who create, use and manipulate datasets, and each dataset comes with code and tooling examples so it can be consumed and reproduced.
• Data Labeling annotates data for supervised learning, and the published sample question makes the scope precise: purchase orders, a typed budget document and images of server racks can be annotated, while an audio recording and video footage cannot.

Five questions is not many, but these are the easiest marks on the paper to lose by omission. Nobody fails to revise the lifecycle domain. Plenty of candidates never open Data Labeling, then meet a question that asks which three file types it can annotate.

Who is the OCI Data Science Professional credential written for?

The OCI Data Science Professional credential is written for people who build and run machine learning on Oracle Cloud Infrastructure: data scientists working in Python and open source libraries, machine learning engineers who deploy and monitor models, and OCI engineers asked to configure a tenancy for a data science team. The syllabus says it expects some experience or exposure to OCI, not just to data science.

That last group is easy to overlook. The 10 percent Introduction and Configuration domain covers the service overview, the capabilities of the ADS SDK, and configuring a tenancy for Data Science. One sample question asks which resource types the default matching rules of the Data Science service template include, and the answer names model deployments, notebook sessions and job runs. That is an identity and policy question, and it lands on the person who owns the tenancy.

Oracle’s own description of the OCI Data Science platform sets the scope well: teams of data scientists using Python and open source tools, a JupyterLab environment, NVIDIA GPUs and distributed training for scale, and MLOps capabilities such as automated pipelines, model deployments and model monitoring. Every phrase in that sentence maps to a domain above.

The credential has been reissued every year since at least the 2023 release. This site’s earlier 1Z0-1110-23 preparation guide describes that release as a 55 question paper, and the generative AI objectives did not exist in it. The current 50 question syllabus is the one to work from, and anything written for an older code should be read with that in mind.

How should you prepare for 1Z0-1110-26?

Prepare for 1Z0-1110-26 by spending your time in proportion to the weights: close to half on the machine learning lifecycle, a fifth on MLOps, and the remaining third on workspace setup, tenancy configuration and the related services. Do all of it inside a real OCI tenancy, because the exam asks what the platform does, and that is learned by using it rather than reading about it.

1. Read the five domains and write the question arithmetic next to each, so you plan for roughly 22 lifecycle questions against 5 on tenancy configuration.
2. Configure a tenancy for Data Science, then create a project, a notebook session and a conda environment, because the workspace and configuration domains are 25 percent of the paper and cannot be learned from a slide.
3. Take one small dataset through the whole lifecycle in a notebook: fetch it, profile it, train with an open source library and with AutoML, evaluate it, generate global and local explanations, and save the model to the Model Catalog.
4. Deploy that cataloged model and invoke it, then rebuild the same work as a Job and as a Pipeline with a dependency between the processing step and the training step.
5. Visit the edges: connect a notebook to Data Flow, open a dataset from Open Data, label a handful of documents in Data Labeling, and open AI Quick Actions to see what a deployed foundation model looks like.
6. Finish with timed sets of 50 questions in 90 minutes, and book the exam when you are comfortably above 34 correct.

Two habits pay off during that sequence. Keep a note of every OCI resource name you meet, because the exam uses the platform’s vocabulary and expects you to match it. And read the answer options as a systems engineer would, asking where an output is stored, which service is doing the work and which policy allows it, since that is how most of the platform questions are built.

Frequently Asked Questions

How many questions are on the 1Z0-1110-26 exam?

The 1Z0-1110-26 exam has 50 multiple choice questions with a 90 minute time limit, which works out at 108 seconds per question.

What is the passing score for the OCI Data Science Professional exam?

The passing score is 68 percent. On a 50 question paper that means 34 correct answers, so you can miss 16 questions and still pass.

How much does the 1Z0-1110-26 exam cost?

The exam costs USD 245. Oracle notes that the price may vary by country or by localised currency, so check the figure shown at booking.

Is 1Z0-1110-26 the same exam as 1Z0-1110-25?

They are annual releases of the same credential. 1Z0-1110-26 is the 2026 release and replaces the 1Z0-1110-25 code, with 1Z0-1110-24 and 1Z0-1110-23 before it. Study the syllabus published for the current code.

Which domain is the largest on the OCI Data Science Professional exam?

Implement end-to-end Machine Learning Lifecycle is the largest domain at 45 percent, about 22 or 23 of the 50 questions. Apply MLOps Practices is next at 20 percent.

Does the OCI Data Science Professional exam cover generative AI?

Yes, as four objectives inside the lifecycle domain: ADS and OCI Generative AI integration, LangChain application deployment, Operators, and AI Quick Actions. They are discussion level topics, not prompt engineering.

What is the difference between a job and a job run in OCI Data Science?

A job is a template that defines a task, its code and its compute. A job run is a single execution of that template, and one job can have many runs.

Where can I find OCI Data Science Professional sample questions?

DBExam publishes a free set of ten sample questions with answers for 1Z0-1110-26, covering Open Data, autoscaling, Vault, pipelines, Git, jobs, tenancy templates, Data Labeling and AI Quick Actions.

How long is the OCI Data Science Professional certification valid?

The syllabus published for 1Z0-1110-26 does not state a validity period. Confirm the current renewal terms on Oracle’s certification portal before you plan a recertification date, rather than relying on a third party figure.

Conclusion

The wrong assumption is the expensive one. Candidates who treat 1Z0-1110-26 as a modelling exam revise the part they already know and leave 55 percent of the paper to chance. The syllabus is clear that the OCI Data Science Professional credential measures whether you can set up, run and operate machine learning on the platform: tenancy, workspace, catalog, deployment, jobs, pipelines and the services at the edges.

The numbers give you the plan. Fifty questions, 90 minutes, 34 to pass, with 45 percent on the lifecycle and 20 percent on MLOps. Build one model end to end inside a real tenancy, deploy it, automate it, and visit Data Flow, Open Data and Data Labeling before exam day. Then sit the sample questions on DBExam, and book when your timed scores sit well above the pass mark.

Why does NS0-604 require a hyperscaler certification first?

NetApp requires proof of at least one hyperscaler certification before you can take NS0-604, the NetApp Certified Hybrid Cloud Architect exam. The accepted exams are AWS SAA-C03, Microsoft AZ-104, Microsoft AZ-305 and the Google Associate Cloud Engineer. The exam tests your ability to analyze, position and design NetApp hybrid cloud solutions on one of those three public clouds, so NetApp wants the cloud half proven in advance.

You need one of the four, not all of them. Pick the cloud your employer actually runs, because the design scenarios on the exam let you reason from any of the three providers and your answers will be sharper on the one you know.

What NetApp recommends but does not require

The official credential page also lists the NetApp Hybrid Cloud Administrator exam, NS0-305, as highly recommended, along with fundamental NetApp knowledge and NetApp courses. Two low cost accreditation exams, NetApp Cloud Native Associate and NetApp Hybrid Cloud Associate, are suggested as warm ups. None of these is a gate. The hyperscaler certification is.

The task list on the NetApp credential page reads like an architect’s job description rather than an administrator’s: determine business requirements, architect and position a solution, document it, run a proof of concept, support customer success and future proof the design. That is the person NS0-604 is written for, and it explains why the questions are scenarios rather than command syntax.

What does the NetApp Certified Hybrid Cloud Architect exam look like?

NS0-604 has 60 questions in 120 minutes with an 80 percent passing score, delivered through Pearson VUE. NetApp’s price list since 1 May 2025 sets certification exams at 200 USD and Expert level exams at 250 USD, and NetApp places Hybrid Cloud Architect at the Expert level of its Hybrid Cloud path. The credential stays active for 24 months once earned.

Do the arithmetic before you book. Eighty percent of 60 is 48 correct answers, which leaves you 12 misses. Two hours across 60 questions is two minutes each, which is generous for a fact and tight for a scenario that asks you to compare three placement options. Most candidates find the time is fine and the 80 percent bar is the real obstacle.

Retakes and the account you need first

NetApp’s retake rules are stated on its certification policies page. A first failure can be retaken straight away. After further failures you wait 14 days. After a pass you wait 12 months before sitting the same exam again. One practical detail catches people out: every NetApp exam needs a NetApp account, and a new account takes between 4 and 24 hours to create, so set it up before you try to schedule.

Which eight domains does NS0-604 test, and why are there no weightings?

NS0-604 covers eight domains: Customer Requirements, NetApp Hybrid Cloud Solutions, Hybrid Cloud Architecture, Business Continuity and Data Protection, Networking, Sizing and Scale, Security, and Monitoring. Neither NetApp nor the NWExam syllabus page publishes a percentage for any of them. You plan by objective, not by weight, and there are only 15 objectives in total.

Without weightings, the only safe assumption is that every domain can appear and none can be skipped. If you lose half the marks in any two domains, you have probably spent your 12 misses. The third column above is not published by NetApp. It comes from reading the objectives against the shape of the questions, and the quickest way to calibrate that yourself is to work through a set of NS0-604 sample questions before you study, so you can see which objective each scenario is really testing.

Notice what the objectives do not say. There is no ONTAP command line, no SnapMirror configuration syntax, no cluster setup. Those belong to the administrator and implementation exams lower in the path. Here the verbs are position, design and consider.

How does the NetApp Console change the architecture questions?

The Hybrid Cloud Architecture and Security domains of NS0-604 revolve around the NetApp Console, the control plane NetApp formerly called BlueXP, and the agent it deploys into each environment. NetApp’s documentation now calls that agent the Console agent; older material, including the sample questions, still calls it the Connector. Both names refer to the same component, and the exam expects you to know what it does and does not touch.

Control plane and data path are separate

The design point that keeps recurring is separation. The Console orchestrates provisioning and lifecycle actions. Client reads and writes go directly to the storage service and never pass through the Console or its agent. A candidate who believes the agent proxies application traffic will get the placement, the security and the availability questions wrong in one go, because all three follow from that separation.

NetApp’s own description of the Console agent architecture makes the boundaries explicit: the agent is a lightweight component installed in your network, it initiates every connection to the Console rather than the other way round, it uses TLS 1.3, and it acts on cloud resources using only the permissions it has been granted.

One agent per environment

Placement follows from permissions. When a design spans two public clouds, the expected answer is an agent aligned to each cloud, holding locally scoped permissions and the network reachability that cloud needs. Routing every cloud’s control operations through one central agent, or embedding the agent inside a volume, are the distractors, and they read as plausible until you remember the permission boundary.

The Monitoring domain sits on the same platform. When a scenario asks for one service that ingests telemetry from on-premises systems and several public clouds and correlates resource relationships across all of them, it is describing the observability service in the Cloud Controls portfolio rather than the health and risk telemetry of the support tooling, and the difference between those two is exactly what the question is checking.

Designing for availability and durability: what NS0-604 expects

The Business Continuity and Data Protection domain of NS0-604 has two objectives, designing for availability and designing for durability, and the exam treats them as different problems. Availability is about surviving the loss of a zone or a region while still serving. Durability is about keeping a restorable copy that survives an attacker with administrative credentials. A single mechanism rarely covers both.

Zones for local resilience, replication for the region

The canonical availability design is a file service deployed across availability zones in the primary region, replicated with SnapMirror to a second region. Two instances in the same zone do not survive a zone loss. Two regions with no replication relationship do not survive anything, because nothing moves the data. Expect the wrong answers to be built from exactly those two mistakes.

Cascade or fan-out

When one dataset must feed a disaster recovery replica in a second region and a reporting copy in a third, the choice is between a fan-out, where the primary sends to both destinations over separate wide-area links, and a cascade, where the primary replicates once to the second region and that copy forwards to the third. If the requirement is to carry the source across the wide-area link only once, the cascade is the answer. Fan-out is not wrong in general, it is wrong for that requirement, and reading the requirement is the skill.

