Skip to main content
qorionix
ZQ-200professional
  • IT generalist

Qorionix Certified Administrator

The main technical credential. For the one IT person at a 100–500 person company who owns security alongside four other jobs.

What this certifies

Written so it could be disproved by watching the holder work. If you cannot imagine the task you would set to test a line of this, it does not belong here.

Can configure single sign-on, adaptive multi-factor and network zones for a 200-identity Microsoft 365 tenant, and produce the per-rule decision trace showing which sign-on rule granted a given session and why each earlier rule did not apply. Can deploy the endpoint sensor to Windows and Linux hosts and confirm from ingested events that it is reporting process ancestry and command lines rather than a bare heartbeat. Can change a detection rule's severity or threshold with an audited reason and predict the effect on the affected entity's risk score. Can explain any Sentinel-Q decision — classification, confidence, grounding result, escalation reason — to a manager who is not technical.

What it does not certify

A credential that appears to certify more than it tested is worse than no credential, because a buyer relies on it. This list is never empty on any credential in the programme.

  • Does not certify privileged access management. The PAM proxy, the rotation engines and just-in-time elevation are in the Delivery Architect track, because the organisations that buy PAM are not the ones this person works for.
  • Does not certify multi-tenant operation. One tenant, well run, is the whole scope.
  • Does not certify detection authoring. Tuning an existing rule is in scope; writing a new one is not, and custom authoring is an Enterprise-tier capability in any case.
  • Does not certify that the holder can respond to a real intrusion. It certifies that they can operate the platform's response controls and know which of them are reversible.

The job tasks it maps to

Phrased as the person holding the job would phrase it, with where in the product it happens — so the mapping is checkable rather than aspirational.

“Set up federation so people sign in with their existing account”
SSO, SAML and OIDC configuration; the hardened inbound SAML path
“Make sign-in harder only when it looks wrong, and prove afterwards which rule decided”
Adaptive multi-factor, the ordered sign-on policy engine, the per-rule decision trace
“Stop sign-ins from places we never operate from”
Network zones by address range and country, evaluated before rule matching
“Give the office manager the ability to reset a password without the ability to read the audit log”
Role-based access over the named permission catalogue, and delegated administration
“Get the sensor onto the fleet and confirm it is actually reporting something useful”
MSI, deb and rpm installers; verifying telemetry depth rather than agent check-in
“Stop a rule that fires forty times a day without going blind to the thing it detects”
Per-tenant tuning: severity, threshold, window, cooldown, suppression, shadow mode
“Decide which rules, if any, are allowed to act without asking me”
Per-rule autonomy tier, the action capability ceiling, and per-action-class opt-in
“Explain to my manager what the AI did and why, in a meeting, without notes”
The decision record: classification, confidence, citations, grounding, escalation reason

Getting here

Prerequisites

Full sequence: ZQ-100 → ZQ-200

Recommended experience

Roughly two years administering Microsoft 365 or Entra ID, comfort with a terminal, and having personally deployed software to more than ten machines. The Operator credential is a hard prerequisite; the experience is a recommendation and is not checked, because gating on a CV we cannot verify only filters out honest people.

Recertification

Valid for 12 months

A free twenty-item renewal assessment, unproctored, delta-scoped: it tests what changed in the twelve months since you passed, not the whole blueprint again. Annual because this credential's content genuinely goes stale — several exercises in its course exist only to work around capabilities that are not finished, and those workarounds will stop being correct.

Price

€150 for the exam; the course free

Learning is always free and only the proctored exam is paid — the split Microsoft runs on Learn, and the one that maximises the number of people who can operate the product. Deliberately below Okta's $250 per-exam figure, because our candidate is more often paying for it themselves. Purchased in the console; the price there and the price here are checked against each other at build time.

Holding this is a prerequisite for ZQ-300 Qorionix Certified Multi-Tenant Engineer.

How you would prepare, and how you would be assessed

What the labs assume

  • A Qorionix tenant you can change settings in. Ideally not your production tenant for Modules 1 and 2, because you will lock yourself out at least once — that is a planned part of the exercise.
  • Entra ID P1 or better, if you want the sign-in and Conditional Access exercises to produce data. Without it those checks report as skipped, which is itself one of the lessons.
  • At least two machines you can install the sensor on: one Windows, one Linux. The Linux one should be running a kernel with eBPF available, which in practice means anything current.
  • A second identity provider to federate with, for Module 2. Entra ID, Okta or a self-hosted Keycloak all work; the SAML exercises deliberately include one that fails.