Three requirements, three mechanisms

A favourite question shape gives you three needs for one volume and asks you to map a mechanism to each:

• Same-day rollback of accidental edits: local snapshots on the source.
• A cross-region copy for site loss: SnapMirror replication.
• Restorable copies kept for ninety days on independent storage: backup and recovery to an object store.

The trap is the answer that uses one mechanism for all three, or swaps the roles around. Snapshots on the same storage do not survive a site loss, and a replica is not a ninety day retention policy.

Ransomware changes the durability question

Following a ransomware tabletop exercise, the design has to guarantee a clean copy even when the attacker holds primary administrator credentials. Three design choices meaningfully improve recoverability: enough historical restore points to go back to before the encryption started, an independent backup copy in an object store whose deletion authority is separated from the primary administrators, and at least one immutable copy that cannot be altered or deleted during its retention period. Anything that consolidates copies or widens delete rights makes the position worse.

How do networking and private connectivity show up on the exam?

The Networking domain of NS0-604 tests two things: the network requirements NetApp hybrid cloud services impose, and the topologies used to connect on-premises systems to the cloud. In practice that means hub and spoke behaviour inside a cloud and the choice between a VPN over the internet and a dedicated private circuit between sites.

The hub and spoke question is the one most people get wrong on first sight. Spoke A is peered to a hub, spoke B is peered to the same hub, both peerings are healthy, and hosts in A still cannot reach hosts in B. The reason is that peering is non-transitive. Traffic from A to B does not flow through the hub by default, and the fix is a transit gateway or hub transit rather than a security group change or a public-facing hub.

The private connectivity question is about predictability. A financial customer replicating continuously from on-premises ONTAP to a cloud file service wants low, consistent latency and dedicated throughput unaffected by internet congestion, and accepts the lead time of a physical circuit. A site-to-site VPN encrypts the traffic but still rides the public internet. A private endpoint keeps the address private but not the path. The dedicated circuit, Direct Connect on AWS or ExpressRoute on Azure, is what the requirement describes.

Why the definition matters

Every one of those scenarios is a hybrid cloud in the sense the NIST definition uses, and the wording is worth having in your head because the Customer Requirements domain asks you to talk about cloud solutions in general before it asks about NetApp’s. NIST’s definition of cloud computing puts it this way:

“The cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load balancing between clouds).”

The phrase to hold on to is bound together by technology that enables portability. On this exam, SnapMirror, the Console agent and the private circuit are that technology, and the questions are about choosing the right one for the requirement in front of you.

Where does NS0-604 sit in NetApp’s Hybrid Cloud path?

NetApp’s certification catalogue places the Hybrid Cloud Architect at the Expert level, the top of a Hybrid Cloud path that runs through Technology Solutions Professional, Data Administrator ONTAP, Hybrid Cloud Administrator, StorageGRID Administration and Hybrid Cloud Implementation Engineer. NS0-604 is the only exam in that path with a prerequisite from another vendor, and the only one at the Expert tier.

The path is a recommendation, not a ladder you must climb rung by rung. NetApp does not require the Administrator or Implementation Engineer credentials before the Architect exam. It does say the Administrator exam is highly recommended, and there is a good reason: the Administrator syllabus is where you learn what the services do, while the Architect syllabus assumes you know and asks where to put them. If you are weighing the two, this site’s guide to the NS0-305 Administrator exam shows how much lower the design content sits at that level.

Why the architect role is in demand now

NetApp is a Leader in the 2026 Gartner Magic Quadrant for Enterprise Storage Platforms and ranked first for the Hybrid Cloud Storage use case in the 2026 Gartner Critical Capabilities report, a position NetApp attributes to native storage services across all three major public clouds. Writing about that result on the NetApp Platform blog, the head of NetApp’s platform engineering organisation described what customers are asking for:

“customers today want their hybrid, often multicloud storage to function as one unified platform, with a consistent operating model across data infrastructure, managed and protected via a single interface”

That sentence is the Architect exam in miniature. One platform across clouds is Domain 2. A consistent operating model is Domain 3. Managed and protected through a single interface is the Console and the Security and Monitoring domains. The person who can design that is the person NS0-604 certifies.

How should you prepare for the NetApp Certified Hybrid Cloud Architect exam?

Prepare for NS0-604 in the order NetApp’s own requirements imply: secure the hyperscaler prerequisite first, learn the NetApp services as an administrator would, then practise design decisions by objective across all eight domains until you can defend a placement, a replication topology and a connectivity choice from the requirement alone. Book when timed practice sits comfortably above 48 out of 60.

1. Confirm you hold one of SAA-C03, AZ-104, AZ-305 or Google ACE, and pass it first if you do not, because NetApp will not register you for NS0-604 without it.
2. Work through the Hybrid Cloud Administrator material, or sit NS0-305, so that every service in the Cloud Storage, Cloud Services and Cloud Controls portfolios is familiar before you are asked to position one.
3. Write the 15 objectives down and rate yourself on each, since NetApp publishes no weightings and any of them can carry a question.
4. Study the NetApp Console and its agent until the control plane and data path separation is second nature, and learn the current names alongside the older BlueXP and Connector terms.
5. Practise the protection designs on paper: zones plus a replicated region, cascade against fan-out, snapshot against SnapMirror against backup, and the three ransomware safeguards.
6. Sit timed sets of 60 questions in 120 minutes and stop booking only when you are consistently above 48 correct.

The older resource pages on this site are still useful for the topic map. The NS0-604 essential topics page lists the same eight domains and links out to practice material, and it makes a reasonable checklist to work down once you have the prerequisite and the administrator knowledge in place.

Two things not to spend time on: memorising ONTAP command syntax, which this exam does not test, and hunting for domain percentages, which do not exist. Every hour spent there is an hour not spent on the design decisions the paper is actually made of.

Frequently Asked Questions

How many questions are on the NS0-604 exam?

NS0-604 has 60 questions and a 120 minute time limit, which works out at two minutes per question.

What is the passing score for the NetApp Certified Hybrid Cloud Architect exam?

The passing score is 80 percent. On 60 questions that means 48 correct answers, so you can miss 12.

Do I need another certification before NS0-604?

Yes. NetApp requires proof of at least one of AWS SAA-C03, Microsoft AZ-104, Microsoft AZ-305 or the Google Associate Cloud Engineer before you can take the exam. The NetApp Hybrid Cloud Administrator exam, NS0-305, is highly recommended but not required.

How much does the NS0-604 exam cost?

NetApp’s price list since 1 May 2025 sets certification exams at 200 USD and Expert level exams at 250 USD, and NetApp lists Hybrid Cloud Architect at the Expert level of its Hybrid Cloud path. The fee shown when you register at Pearson VUE is the one that applies.

Does NetApp publish weightings for the NS0-604 domains?

No. Both NetApp and the NWExam syllabus page list eight domains with their objectives and no percentages. Plan by objective and treat every domain as examinable.

How long is the NetApp Certified Hybrid Cloud Architect certification valid?

NetApp certifications are active for 24 months once earned. After a pass you must wait 12 months before retaking the same exam.

What is the retake policy if I fail NS0-604?

A first failure can be retaken immediately. After multiple failures you must wait 14 days between attempts.

Is NS0-604 the current NetApp Hybrid Cloud Architect exam?

Yes. NS0-604 replaced the earlier NS0-603, and NetApp’s catalogue lists the Hybrid Cloud Architect credential as active at the Expert level with no retirement notice.

What is the difference between the NetApp Console and BlueXP?

They are the same product. NetApp renamed BlueXP to NetApp Console, and the Connector component is now called the Console agent. Older study material and sample questions still use the earlier names.

Conclusion

The prerequisite is the point. NetApp Certified Hybrid Cloud Architect is the one NetApp credential that starts with another vendor’s exam, because the paper assumes the cloud and tests the design: where the Console agent sits, how a file service survives a zone and then a region, when a cascade beats a fan-out, and why a private circuit rather than a VPN answers a latency requirement.

The numbers are simple. NS0-604 is 60 questions in 120 minutes at an 80 percent bar, eight domains with no weightings, 24 months of validity, and a fee set by NetApp’s Expert tier price list rather than the older figure still circulating.

Hold the hyperscaler certification, learn the services as an administrator, then practise the design decisions until you can name the objective behind every scenario. When your timed scores stay above 48, schedule the exam.

What are the UiAAP exam facts?

The UiAAP exam has 60 questions in 120 minutes, a 70 percent passing score and a fee of 300 USD. Pearson VUE delivers it at a test centre or online with a proctor. UiPath registers it under the exam number UiPath-AAPv1, and the credential stays valid for 3 years from the date you earn it.

Two pieces of arithmetic follow from those figures. First, 70 percent of 60 is 42, so you can miss 18 questions and still pass. Second, 120 minutes across 60 questions gives you 2 minutes each. That is a comfortable pace for a recall question and a tight one for a scenario that asks you to read a process, a prompt and an evaluation result before you answer.

The format line matters as well. Sequencing items ask you to put steps in the right order, which rewards people who have actually configured an index or an escalation. Reading about the steps is rarely enough to order them correctly.

UiPath does not weight the 14 topics, so you cannot plan by percentage. The only reliable guide to depth is the objective list itself, which UiPath publishes in the official exam description. The rest of this article uses that list, because it is where the two tiers visibly separate.

How is the Professional tier different from the Associate?

UiAAP doubles the Associate fee, adds 30 minutes, and keeps the same 60 questions and 70 percent pass mark. The larger change is scope. The Associate syllabus lists 32 objectives across 10 topics, while the Professional syllabus lists 84 across 14, and UiPath aims it at the people who deliver agentic solutions.

Same topics, different verbs

Nine topic names carry over from one tier to the next, which is why the two exams look alike at first glance. The objectives under them do not. Associate objectives mostly ask you to define, describe and differentiate. Professional objectives ask you to configure, implement, monitor and troubleshoot. Context Grounding shows the shift clearly: 2 objectives at Associate level, 8 at Professional, including index update strategy and threshold tuning.

A narrower audience

UiPath describes the Associate as suited to both technical and non-technical roles, from business analysts to project managers. The Professional exam names four groups only: automation developers, solution architects, technical leads, and Center of Excellence members who deliver agentic automation. The candidate UiPath has in mind can design, build, orchestrate and govern a solution independently.

Do you need the Associate first?

The Associate exam description states that it has no prerequisite. The Professional exam description names no prerequisite exam either. Even so, the Professional syllabus assumes everything the Associate teaches, so most candidates will want that ground covered before they book.

The quickest way to feel the difference is to read a set of UiAAP sample questions next to the syllabus. They ask how to find the root cause of a failed evaluation, what a low trajectory score means when the final answer looks fine, and what an inclusive gateway does in a Maestro flow. None of those can be answered from a definition.

Which topics are new at Professional level?

Five topics appear on the UiAAP syllabus that the Associate syllabus does not list: Agent management, AI Trust Layer, Coded Agents, Conversational Agents and UI Agent. Together they hold 13 objectives. They move the exam past building a single agent and into governing, monitoring and extending agents across a whole tenant.

Agent management

This is the largest of the five, with 7 objectives. You apply governance policies that enable, disable or control agent functionality, and you assign them at tenant, group or user level. You also use agent scores to track performance, analyse trace data, and monitor usage, unit consumption and incidents. Simulations of agent tools and Context Grounding sit here too.

AI Trust Layer

Three objectives cover the controls that sit between an agent and a language model:

• Bringing your own model through the LLM gateway
• Using the audit and usage summary
• Masking personal data in flight before it reaches a model

Coded, conversational and UI agents

Each of these three topics has a single objective, and the syllabus gives no more detail than the name. Coded Agents covers agents written in code. Conversational Agents covers chat based agents. UI Agent refers to ScreenPlay. With so little published, the UiPath Agents documentation is the safest place to learn what each one does.

New objectives inside familiar topics

Some of the sharpest additions hide under topic names you already know. UiPath Platform components and integrations grows from 4 objectives to 11. The new ones include building API workflows as reusable agent tools, exposing existing agents for reuse inside new agents, using agent tool guardrails, and integrating MCP assets as tools. MCP is an open standard for connecting models to tools and data, and the Model Context Protocol specification explains the client and server roles behind it.

Why do evaluations and Maestro carry so many objectives?

Agentic evaluations and agentic orchestration with UiPath Maestro hold 14 and 16 objectives on the UiAAP syllabus, 30 of 84 in total. UiPath publishes no topic weightings, so these counts show breadth of content and not a share of questions. Even so, no other pair of topics asks you to know as much.

Notice the first row. The concepts topic shrinks from 6 objectives to 3, because the Professional exam stops asking what machine learning and large language models are. It assumes you know.

What the evaluation objectives cover

At Associate level you define evaluations and tell deterministic ones from model graded ones. At Professional level you run the whole cycle. You design datasets that reflect real complexity, write input and output pairs, add edge cases and failure scenarios, and choose between strict and flexible assertions. Then you execute the set, interpret the scores, read execution traces for the failures, and improve the prompt.

UiPath has been open about why this matters to it.

“We are targeting 95%+ agent accuracy with every launch.”

Developers share the concern behind that target. In the Stack Overflow Developer Survey for 2025, 87 percent of respondents agreed that they are concerned about the accuracy of information from AI agents, and 81 percent agreed that they have security and privacy concerns. Evaluations, guardrails and escalations are the practical answer, which explains their place on the syllabus.

What the Maestro objectives cover

The Associate touches Maestro in 3 objectives: model a process in BPMN and configure service tasks. The Professional list runs to 16. It adds send and receive tasks for connectors and webhooks, global, local and task level variables, and input and output mapping between tasks and agents. It also covers chaining several agents in one process, asynchronous completion events, user tasks with assignees, SLAs and expiry rules, control flow, and instance management.

Where does the Builder Professional certification fit?

Agentic Automation Builder Professional is a separate UiPath credential that launched on 22 September 2026 under the exam number UiPath-AABPv1. It sits in the same Agentic Automation track as UiAAP, runs 120 minutes with a 70 percent pass mark, and costs 150 USD. UiPath has published no statement that it replaces Agentic Automation Professional.

What Builder Professional adds

The Builder exam reaches into areas UiAAP does not name. It has a full domain on deterministic automation, which covers variables, control flow, UI automation and exception handling. It has another on UiPath for Coding Agents. Its agent domain includes building Python agents, and its orchestration domain includes case management. UiPath also states an experience level for it: at least 6 months of building automations on the platform.

That deterministic domain overlaps with the developer track. If classic workflow skills are your weak point, this site’s UiADP preparation guide covers the same foundations in more depth.

What UiAAP keeps to itself

UiAAP stays closer to the agent itself. Its objectives go deeper on Context Grounding indexes, on evaluation datasets and assertions, and on the detail of Maestro tasks. Both credentials are currently listed side by side on the UiPath Academy certification page. Because the Builder exam is so new, check that listing on the day you book. If UiPath changes the status of either exam, that page is where it will show first.

How should you prepare for UiAAP?

Prepare for UiAAP by working outward from the official exam description. UiPath names three resources: the Agentic Automation Training learning plan on UiPath Academy, the product documentation, and a free practice test. Candidates on the UiPath forum report that the learning plan covers Associate level material, so the documentation has to fill the gap.

1. Download the exam description, and mark every objective you cannot already carry out in a tenant.
2. Complete the Agentic Automation Training learning plan, and treat it as the base layer.
3. Read the product documentation for the five topics the Associate syllabus does not list.
4. Build one agent in Studio Web with a tool, a Context Grounding index and an escalation.
5. Write an evaluation set for that agent, run it, and trace every failure back to its cause.
6. Model a small Maestro process that calls the agent, routes a user task to a person, and returns the data.
7. Take the free practice test, and review each missed question against the objective it came from.

Steps 4 to 6 are where the exam is won. Sequencing questions and scenario questions both reward people who have watched an evaluation fail and worked out why. One forum member who passed in the first week after launch described a shorter version of the same order: the Associate training, then the exam description, then the practice test.

Booking and retakes

You schedule through the Pearson VUE UiPath page, and you choose between a test centre and an online appointment. If you fail the first attempt, UiPath asks you to wait two weeks before the second. After that, the wait is one month between attempts, and each attempt carries the full fee.

If you are still deciding which UiPath credential suits your role, the overview of UiPath certification paths on this site sets the agentic exams beside the developer, analyst and architect tracks.

Frequently Asked Questions

How many questions are on the UiAAP exam?

The UiAAP exam has 60 questions to answer in 120 minutes, which works out at 2 minutes per question. The format is multiple choice with drag and drop or sequencing items.

What is the passing score for UiAAP?

The passing score is 70 percent. On 60 questions that means 42 correct answers, so you can miss 18 and still pass.

How much does the Agentic Automation Professional exam cost?

The exam fee is 300 USD, which is double the 150 USD fee for the Agentic Automation Associate exam. Each retake carries the full fee again.

Is UiAAP the same exam as UiPath-AAPv1?

Yes. UiAAP is the short code used for the credential, while UiPath and Pearson VUE list the exam as UiPath-AAPv1, the UiPath Agentic Automation Professional Exam. Look for that number when you book.

Do I need the Associate certification before UiAAP?

The Professional exam description names no prerequisite exam. The syllabus does assume Associate level knowledge, so covering that material first is sensible even though UiPath does not list it as a requirement.

Which topics are new in the Professional exam?

Five topics are not on the Associate syllabus: Agent management, AI Trust Layer, Coded Agents, Conversational Agents and UI Agent. Together they list 13 objectives.

How long is the UiAAP certification valid?

The credential is valid for 3 years from the date you earn it. UiPath expects certified professionals to recertify every three years to keep pace with platform changes.

In which languages can I take the UiAAP exam?

UiPath offers the Agentic Automation Professional exam in English and in Japanese. You can sit it at a Pearson VUE test centre or online with a proctor.

Has Builder Professional replaced Agentic Automation Professional?

UiPath has published no statement saying so. Builder Professional launched on 22 September 2026 as a separate credential in the same track, and both are listed on the UiPath Academy certification page. Check that page before you book.

Conclusion

UiAAP is 60 questions in 120 minutes at a 70 percent pass mark, for a fee of 300 USD. Those numbers look close to the Associate exam, and that closeness is what misleads people.

The real distance is in the objective list: 84 against 32, five topics the Associate never mentions, and 30 objectives on evaluations and Maestro alone. The exam is about proving, orchestrating and governing agents, with building them as the starting point.

So prepare in that order. Build one agent, test it until you understand its failures, and place it in a Maestro process with a person in the loop. Then check which agentic credentials UiPath lists on the day you book, and choose the one that matches the work you do.

What changed between SCS-C02 and SCS-C03?

SCS-C03 keeps six domains but reshapes them. AWS split the old threat detection, incident response, logging and monitoring material into two cleaner domains called Detection and Incident Response, raised Identity and Access Management from 16 to 20 percent, cut Infrastructure Security from 20 to 18 percent, and renamed the governance domain Security Foundations and Governance.

AWS sets the two blueprints side by side in its SCS-C02 and SCS-C03 comparison, which states that SCS-C02 was in use until 1 December 2025 and SCS-C03 from the following day.

The first two domains were rebuilt, not renamed

Do not read the first two rows as a simple swap. Under SCS-C02, logging sat in its own domain and detection shared a domain with response. Under SCS-C03, monitoring, alerting and logging all live in Detection, while planning for and responding to an event live in Incident Response. Together the pair still carries 30 percent. The old pair carried 32.

Identity is now the heaviest domain

Infrastructure Security used to lead at 20 percent. Identity and Access Management now holds that position, and it is the only domain that gained four points. Data Protection and governance kept their weights exactly.

“To better serve security professionals, we’ve restructured the exam domains, creating distinct sections for Detection and Incident Response capabilities.”

What does the SCS-C03 exam look like on the day?

The SCS-C03 exam has 65 questions and lasts 170 minutes. It costs 300 USD and the minimum passing score is 750 on a scale of 100 to 1,000. Only 50 of the 65 questions affect your score. The other 15 are unscored items that AWS is trialling, and they are not identified on the exam.

How the score works

AWS uses a compensatory scoring model. That means you do not need to pass each domain separately, only the exam as a whole, so a strong identity score can cover a weaker incident response score. Unanswered questions count as incorrect and there is no penalty for guessing. Never leave a question blank.

Question types

The exam guide lists four response types:

• Multiple choice, with one correct response and three distractors.
• Multiple response, with two or more correct responses out of five or more options.
• Ordering, where you pick 3 to 5 responses and place them in the correct order.
• Matching, where you pair responses with a list of 3 to 7 prompts.

Ordering and matching give no partial credit. Every position or pair must be right. On pacing, 170 minutes across 65 questions is a little over two and a half minutes each, which sounds generous until you meet a question built around an IAM policy document. Working a set of SCS-C03 sample questions early shows you how long those scenario items really take to read.

Which topics are new in SCS-C03?

AWS added seven items to SCS-C03. They cover validating findings during an incident, integrating edge services with third-party tools, guardrails for generative AI applications, encryption in transit between resources, imported key material, masking sensitive data, and managing keys and certificates across Regions. Four of the seven sit in the Data Protection domain.

Generative AI guardrails

This is the addition that gets the attention. The blueprint gives one example for it: applying the protections in the OWASP LLM Top 10. The 2025 edition of that list opens with prompt injection and sensitive information disclosure, and also covers supply chain risk and excessive agency. Keep it in proportion, though. It is one task inside an 18 percent domain, and training machine learning models is explicitly out of scope for the target candidate.

OCSF and third-party edge tools

Task 3.1.4 names the Open Cybersecurity Schema Framework as its example, alongside third-party WAF rules. OCSF is an open, vendor-neutral format for security events, and the OCSF schema project publishes it in the open. Amazon Security Lake, which the Detection domain also names, is the service where candidates usually meet it.

Keys, masking and multi-Region

The Data Protection additions are practical. You should be able to explain how imported key material differs from key material that AWS KMS generates, mask sensitive values with CloudWatch Logs data protection policies or Amazon SNS message data protection, and manage customer managed keys and AWS Private Certificate Authority across Regions. Inter-node encryption for Amazon EMR, Amazon EKS and SageMaker AI is named as well.

What did AWS remove from the exam?

AWS removed a set of fundamentals and older references from SCS-C03. The published deletions include TCP/IP networking concepts, host-based security, the components of an IAM policy, TLS concepts, the AWS Security Finding Format, the AWS Security Incident Response Guide, log format and components, and configuring S3 static website hosting.

The full list of published deletions, grouped by the SCS-C02 task each one came from:

• Task 1.1: AWS Security Finding Format (ASFF).
• Task 1.3: the AWS Security Incident Response Guide.
• Task 2.5: log format and components, such as CloudTrail logs.
• Task 3.3: host-based security and activating host-based firewalls.
• Task 3.4: analysing reachability, fundamental TCP/IP networking concepts, and prioritising problems in network connectivity.
• Task 4.2: the components and impact of a policy, such as Principal, Action, Resource and Condition.
• Task 5.1: TLS concepts, and cross-Region networking with private and public VIFs.
• Task 5.2: configuring S3 static website hosting.
• Task 6.4: identifying security gaps through architectural reviews and cost analysis.

Removed from the list is not the same as safe to skip

Read the pattern before you delete your notes. Most of what left is knowledge a working engineer already has. The exam no longer asks you to describe the parts of a policy, yet it still asks you to design, interpret and implement IAM policies and to analyse authorization failures. You cannot do that without knowing what a Condition block does.

The same holds for networking. OSI layers are gone as a topic, while security groups, network ACLs, AWS Network Firewall and segmentation remain. Treat the deletions as AWS raising the floor, not shrinking the syllabus.

Where do the six SCS-C03 domains put their weight?

The six SCS-C03 domains are Detection at 16 percent, Incident Response at 14, Infrastructure Security at 18, Identity and Access Management at 20, Data Protection at 18, and Security Foundations and Governance at 14. The weights apply to scored content, so they describe the 50 scored questions and not all 65.

Two task statements carry a fifth of the exam

Identity and Access Management has only two task statements, authentication and authorization, yet it holds the largest share. That makes it the densest domain on the blueprint. Expect IAM Identity Center, Amazon Cognito, AWS STS, permission boundaries, session policies, IAM Roles Anywhere and IAM Access Analyzer to appear in scenario form.

Governance is about many accounts, not one

Security Foundations and Governance assumes an organization, not a single account. Its examples include AWS Organizations, AWS Control Tower, service control policies, resource control policies, AI service opt-out policies and centralised root access for member accounts. If your experience is limited to one account, this is the domain to practise in a sandbox organization.

Who is the SCS-C03 exam written for?

The SCS-C03 exam guide describes a target candidate with the equivalent of 3 to 5 years of experience securing cloud solutions. AWS requires no earlier certification before you sit the exam. Its certification page adds that candidates commonly hold AWS Certified Solutions Architect – Associate or Professional first.

AWS words the experience in a second way on the certification page: five years of IT security experience designing and implementing security solutions, plus two or more years of hands-on work securing AWS workloads. Both descriptions point at the same person, someone who has already run security in production.

What AWS expects you to know already

• The shared responsibility model and how it applies.
• Managing identity at scale and multi-account governance.
• Software supply chain risk and vulnerability management in the cloud.
• Firewall rules at scale for layers 3 to 7.
• Incident root cause analysis and responding to an audit.
• Encryption at rest and in transit, plus backup and disaster recovery controls.

What is out of scope

The guide also lists job tasks the candidate is not expected to perform: designing cryptographic algorithms, analysing traffic at packet level, architecting overall cloud deployments, managing end-user compute resources and training machine learning models. That list is useful when a study resource drifts into packet captures or model training. You can stop reading.

If you want the older blueprint for reference, this site’s earlier SCS-C02 exam walkthrough shows how the previous version was organised, which makes the changes above easier to see.

How should an SCS-C02 candidate adjust a study plan?

An SCS-C02 candidate moving to SCS-C03 should keep most existing notes and re-sort them. Start by mapping old material to the six new domains, then add the seven new tasks, give Identity and Access Management the most time, and practise ordering and matching questions, since both need every part correct to score.

1. Re-file your notes under the six SCS-C03 domain names, moving all logging and monitoring material into Detection and all response material into Incident Response.
2. Write one page for each of the seven added tasks, using the example services AWS names for each.
3. Give Identity and Access Management the largest block of study time, because it now holds 20 percent of scored content.
4. Build a multi-account sandbox with AWS Organizations and practise service control policies, delegated administrators and centralised root access.
5. Practise ordering and matching questions until you can sequence an incident response without hesitating.
6. Sit a full timed set of 65 questions in 170 minutes and review every miss by domain.

What carries over unchanged

Data Protection kept its 18 percent and governance kept its 14. Encryption at rest, S3 Object Lock, AWS Secrets Manager, AWS Config, AWS Audit Manager and AWS Firewall Manager all remain. Work you did on those topics for SCS-C02 still pays.

A caution on old material

Search results still surface plenty of SCS-C02 and even SCS-C01 content. Before trusting a resource, check that it names Detection and Incident Response as separate domains. If it lists Security Logging and Monitoring as a domain, it was written for the retired blueprint.

How long does the certification last, and which languages are ending?

AWS Certified Security – Specialty is valid for 3 years, and you recertify by passing the latest version of the exam. AWS offers SCS-C03 in six languages today, but the Simplified Chinese, Spanish (Latin America) and Portuguese (Brazil) versions will be retired after 31 December 2026. English, Japanese and Korean are not part of that notice.

Both facts come from the AWS certification page. If you planned to sit the exam in one of the three retiring languages, the practical deadline is the end of December 2026. After that date you would need to take it in one of the remaining languages.

Cost of the next exam

AWS states that once you hold one AWS Certification, you receive a 50 percent discount on your next AWS Certification exam, claimed through your AWS Certification Account. For a holder of an Associate credential, that halves the 300 USD fee.

Where the credential leads

AWS names AWS Certified DevOps Engineer – Professional and AWS Certified Advanced Networking – Specialty as certifications that professionals earn afterwards, on the way to roles such as DevSecOps Engineer or Networking Engineer. For a wider view of how AWS credentials fit a career, see this site’s piece on AWS certification career value.

Frequently Asked Questions

Is SCS-C02 still available?

No. AWS states that SCS-C02 was in use until 1 December 2025 and that SCS-C03 has been in use since 2 December 2025. Anyone booking the exam now sits SCS-C03.

How many questions are on the SCS-C03 exam?

There are 65 questions. Fifty affect your score and 15 are unscored questions that AWS is evaluating for future use. The unscored questions are not identified, so answer all 65 with equal care.

What is the passing score for SCS-C03?

The minimum passing score is 750 on a scaled range of 100 to 1,000. Scoring is compensatory, so you need to pass the exam overall and not each domain separately.

How much does the AWS Security Specialty exam cost?

The exam costs 300 USD. AWS gives holders of an active AWS Certification a 50 percent discount on their next exam, claimed through the AWS Certification Account.

Which domain has the highest weight in SCS-C03?

Identity and Access Management, at 20 percent of scored content. It was 16 percent under SCS-C02. Infrastructure Security and Data Protection follow at 18 percent each.

Does SCS-C03 test generative AI?

Yes, in one task. Task 3.2.7 asks you to implement protections and guardrails for generative AI applications, with the OWASP Top 10 for LLM Applications as the example. Training machine learning models is out of scope.

Do I need another AWS certification before SCS-C03?

No. AWS requires no specific certification first. It notes that candidates commonly earn AWS Certified Solutions Architect – Associate or Professional before attempting the Security Specialty exam.

How long is AWS Certified Security – Specialty valid?

The certification is valid for 3 years. Before it expires, you can recertify by passing the latest version of the exam.

Which SCS-C03 exam languages are being retired?

AWS will retire the Simplified Chinese, Spanish (Latin America) and Portuguese (Brazil) versions after 31 December 2026. The exam is also offered in English, Japanese and Korean.

Conclusion

SCS-C03 is the same size as the exam it replaced: 65 questions, 170 minutes, 750 to pass. What changed is where the marks sit. Identity and Access Management is now the largest domain at 20 percent, detection and response each have a domain of their own, and seven new tasks bring in generative AI guardrails, OCSF, imported key material and data masking.

For anyone holding SCS-C02 notes, that is good news. Most of the material survives, and the published deletions are fundamentals you still use every day. Re-sort what you have, add the seven new tasks, and put your extra hours into identity and multi-account governance. Then test the plan against timed scenario questions before you book.

What does the PSM-AI Essentials exam look like on the day?

The PSM-AI Essentials exam is 40 multiple choice questions in 60 minutes, with an 85 percent passing score and a fee of 200 USD. The syllabus lists four topics and publishes no weightings for any of them, so you cannot plan by percentage. You plan by topic, and you plan for a very small error budget.

Two numbers in that table matter more than the rest. First, 85 percent of 40 is 34, so the whole attempt tolerates six wrong answers. Second, 60 minutes for 40 questions gives you 90 seconds each, which is generous. Time is rarely what beats a candidate here. Accuracy is.

That combination changes how you should use the clock. With 90 seconds per question you can read every option twice, and you should, because the wrong answers on this paper tend to sound reasonable. A careless pick costs you a sixth of your allowance.

Which four topics does the syllabus name?

The PSM-AI Essentials syllabus names four topics: AI Theory and Primer, AI Security and Ethics, AI for Scrum Masters, and Effective AI Prompting. None is weighted. Only the first is about how AI works; the other three are about how a Scrum Master uses it responsibly with a team.

AI Theory and Primer

This is the foundation layer: what generative AI is, what a large language model does with a prompt, and why its output is a prediction rather than a looked-up fact. You need enough to explain the tool to a team, not enough to build one.

AI Security and Ethics

Data handling, privacy, bias and transparency. This topic asks what can go wrong when a team starts pasting work into an AI tool, and what a Scrum Master should do before it does.

AI for Scrum Masters

The accountability topic. It covers where AI can genuinely help a Scrum Master, such as summarising retrospective input or drafting options, and where using it would undermine self-management or transparency.

Effective AI Prompting

Writing prompts that return something useful. It is also the only topic on the Scrum Master paper with no counterpart on the Product Owner equivalent, which makes it the clearest difference between the two AI Essentials exams.

The fastest way to see how these topics turn into questions is to work a set of PSM-AI Essentials sample questions before you study anything else. Almost every item is a short scenario with a Scrum Master in it, followed by four plausible responses.

Why is most of the paper about judgement?

Because the credential is about the Scrum Master accountability, not about AI engineering. Published sample questions for PSM-AI Essentials almost all describe a Scrum Master facing a choice with an AI tool, and the correct answer is usually the one that keeps people in charge of decisions, data and quality.

That framing is older than any AI tool. The first value of the Agile Manifesto, written in 2001, is individuals and interactions over processes and tools. An AI assistant is a tool, and the exam keeps asking whether you remember that.

The patterns repeat across the sample items:

• Anything typed into a public AI tool may be stored, logged or reused, so treat it as shared.
• Personal identifiers should be stripped or pseudonymised before data leaves the team.
• A generative model can produce output that is plausible and wrong, so someone must check it.
• AI may draft a Definition of Done, but the Developers agree on it and own it.
• A new tool gets checked against the organisation’s acceptable use and data policies first.

Each of those answers protects something the Scrum Guide already assigns to a person. Self-management belongs to the team, the Definition of Done belongs to the Developers, and transparency belongs to everyone. The Scrum Master’s job is to keep it that way while the tools change.

“The Scrum Master is accountable for the Scrum Team’s effectiveness. They do this by enabling the Scrum Team to improve its practices, within the Scrum framework.”

Read the wrong options in any sample item and you will see the same shortcut offered again and again: let the tool decide, adopt its output as-is, or skip the team. Spotting that shortcut is most of the skill.

What does AI Security and Ethics expect you to know?

AI Security and Ethics expects a PSM-AI Essentials candidate to recognise the everyday risks of using generative AI at work: sensitive data leaving the organisation, output that is confidently wrong, recommendations nobody can explain, and tools adopted without checking policy. It is practical awareness, not security engineering.

The risks worth naming

The security community has already catalogued these. The OWASP LLM Top 10 for 2025 lists prompt injection first, sensitive information disclosure second and misinformation ninth. You will not be asked to defend against prompt injection in code, but you should recognise why confidential sprint data should not go into a public chatbot, and why a polished answer still needs checking.

Ethics is mostly transparency

One sample item asks what concern arises when an AI tool ranks backlog risks and gives no reasoning. The answer is transparency and explainability. In Scrum terms, a decision nobody can inspect cannot be adapted, so an unexplained AI recommendation is a transparency problem before it is anything else.

Frameworks behind the topic

For organisational context, the NIST AI framework is a useful reference. It was released on 26 January 2023 for voluntary use, and NIST added a Generative AI Profile, NIST AI 600-1, on 26 July 2024. You do not need to memorise it; it simply shows that the risks this topic names are the same ones organisations are formally managing.

How is effective prompting tested?

Effective prompting in PSM-AI Essentials is tested through short before-and-after scenarios. A vague prompt returns a generic answer, and you choose the revision that fixes it. The winning revision nearly always adds context, a clear goal, a specific task or an explicit output format, never a louder request or a bigger model.

The sample items make the principle concrete. “Give me some retrospective ideas” is too vague to help. “Help with the team” is worse. The better option in each case states the situation and names the task, such as asking for three ways to help a team surface impediments in the Daily Scrum.

A useful prompt for this exam has four parts, and each one fixes a different failure:

1. Situation, so the tool knows the team, the event and the problem.
2. Goal, so it knows what a good result would achieve.
3. Task, so it knows exactly what to produce and how much of it.
4. Format, so the answer arrives as five bullet points rather than dense prose.

Watch for the distractors. Answers that repeat the same prompt until something better appears, ask for the longest possible response, or simply demand a better model are the traps. None of them clarifies the task, which is the only thing that reliably improves the output.

PSM-AI Essentials, PSM I or PSPO-AI Essentials?

PSM-AI Essentials, PSM I and PSPO-AI Essentials share the same 200 USD fee, the same 60 minutes and the same 85 percent bar. They differ in length and focus: PSM I tests the Scrum framework across 80 questions, while the two AI Essentials exams each have 40 questions on applying AI within one accountability.

The practical difference is pace. PSM I gives you 45 seconds a question, so it rewards fast recall of the Scrum Guide. PSM-AI Essentials doubles that time and spends it on scenarios where two answers look sensible, so it rewards careful reading.

If you are choosing between the two AI Essentials exams, pick by accountability. The Scrum Master version is the only one with a prompting topic, while the Product Owner version replaces it with product ownership. A Scrum Master who still wants to strengthen the framework basics first can start with this site’s guide to PSM I preparation, since the AI questions assume you already know who owns what in Scrum.

How should you prepare for PSM-AI Essentials?

Prepare for PSM-AI Essentials by using AI tools on real Scrum Master work and checking every result, not by studying machine learning. Refresh the Scrum Guide accountabilities, practise rewriting weak prompts, learn the common data and accuracy risks, then work scenario questions until the tempting shortcut answers stop tempting you.

1. Reread the Scrum Guide sections on accountabilities, the Definition of Done and transparency, because most correct answers defend one of them.
2. Spend one short session on AI theory so you can explain why a model can sound certain and still be wrong.
3. Use an approved AI tool on a real task, such as grouping retrospective notes into themes, and check the output yourself before sharing it.
4. Rewrite three vague prompts from your own work by adding situation, goal, task and format, and compare the answers.
5. Read your organisation’s acceptable use and data policies so the policy questions feel familiar.
6. Work scenario questions and, for every miss, name the shortcut the wrong answer offered.

The prompting and retrospective work overlaps heavily with facilitation. If that is a weak area, the site’s PSF Skills guide covers the facilitation side of the Scrum Master role in more depth.

Book the attempt when you are consistently above 34 out of 40 in practice, not when you first scrape past it. With only six misses allowed, a comfortable margin matters more than speed.

Frequently Asked Questions

How many questions are on the PSM-AI Essentials exam?

Forty multiple choice questions in 60 minutes, which works out at 90 seconds per question.

What is the passing score for PSM-AI Essentials?

Eighty five percent. On 40 questions that means 34 correct answers, so you can miss six.

How much does PSM-AI Essentials cost?

The listed fee is 200 USD, the same as PSM I and PSPO-AI Essentials.

What are the four PSM-AI Essentials topics?

AI Theory and Primer, AI Security and Ethics, AI for Scrum Masters, and Effective AI Prompting. No weightings are published for any of them.

Is PSM-AI Essentials a technical AI exam?

No. Only one topic covers AI theory. The rest test how a Scrum Master uses AI tools with a team while protecting data, quality and ownership.

Do I need PSM I before PSM-AI Essentials?

The syllabus page lists no prerequisite. Check the current rules on Scrum.org before booking, and note that the questions assume you already know Scrum accountabilities well.

How is PSM-AI Essentials different from PSPO-AI Essentials?

Both have 40 questions, 60 minutes and an 85 percent pass mark. The Scrum Master exam includes Effective AI Prompting, while the Product Owner exam has an AI Product Ownership topic instead.

Does PSM-AI Essentials expire?

The syllabus page publishes no validity period or renewal rule, so confirm it on Scrum.org rather than relying on second-hand claims.

What is the best way to practise for PSM-AI Essentials?

Use AI on real Scrum Master tasks, check every output, practise rewriting vague prompts, and work scenario questions until you can name why each wrong option is wrong.

Conclusion

PSM-AI Essentials is 40 questions in 60 minutes at an 85 percent pass mark, and the pass mark is the real difficulty. Six misses is not much room on a paper built from reasonable-sounding options.

The candidates who struggle are usually the ones who prepared for a technology exam. The syllabus spends one topic on how AI works and three on how a Scrum Master uses it: keeping data safe, checking output, protecting team ownership and writing prompts that ask for something specific.

Prepare in that proportion. Use the tools on real work, verify what they give you, and practise on scenarios until the shortcut answers stand out. When your practice scores sit comfortably above 34, you are ready to book.

QSDA or QSBA, which exam is yours?

QSDA is the data architect exam and QSBA is the business analyst one. The first tests how you get data into Qlik Sense and shape it; the second tests what you build on top once it is there. They are separate credentials for separate jobs, and picking the wrong one is the most expensive mistake available here.

The clean test is where your work happens. If you spend your time in the data load editor, writing scripts, joining tables, deciding what the model should look like and why a chart is slow, QSDA is the exam that describes you. If you spend it in the app, choosing visualisations, building sheets and working with business users on what they want to see, the business analyst route fits better.

There is overlap in one place, and the blueprint puts it first. Twenty percent of QSDA is identifying requirements, which includes working out what business users actually need, who the stakeholders are, and what granularity the numbers should sit at. A data architect who cannot do that builds technically sound models that answer nobody’s question, so Qlik tests it before it tests any script.

Qlik lists both credentials, and several others, on its certifications overview. Read the role description rather than the title before booking anything.

What are the QSDA exam facts?

QSDA is 50 questions in 90 minutes at a 62 percent pass mark, priced at 250 USD, delivered as a proctored multiple choice exam you sit remotely. Five topics are published, all of them weighted, and the exam is platform-neutral across client-managed Qlik Sense and Qlik Cloud.

One number in that table is worth stating carefully. Some exam catalogues list this paper at 120 minutes. Qlik’s own exam details page gives 90, and that is the figure used throughout here. The difference is not academic: 50 questions in 90 minutes is 108 seconds each rather than 144, which is enough to change how you pace a scenario-heavy paper.

Qlik is also unusually open about how the pass mark works. It states that exam content is updated periodically, that the number and difficulty of questions may change, and that the passing score is adjusted to maintain a consistent standard. So 62 percent is not a fixed bar you can calibrate against forever; it is the current expression of a constant standard, and the standard is what you are actually preparing for.

Price is the one field Qlik does not publish on that page, so treat 250 USD as the catalogue figure and confirm it when you book.

Where does the exam weight actually sit?

In the script and the model. Data transformations is 38 percent and data model design is 28, which is 66 percent of the paper in two topics. Identify requirements takes 20 percent, data connectivity 8 and validation 6. The distribution is published by both the exam catalogue and Qlik, and the two agree exactly.

Read those numbers against how people usually prepare and the mismatch is obvious. Candidates tend to revise connectors, because connectors are concrete and easy to list. Connectivity is 8 percent, roughly four questions. Meanwhile the load script, which is harder to revise because it is a skill rather than a list, is nearly two fifths of the paper.

The practical instruction is to spend your time in proportion. If you have ten study sessions, six or seven belong in the script and the model, two in requirements, and the remaining one across connectivity and validation together.

What does the 38 percent transformations topic cover?

Everything that happens between a raw source and a usable model. Six objectives: building data content to requirements, handling nulls and blanks so filtering behaves, documenting load scripts, date handling, script organisation and cleansing, and the variables needed for incremental loading in the extract layer.

Incremental loading is the one to take seriously. It is named explicitly, it sits in the extract layer, and it is production work rather than exam theory: you are being asked how to load only what has changed since the last run, which means understanding what drives the decision and which variables carry the state. Anyone who has only ever done full reloads on small datasets will find this unfamiliar.

Null and blank handling earns its place for a subtler reason. The objective ties it to filtering, not to correctness, and that connection is the insight. A null that is technically harmless in the data can make a selection behave in a way a user reads as a bug, so the exam wants you to reason about the consequence in the application rather than about the value in the field.

Two objectives are about discipline rather than technique: documenting load scripts, and script organisation and cleansing. They look like filler and are not. A script nobody can follow is a maintenance liability, and Qlik has chosen to examine that directly. Qlik’s load script documentation is the reference if your habits were learned on the job rather than from the manual.

What does data model design ask for?

Four objectives across 28 percent: determining measures and attributes from each source, identifying the appropriate type of data model, optimising the model for Qlik Sense specifically, and implementing data structures efficiently. It is the judgement half of the exam, where transformations is the execution half.

The phrase doing the work is “appropriate type of data model”. You are expected to choose, with reasons, rather than to apply one shape everywhere. That means recognising when a star schema is right, when a snowflake is acceptable, when to denormalise for speed, and when the answer is to split a model rather than stretch one.

“Optimised for Qlik Sense” is deliberate too. Generic warehouse modelling instincts do not transfer cleanly, because Qlik’s associative engine rewards different choices from a relational query engine: synthetic keys and circular references are problems here that would be unremarkable elsewhere, and column cardinality affects memory in ways that matter at load time.

Requirements feed straight into this, which is why the blueprint puts them first. Granularity, aggregation level and the need for slowly changing dimensions are all named in the 20 percent requirements topic, and each is a decision that constrains the model before you write a line of script. Recognising that need early is exactly what the exam is testing.

The three light topics, and why light is not skippable

Requirements at 20 percent, connectivity at 8 and validation at 6 make up the remaining third. Only two of them are genuinely small, and treating any of them as optional is how a candidate with strong scripting skills still fails.

Requirements is not light at all, despite sitting outside the two heavy topics. Twenty percent is roughly ten questions, and its objectives are the ones least improved by technical practice: identifying stakeholders from a scenario, settling metrics and levels of granularity, and determining the appropriate level of security. These are consulting questions, and they reward having sat in the meeting rather than having read about it.

Connectivity at 8 percent is genuinely small, and it is also the easiest topic to secure. Two objectives, both concrete: which sources and connectors a situation needs, and the right way to create those connections. A single focused session covers it, and it would be careless to lose four questions to something that finite.

Validation at 6 percent is the smallest topic on the paper and the one most often left to chance. Two objectives, testing scripts and testing data, and they are worth understanding as separate activities: a script can run perfectly and still produce a model that is wrong. Three questions is not many, but at a 62 percent pass mark the margin is thin enough that three is worth having.

What does Qlik expect you to have built already?

Production applications, not practice ones. Qlik publishes a recommended experience list, and it reads as a description of a working data architect rather than a study prerequisite, which tells you how the questions will be framed.

• Practical experience developing multiple production-quality Qlik Sense applications
• Ability to write Qlik Sense load scripts and validate data
• A basic understanding of extract, transform and load as a discipline
• Creating and using connectors to various data sources
• Understanding the QVD layer and the architecture of the Qlik platform
• Ability to architect data to provide optimal performance
• Familiarity with SQL and relational databases

The QVD layer entry is the one to check yourself against honestly. QVD files are Qlik’s own storage format and the layered extract, transform and load pattern built on them is how serious Qlik estates are organised. If you have never worked in a layered architecture, the incremental loading material in the transformations topic will feel abstract, because it exists to serve exactly that pattern.

The SQL entry matters for a different reason. Much of what a Qlik data architect does is decide what to push back to the source and what to do in the script, and that decision needs enough SQL to know which is cheaper. The exam is platform-neutral across client-managed and cloud deployments, so nothing here depends on where your Qlik sits. A related view of how Qlik frames a specialist credential appears in the QAIS specialist guide.

How should you prepare?

Work in the script, in proportion to the weightings, on a model you did not build. Reading about transformations does not prepare you for a paper where nearly two fifths of the questions describe a situation and ask which method is correct.

1. Split your study time to match the weights, with roughly two thirds of it in transformations and model design.
2. Build one layered extract, transform and load setup with a QVD layer, even a small one, so the architecture is something you have assembled.
3. Implement incremental loading end to end and work out for yourself which variables carry the state between runs.
4. Take a model somebody else built and find its synthetic keys and circular references, because diagnosing is closer to the exam than designing.
5. Practise the requirements objectives out loud: given a scenario, name the stakeholders, the granularity and the security level.
6. Spend one session on connectivity and one on validation, which is enough for 14 percent of the paper.
7. Work a set of QSDA sample questions to calibrate how the script material is actually asked.

If you are coming from the application side, invert the emphasis and expect the adjustment to take longer than you plan. The front-end instincts that make a good sheet designer do not help with a slow model, and the exam is almost entirely about the second problem. An older look at the same credential is available in the site’s earlier data architect overview, useful for the role framing rather than the current figures.

Frequently Asked Questions

How many questions are on the QSDA exam?

Fifty questions in 90 minutes, which is about 108 seconds each.

What is the passing score for QSDA?

Sixty two percent. Qlik states that it adjusts the passing score as content and question difficulty change, so that the standard stays consistent.

How long is the exam, 90 or 120 minutes?

Ninety minutes. Some catalogues list 120, but Qlik’s own exam details page gives 90, and that is the figure to plan against.

What is the difference between QSDA and QSBA?

QSDA is the data architect exam, covering the load script and the data model. QSBA is the business analyst exam, covering what gets built in the application once the data is there.

What are the five topics and their weightings?

Identify requirements at 20 percent, data connectivity at 8, data model design at 28, data transformations at 38, and validation at 6.

Does the exam cover Qlik Cloud or client-managed Qlik Sense?

Both. Qlik states the exam is platform-neutral, so the content applies to either deployment.

How much does QSDA cost?

Two hundred and fifty US dollars as listed. Qlik does not publish a price on its exam details page, so confirm the figure when you book.

Is the exam proctored?

Yes. It is sat remotely with the machine locked down and webcam supervision throughout.

Do I need SQL for this exam?

Qlik lists familiarity with SQL and relational databases as recommended experience. You are not tested on writing SQL, but the modelling decisions assume you understand what the source can do.

What do I get for passing?

The Qlik Sense Data Architect certification and a digital badge issued through Credly.

Conclusion

QSDA is the script and model exam. Fifty questions in 90 minutes, 62 percent to pass, 250 USD, and five topics in which transformations and model design take 66 percent between them.

Prepare in that proportion. Incremental loading, null handling for filtering, script discipline and choosing a model type for Qlik’s engine rather than for a relational one are where the questions live, and none of them yields to revision without a keyboard. Requirements at 20 percent is the topic experience helps with most and study helps with least.

Check the duration before you plan your pacing, since the catalogue figure and Qlik’s own differ, and remember that the 62 percent bar moves with the paper by design. Then work the two heavy topics until the script is something you write rather than something you recognise.

What does SecAI+ actually examine?

Four domains, weighted, and the weighting is the answer. Securing AI systems takes 40 percent. AI-assisted security, the domain most people expect to dominate, takes 24 percent. Basic AI concepts take 17 percent and governance, risk and compliance take 19 percent. Defending AI outweighs using it by a clear margin.

That single number reorganises how you should prepare. Two fifths of the questions concern a class of asset most security teams did not own two years ago, and the controls involved have no equivalent on the exams you have already passed. An experienced defender will recognise most of domain 3 on sight and very little of domain 2.

It also explains who the credential is aimed at. This is not a course in prompt writing. It assumes your organisation now runs models in production, exposes them to users, and has to answer for what they do, and it tests whether you can secure and govern that. The full SecAI+ exam syllabus sets out every objective under those four headings.

What are the CY0-001 exam facts?

CY0-001 runs 60 minutes with up to 60 questions, a mix of multiple choice and performance-based items, scored on a scale of 100 to 900 with 600 required to pass. It costs 298 USD, is delivered through Pearson VUE, and is available in English and Japanese.

Two details in that table are worth drawing out. The question count is a maximum rather than a fixed number, and the paper mixes performance-based items with multiple choice, which CompTIA states on its official SecAI+ page. Sixty minutes for up to 60 questions is already tight at a minute each, and performance-based items take several minutes, so the practical arithmetic is worse than it looks.

The second is the launch date. SecAI+ went live on 17 February 2026, which means the beta period is over. Searches for a SecAI beta exam still circulate; there is nothing to wait for. CompTIA estimates retirement roughly three years after launch, so the credential has a normal useful life ahead of it rather than a short one.

Domain 1: how much AI theory do you need?

Enough to hold a precise conversation, and no more. Seventeen percent covers the vocabulary: the types of AI, how models are trained, how prompts are constructed, and how data is prepared. It is a grounding domain rather than a mathematical one, and nothing in it requires you to build a model.

Three groups make up the bulk of it. The first is model types, which spans generative AI, machine learning, statistical learning, transformers, deep learning, generative adversarial networks, natural language processing, and both large and small language models. The distinction between a large and a small language model matters more than it first appears, because it drives where a model runs and therefore what you can control about it.

The second is training technique: supervised, unsupervised, reinforcement and federated learning, plus model validation, fine-tuning, epochs, pruning and quantization. The third is prompt engineering, covering system and user prompts, zero-shot, one-shot and multi-shot prompting, system roles and templates. Prompt structure returns in domain 2 as a control, so learning it properly here pays twice.

Data security closes the domain: cleansing, verification, lineage, integrity, provenance, augmentation and balancing. Data lineage and provenance are the two to know cold, because both reappear in the governance domain as audit and compliance obligations.

Domain 2: what does securing an AI system involve?

Threat modelling it, wrapping it in guardrails, and controlling access to the model and its data. At 40 percent this is the largest block on the exam by a wide margin, and it is built on named public frameworks rather than on abstractions, which makes it unusually studiable from primary sources.

Threat modelling with named frameworks

The syllabus names six: the OWASP Top 10, the OWASP LLM Top 10, the OWASP Machine Learning Security Top 10, the MIT AI Risk Repository, MITRE ATLAS, and the CVE AI Working Group. Knowing which one applies to a described scenario is the examinable skill. ATLAS catalogues adversary tactics against AI systems; the OWASP lists enumerate the vulnerability classes.

Model and gateway controls

This is the material with no equivalent anywhere on Security+ or CySA+, and it is where preparation time should concentrate. Model controls cover model evaluation, guardrails and prompt templates. Gateway controls sit in front of the model and are the newer idea:

• Prompt firewalls, which inspect what is sent to a model rather than what is sent to a network
• Rate limits and token limits, which cap how much a caller can consume
• Input quotas covering data size and quantity
• Modality limits, restricting whether a caller may send images or audio as well as text
• Endpoint access controls on the interface itself

Guardrail testing and validation is examinable separately from building guardrails, and the distinction is deliberate. A guardrail nobody has tried to defeat is an assumption, not a control, so expect scenarios that ask how you would prove one works.

Access control

The domain closes on access to the model and access to the data behind it, treated as two separate problems. That separation is the point. Someone may legitimately query a model while having no business reaching the training data, and the exam expects you to control each independently.

Domain 3: where does AI help the defender?

In tooling and automation, and it helps the attacker in the same breath. Twenty-four percent splits three ways: using AI-enabled tools for security tasks, understanding how AI enables or enhances attack vectors, and automating security work. Most experienced defenders will find this the familiar half of the paper.

The tooling list covers plug-ins for development environments, browsers and the command line, plus chatbots, personal assistants and Model Context Protocol servers. The use cases run from signature matching, code quality and linting, and vulnerability analysis through to automated penetration testing, anomaly detection, pattern recognition, incident management, threat modelling, fraud detection, translation and summarisation.

The offensive half deserves equal study and usually gets less. It covers AI-generated content and deepfakes used for impersonation, misinformation and disinformation, adversarial networks, reconnaissance, social engineering, obfuscation, and automated data correlation for generating attacks, discovering attack vectors, and producing payloads, malware, honeypots and distributed denial of service traffic.

Automation closes the domain: low-code and no-code scripting, document synthesis and summarisation, incident response ticket management, change management with AI-assisted approvals and automated deployment or rollback, AI agents, and a continuous integration pipeline covering code scanning, software composition analysis, and unit, regression and model testing. Model testing inside a pipeline is the item most likely to catch out someone who prepared only on traditional application security.

Domain 4: what does the governance domain expect?

That you can describe how an organisation governs AI, name the risks that come with it, and identify which regulation applies. Nineteen percent, and it is more concrete than governance domains usually are, because the syllabus names actual instruments rather than talking about policy in general terms.

Structures come first: an AI Center of Excellence, and the policies and procedures around it. Then roles, and the list is long enough to be examinable in its own right, spanning data scientist, AI architect, machine learning engineer, platform engineer, MLOps engineer, AI security architect, AI governance engineer, AI risk analyst, AI auditor and data engineer. Learn which ones own risk decisions rather than trying to memorise every description.

Responsible AI covers fairness, reliability and safety, transparency, privacy and security, differential privacy, explainability, inclusiveness, accountability, consistency and awareness training. The risk list is more practical: introduced bias, accidental data leakage, reputational loss, model accuracy and performance, intellectual property exposure, autonomous systems, and shadow AI, which is shadow IT for people quietly using unsanctioned models.

Compliance names four external instruments: the EU AI Act, OECD standards, ISO AI standards and the NIST AI Risk Management Framework. Alongside them sit corporate policy questions: sanctioned against unsanctioned use, private against public models, sensitive data governance, third-party compliance evaluations and data sovereignty. You are not expected to recite the EU AI Act, but you are expected to know what each instrument is for.

Who should take this exam?

Working security practitioners whose organisations have started running AI in production. CompTIA recommends three to four years in IT and at least two years of hands-on cybersecurity, with Security+, CySA+ or PenTest+ already held or equivalent experience in place. This is not an entry point into the field.

It fits most cleanly where someone already owns defensive work and has been handed AI systems to protect: security analysts whose estate now includes model endpoints, security architects designing controls around them, and engineers asked to put a gateway in front of a model that is already live. The governance domain also makes it genuinely useful to risk and compliance staff who need the vocabulary rather than the implementation.

It fits less well if your interest is using AI tools to work faster. That is domain 3, it is a quarter of the exam, and a shorter course would serve you better. It is also a poor first certification, for the reason CompTIA states: the paper assumes the security fundamentals rather than teaching them, and the CySA+ analyst credential is one of the routes it expects you to have taken first.

One honest caveat about newness. The exam launched in February 2026, so there is little community material, few study guides and no long track record of employer recognition. That is the trade for being early, and it cuts both ways.

How should you prepare?

Spend your time in proportion to the weightings, and study domain 2 from the primary sources it names rather than from summaries of them. Forty percent of the paper sits in one domain built on public frameworks that are free to read, which is an unusually direct route from syllabus to preparation.

1. Read the four domain weightings and plan your hours against them, because 40 percent in one domain is not a hint you can ignore.
2. Work through the OWASP LLM Top 10 and the OWASP Machine Learning Security Top 10 directly, since the syllabus names both by title.
3. Read MITRE ATLAS as a tactics catalogue and practise mapping a described attack onto it.
4. Learn the gateway controls as a set, prompt firewalls, rate and token limits, input quotas and modality limits, because none of them appear on the exams you have already passed.
5. Build or borrow one model endpoint and put a control in front of it, so guardrail testing is something you have done rather than read about.
6. Skim the NIST AI Risk Management Framework and note what the EU AI Act, OECD and ISO standards each cover, at the level of purpose rather than clause.
7. Practise performance-based items under time, since up to 60 questions in 60 minutes leaves no room to think slowly.

If your background is AI rather than security, invert that plan. Domain 1 will already be familiar and domains 2 and 4 will not, and the security reasoning behind a control is what the questions actually test. A related view of how CompTIA frames AI content appears in the DataAI exam material, which approaches the same technology from the data side.

Frequently Asked Questions

How many questions are on the CY0-001 exam?

A maximum of 60, mixing multiple choice and performance-based items, in 60 minutes.

What is the passing score for SecAI+?

Six hundred on a scale of 100 to 900. It is a scaled score, not a percentage.

How much does SecAI+ cost?

Two hundred and ninety eight US dollars. CompTIA does not publish a price on its own exam page, so confirm the current figure when you book through Pearson VUE.

Is SecAI+ about using AI or about securing AI?

Mostly securing it. The securing AI systems domain is 40 percent of the exam, while the AI-assisted security domain, which covers using AI for defensive work, is 24 percent.

Is the exam still in beta?

No. SecAI+ launched on 17 February 2026, so the beta period is over and the live exam is available.

What experience does CompTIA recommend?

Three to four years in IT and at least two years of hands-on cybersecurity, with Security+, CySA+ or PenTest+ recommended beforehand.

What are the four domains and their weightings?

Basic AI concepts related to cybersecurity at 17 percent, securing AI systems at 40 percent, AI-assisted security at 24 percent, and AI governance, risk and compliance at 19 percent.

What languages is the exam available in?

English and Japanese.

When will SecAI+ retire?

CompTIA estimates retirement about three years after launch, which places it around early 2029, though that is an estimate rather than a fixed date.

Do I need to know how to build machine learning models?

No. Domain 1 covers model types, training techniques and prompt engineering as vocabulary and mechanics, not as a development skill.

Conclusion

SecAI+ is a defending-AI credential wearing a name that suggests otherwise. Up to 60 questions in 60 minutes, 600 to pass on a 100 to 900 scale, 298 USD, and four domains in which securing AI systems alone takes 40 percent.

Plan against that number. The gateway controls, guardrail validation and model access material in domain 2 have no equivalent on the security exams you have already passed, while most of domain 3 will be recognisable from work you already do. Study the named frameworks directly, because the syllabus points at them by title and they are free to read.

Check the current price when you book, since CompTIA publishes none on its exam page, and go in expecting performance-based items rather than a pure multiple choice paper. Then work the domains in proportion to their weight, which is the clearest instruction this syllabus gives.

What makes this exam different from other Linux credentials?

Two things: the syllabus includes Oracle Ksplice, which no other vendor’s Linux exam covers, and the format is multiple choice rather than performance based. Everything else on the topic list would be recognisable to anyone who has prepared for a general enterprise Linux credential.

That combination produces a specific kind of paper. A performance based exam proves you can complete tasks under time pressure on a live system. A multiple choice exam at this level proves something narrower and still useful: that you know which mechanism applies, what a configuration does, and where the system keeps the answer when something breaks.

The distinction matters when you are choosing between credentials rather than collecting them. If your estate runs Oracle Linux, this exam covers the distribution you actually administer, including the parts Oracle adds on top of the common base. If it does not, a vendor neutral credential will serve you better, and the performance based Red Hat route is the obvious comparison at a similar level. If you want a performance-based alternative that is not tied to one distribution, look at the LFCS hands-on exam tasks before you decide.

What are the 1Z0-106 exam facts?

1Z0-106 runs 90 minutes with 60 multiple choice questions and a 60 percent pass mark, which is 36 correct answers. It costs 245 USD, though Oracle prices vary by country, and passing grants the Oracle Certified Professional, Oracle Linux 8 System Administrator credential.

A word on where those figures come from. Oracle’s certification portal returns an error to anything but a browser, and its learning site serves an application shell with no readable specification inside it, so none of this can be checked against the vendor the way a CompTIA or Cisco figure can. These are the exam catalogue’s numbers, they are internally consistent, and you should confirm the price at registration since Oracle localises it.

For the same reason this guide states no validity period and no retake rule: Oracle publishes neither where it can be read. Ninety seconds per question is comfortable, so the practical constraint is breadth rather than speed, and a 1Z0-106 practice test is the quickest way to find which of the 21 areas you have never touched.

How do you plan for a syllabus with no weightings?

You plan by objective count and by how much of the working day each area occupies, because Oracle publishes no percentages for this exam. Twenty one areas across 60 questions averages under three questions each, which tells you immediately that depth in one favourite area cannot carry the paper.

That average is the most useful planning number available. It means no single area can be worth revising exhaustively, and it means an area you skip entirely costs you roughly three questions, or five percent of the mark, which is most of the margin between 60 percent and a fail.

The sensible approach is coverage first, depth second. Work the whole list once, mark every area where you could not explain the mechanism to a colleague, and spend your remaining time only on those. Candidates who fail this paper usually do so by knowing six areas extremely well and four not at all.

What do the core administration topics cover?

The first half of the syllabus is conventional enterprise Linux administration: the boot process and GRUB 2, kernel boot parameters, systemd, system configuration through /etc/sysconfig, the /proc and /sys filesystems, sysctl, time synchronisation with chrony, NTP and PTP, package management, task automation, users and groups, filesystems and swap, storage devices, networking and OpenSSH.

Two details in that list are worth pausing on, because they are where multiple choice questions tend to live. The first is the difference between a runtime kernel parameter set through sysctl and a boot parameter set in GRUB, which is a distinction the exam can test cleanly without a lab. The second is time: chrony, NTP and PTP are named separately, and the exam expects you to know which one a situation calls for rather than merely that time synchronisation exists.

The behaviour of systemd runs underneath much of this material. Units, targets, dependencies and the journal appear across the boot, service, logging and troubleshooting areas, so a candidate fluent in systemd picks up marks in four separate topic areas rather than one. The kernel side of the same material is documented at the kernel project, which is worth reading once for boot parameters if that ground is unfamiliar.

Why does Ksplice have its own topic area?

Because it solves a problem every other distribution answers with a reboot. Ksplice applies kernel and userspace patches to a running system, so a security fix can be applied without a maintenance window, and it is Oracle technology rather than part of the common Linux base.

That is why it earns a topic area of its own on this syllabus and appears on no competing vendor’s Linux exam. If you administer Oracle Linux in an environment with uptime commitments, it is also the feature most likely to justify the certification to a manager, because the operational saving is concrete.

For the exam, the examinable ground is what Ksplice does, when it applies, how it is managed, and what its limits are. The vendor documents the service on the Ksplice site, and it is one of the few areas where a candidate cannot fall back on general Linux experience, because there is no general equivalent to fall back on.

How much security does the syllabus expect?

Three of the 21 areas are security mechanisms that administrators commonly work around rather than with: Security Enhanced Linux, pluggable authentication modules, and the Linux auditing system. Each gets its own heading, which is a fair signal of how the exam treats them.

SELinux is the one candidates most often under-prepare, because in practice many estates run it permissive and move on. The exam is not interested in that pragmatism. It expects the modes, contexts, booleans and the relationship between a denial and a policy, which is knowledge you can only fake for about two questions. The project’s own material at the SELinux project repository is the authoritative reference.

PAM rewards a different habit. It is a stack, and almost every PAM question is really about order and control flags, so drawing one real stack out and tracing a login through it converts the whole area from memorisation into something you can reason about. The audit system rounds the group off: what it records, where it writes, and how to ask it a question after the fact.

Control groups and container services

Control groups and container services appear as two separate areas late in the syllabus, and together they are the part of the list that dates the exam most clearly to a modern estate. Cgroups govern how resources are allocated and capped; container services cover running containers on the host rather than orchestrating them across a cluster.

Keep the scope in mind while revising. This is host level container administration, not orchestration: nothing here is asking about clusters, schedulers or service meshes. The examinable material is what the host provides, how a container consumes it, and how cgroups bound that consumption.

Advanced storage administration and file sharing sit alongside them and follow the same pattern. The topics are broad, the depth is moderate, and the questions reward someone who has configured the thing once rather than someone who has read about it twice.

Who should take this exam?

It suits administrators running Oracle Linux in production, engineers supporting Oracle Database or Exadata estates where the operating system is part of the stack they own, and sysadmins whose employer is an Oracle shop and wants a credential that matches. Oracle publishes no prerequisite, though the word advanced in the title is accurate.

It is a weak fit for two groups. Anyone whose estate is Red Hat, Ubuntu or SUSE gains little from a distribution specific paper, especially one covering a feature they do not run. And anyone who wants to prove practical ability under exam conditions will find a multiple choice format less persuasive to a technical interviewer than a performance based one.

There is one more group worth naming: candidates who already hold an Oracle credential on the database side and want the operating system underneath it. That is a coherent pairing, and the Oracle Database SQL route covers the other half of the same estate.

How should you prepare?

Cover all 21 areas before deepening any of them, get hands on an Oracle Linux 8 system, and treat Ksplice and SELinux as the two areas where general Linux experience will not carry you. With roughly three questions per area, the exam punishes gaps far more than it rewards specialism.

1. List the 21 topic areas and rate your confidence in each one honestly. The list itself is the study plan.
2. Build an Oracle Linux 8 virtual machine and work through the areas you rated lowest, in order.
3. Spend a dedicated session on Ksplice, which is the one area with no equivalent elsewhere.
4. Trace one real PAM stack and one real SELinux denial end to end, rather than reading about either.
5. Practise distinguishing the mechanisms that look alike: sysctl against boot parameters, chrony against NTP and PTP, cgroups against container limits.
6. Sit a full timed set and use the result to find the areas you skipped rather than to confirm the ones you enjoy.

An earlier walkthrough of this same paper is still useful on tactics rather than content, and that 1Z0-106 preparation guide predates the current catalogue figures, so read it for method and take the numbers from here.

One practical note on the format: because the paper is multiple choice, elimination is a legitimate technique in a way it never is on a performance based exam. Knowing that two of four answers are impossible is worth a mark, and at a 60 percent threshold those marks decide results.

Frequently Asked Questions

How many questions are on the 1Z0-106 exam?

Sixty multiple choice questions in 90 minutes, which is about 90 seconds each.

What is the passing score for 1Z0-106?

Sixty percent, which works out at 36 correct answers from 60.

How much does the exam cost?

Two hundred and forty five US dollars, and Oracle varies pricing by country, so confirm the local figure when you book.

What credential does passing it earn?

Oracle Certified Professional, Oracle Linux 8 System Administrator.

Are the topic areas weighted?

No. Oracle publishes no weightings for this exam, so plan by objective rather than by percentage. Twenty one areas across 60 questions averages just under three questions each.

Is the exam hands on?

No. It is multiple choice, which is the main format difference between this credential and the performance based Red Hat route at a similar level.

What is Ksplice and why is it on the syllabus?

Ksplice applies kernel patches to a running system without a reboot. It is Oracle technology, it has its own topic area, and no competing vendor’s Linux exam covers it.

Are there prerequisites?

None are published, although the syllabus assumes real administration experience rather than first exposure to Linux.

How long is the certification valid?

Oracle does not publish a validity period where it can be read, so this guide does not state one. Check your certification record after passing.

Does it cover Oracle Linux 9?

No. The release is named in the exam title, and this paper covers Oracle Linux 8.

Conclusion

1Z0-106 is a breadth exam for people who run Oracle Linux specifically. Sixty multiple choice questions, 90 minutes, 60 percent to pass, 245 USD, and 21 topic areas that Oracle declines to weight.

Plan for coverage rather than depth, because under three questions per area means a skipped topic costs about as much as the margin you have to spare. Give Ksplice and SELinux their own sessions, since neither yields to general Linux experience, and build the virtual machine rather than reading about the commands.

Treat the published figures as the catalogue’s rather than the vendor’s, because Oracle’s own pages cannot be read from outside a browser, and confirm the price when you book. Then work the topic list in order of your own weakness, which is the only prioritisation this syllabus offers.

What does the HCIA-AI credential cover?

HCIA-AI is the associate tier of Huawei’s artificial intelligence track, and it certifies conceptual breadth rather than engineering depth. The syllabus moves from what AI is and where it is used, through machine learning and deep learning, into the frameworks used to build models, the business process around an AI project, and the applications at the edge of the field.

The emphasis is unusual for an entry-level paper. Rather than spending most of its weight on classical algorithms, it puts 30 percent on deep learning and foundation models and another 20 percent on development frameworks, which means half the exam is about how modern models are built and trained rather than about statistics.

What it does not do is make you an AI engineer, and it does not pretend to. Associate credentials across every vendor certify that you can hold a technically literate conversation and follow an implementation, and this one is honest about sitting at that level while choosing unusually current material to do it with.

What are the H13-311 exam facts?

H13-311 is 60 questions in 90 minutes, scored out of 1000 with 600 required to pass, at a fee of 200 USD and scheduled through Pearson VUE. That works out at 90 seconds per question, and the scaled scoring means the raw number of correct answers needed is not published.

A word about where those numbers come from, because it matters. Huawei’s certification portal is a JavaScript application that serves no readable specification to anything but a browser, so none of these figures can be confirmed against the vendor in the way a Cisco or CompTIA figure can. They are the exam catalogue’s, they are internally consistent with the published syllabus, and you should confirm the fee and the booking terms at registration.

For the same reason, this guide states no validity period, no prerequisite and no retake rule: Huawei publishes none that can be read, and a figure nobody publishes is not one worth repeating. The most reliable readiness check is the paper itself, and an H13-311 practice test will tell you more about your gaps than any specification table.

What does the V4.0 syllabus signal?

The current blueprint is keyed to HCIA-AI V4.0 training material, and its content dates it precisely. The AI Overview domain includes an overview of DeepSeek and its influence on AI development, and the largest domain is titled Basics of Deep Learning and Foundation Models rather than simply deep learning.

Both choices tell you the syllabus was rewritten after large language models became the centre of the field rather than a specialism within it. An associate paper that names a specific recent model is taking a deliberate risk: model names age badly, and Huawei has accepted that in exchange for currency.

The practical consequence is about study material rather than about theory. Older HCIA-AI guides, and there are many, describe a version where deep learning was one domain among several and foundation models were not mentioned. They will teach you most of the machine learning content correctly and leave you short exactly where the weighting is heaviest.

How to tell which version you are reading

Check whether the material mentions foundation models at all. If the deep learning section stops at convolutional and recurrent networks and never reaches transformers or pretraining, it predates this blueprint. The transformer architecture those models are built on was set out in the 2017 attention paper, and any current AI syllabus has to reach it.

How are the six domains weighted?

The six domains are AI Overview at 10 percent, Machine Learning Overview at 20 percent, Basics of Deep Learning and Foundation Models at 30 percent, AI Development Framework at 20 percent, AI Business Process Overview at 15 percent and Cutting-edge AI applications at 5 percent. One domain carries nearly a third of the paper and one carries a twentieth.

Read the bottom row before the top one. Cutting-edge AI applications is worth about three questions, which is the clearest signal in the whole blueprint that the exam is not testing novelty for its own sake. The marks are in the middle: models, frameworks and the process of getting a model into a business.

Inside the 30 percent domain

Basics of Deep Learning and Foundation Models is the domain to organise your preparation around. It starts from the perceptron and works up through network architectures to the pretrained models that dominate current practice, which means it asks you to understand both the mechanics underneath and the vocabulary on top.

The conceptual chain is what carries the marks. A perceptron makes one linear decision; layers of them make a network that can represent non-linear relationships; training adjusts weights by propagating error backwards; and a foundation model is that idea scaled up and pretrained on enough data that it can be adapted to tasks it was never specifically trained for. Candidates who can trace that chain answer most of this domain correctly.

Where people lose marks is the vocabulary of adaptation rather than the architecture itself. Pretraining, fine-tuning, prompting and inference describe different activities at different costs, and an exam question that asks which one fits a described situation is really asking whether you know what each stage does to a model.

What does the development framework domain expect?

AI Development Framework is 20 percent of the paper and covers how models are actually built in code: computational graphs, tensors, the training loop and the libraries that provide them. Huawei’s own MindSpore framework features here, as you would expect from a vendor exam, alongside the general concepts that transfer to any framework.

The good news for anyone arriving from another ecosystem is that the concepts move across intact. A tensor is a tensor, automatic differentiation works the same way, and a training loop looks familiar whether it is written against the PyTorch project or against Huawei’s MindSpore. What you need is the ability to recognise the same idea under a different name.

AI Business Process Overview, at 15 percent, is the domain that surprises engineers. It covers how an AI project runs, from problem definition and data collection through model deployment and monitoring, and its questions are about sequence and responsibility rather than about code. It is also the easiest domain to gain marks in quickly, because the material is short and rarely revised.

HCIA-AI or HCIA-AI Solution?

Huawei runs two associate AI credentials, and they are not tiers of each other. HCIA-AI is H13-311 and HCIA-AI Solution is H13-313. Both are 60 questions in 90 minutes, both score 600 out of 1000, and both cost 200 USD, so the choice is entirely about content rather than about difficulty or commitment.

The split is roughly technology against application. H13-311 spends its weight on the models and the frameworks; H13-313 is keyed to its own separate training material and distributes its marks differently across a solution-focused blueprint. If your work is understanding how models are built, take the first. If it is positioning and delivering AI solutions, read the second blueprint before choosing.

Huawei’s wider scheme follows the same associate, professional and expert ladder used across its tracks, and the expert-level big data credential shows how much deeper the demands become higher up, which is useful context when deciding whether the associate tier is a destination or a starting point.

Who should take this exam?

HCIA-AI suits ICT professionals adding AI literacy, students and career changers who want a structured syllabus rather than a course list, pre-sales and solution staff who must discuss AI credibly, and engineers inside Huawei-aligned organisations where the certification carries internal weight. No prerequisite is published.

It is a weak fit for two groups. Practising machine learning engineers will find the depth well below their working level, and would be better served by a professional-tier paper. Anyone who needs a credential recognised primarily in North American hiring will find Huawei’s scheme carries more weight in other markets, which is a positioning question rather than a quality one.

If your interest is infrastructure rather than models, the same vendor’s other associate tracks may fit better, and the Huawei storage certification route covers a track where the day-to-day work looks nothing like an AI syllabus.

How should you prepare?

Study from V4.0 material, weight your time toward deep learning and frameworks, and treat the business process domain as free marks. Ninety minutes for 60 questions is comfortable, so the constraint is coverage rather than speed, and the commonest failure is a candidate strong on classical machine learning who never reached foundation models.

1. Confirm your study material is V4.0 by checking whether it covers foundation models at all.
2. Give the deep learning domain the largest share of your time, since it alone is 18 of the 60 questions.
3. Learn the adaptation vocabulary deliberately: pretraining, fine-tuning, prompting and inference.
4. Build one small model end to end in any framework, so the tensor and training-loop questions describe something you have actually done.
5. Read the business process domain once and revise it twice. It is 15 percent of the paper for very little study effort.
6. Sit a full timed set before booking, and use it to find which of the six domains you have skipped rather than to confirm the one you enjoy.

Do not over-invest in the cutting-edge applications domain. At 5 percent it is worth about three questions, and the material moves faster than any exam can track, so a general awareness of current applications is enough.

Frequently Asked Questions

How many questions are on the H13-311 exam?

Sixty questions in 90 minutes, which allows 90 seconds each.

What is the passing score for HCIA-AI?

Six hundred out of 1000. The scoring is scaled, so the number of correct answers that represents is not published.

How much does the HCIA-AI certification cost?

Two hundred US dollars, scheduled through Pearson VUE. Confirm the current fee at registration, since Huawei does not publish it in a form that can be checked independently.

Which version of the syllabus is current?

The blueprint is keyed to HCIA-AI V4.0 training material, and it includes foundation models and an overview of DeepSeek. Material that does not mention foundation models predates it.

Are there prerequisites for HCIA-AI?

None are published. It is an associate-tier credential and is designed as an entry point.

Which domain carries the most marks?

Basics of Deep Learning and Foundation Models at 30 percent, roughly 18 of the 60 questions.

What is the difference between HCIA-AI and HCIA-AI Solution?

They are separate exams, H13-311 and H13-313, with the same format and price but different blueprints. The first concentrates on models and frameworks, the second on solution delivery.

Does the exam require programming?

Not directly. The framework domain expects you to recognise tensors, computational graphs and training loops rather than to write code under exam conditions.

How long is the certification valid?

Huawei does not publish a validity period where it can be read, so this guide does not state one. Check your certification record after passing.

Is MindSpore knowledge essential?

It appears in the framework domain as the vendor’s own framework, but the concepts tested transfer across frameworks, so experience in another library is useful preparation rather than a handicap.

Conclusion

HCIA-AI is a current associate credential wearing a conventional name. Sixty questions, 90 minutes, 600 out of 1000 to pass, 200 USD, and a blueprint that puts nearly a third of its marks on deep learning and foundation models rather than on classical algorithms.

The version question decides most outcomes. Study V4.0 material, confirm it reaches foundation models, and give that domain the time its weighting deserves. The business process domain is the cheapest 15 percent on the paper, and cutting-edge applications is worth three questions and no more.

Treat the published figures as the catalogue’s rather than the vendor’s, because Huawei’s portal cannot be read from outside a browser, and confirm the fee and terms when you book. Then build one small model end to end, so the framework questions describe something your hands have already done.