Skip to main content
qorionix
ZQ-100foundation
  • Operator

Qorionix Certified Operator

Free, unproctored, under two hours. For the person who signed up and will run this themselves, with no security team behind them.

What this certifies

Written so it could be disproved by watching the holder work. If you cannot imagine the task you would set to test a line of this, it does not belong here.

Can connect a Microsoft 365 tenant, read the posture report it produces, and correctly sort its findings into what the platform already fixed, what needs their approval and what is a business decision only they can make. Can tell from a Sentinel-Q decision record whether the platform acted, proposed or escalated, and why. Can decide, for an organisation under fifty identities with nobody on call, whether a given alert needs somebody woken up tonight or handled on Monday.

What it does not certify

A credential that appears to certify more than it tested is worse than no credential, because a buyer relies on it. This list is never empty on any credential in the programme.

  • Does not certify the ability to configure anything beyond the guided setup. Sign-on policies, network zones and detection tuning are the Administrator credential.
  • Does not certify incident response. It certifies knowing when you are out of your depth, which is a different and more useful skill for this person.
  • Does not certify anything about privileged access, log ingestion or the endpoint sensor beyond installing it on one machine.
  • Is not a security qualification. It says the holder can operate one product; it says nothing about their security knowledge generally.

The job tasks it maps to

Phrased as the person holding the job would phrase it, with where in the product it happens — so the mapping is checkable rather than aspirational.

“Get the organisation set up and connected without calling anybody”
Guided onboarding: organisation creation, Microsoft 365 consent, first discovery run
“Once a day, find out whether anything needs me”
The posture queue and the alert queue, and the distinction between them
“Decide whether to approve a change the platform is proposing”
The done / approve / decide grouping, and the undo control
“Answer my insurer or my largest customer when they ask what we do about security”
The posture report and the evidence bundle, exported
“Know when to stop and get help”
The escalation record, and the support route

Getting here

Prerequisites

None. There is no gate on this credential and there will not be one.

Recommended experience

No prerequisites and no experience assumed. If you administer your own Microsoft 365 tenant — even badly — you have enough. There is no gate on this and there will not be one.

Recertification

Valid for 24 months

A free fifteen-item reassessment, unproctored, in your browser, covering what changed in the product since you passed. Twenty-four months rather than twelve because reading a finding and knowing when to escalate is the slowest-moving material in the programme, and because a person who is not paid to do this will not renew annually — they will just let it lapse.

Price

Free, permanently

Free forever, including renewals. Its job is to reduce churn and support load, not to generate revenue. The practice exam is sat in the console with no purchase.

Holding this is a prerequisite for ZQ-200 Qorionix Certified Administrator, ZQ-250 Qorionix Certified Evidence and Audit Analyst.

How you would prepare, and how you would be assessed

What the labs assume

  • Your own Qorionix organisation. There is no shared practice tenant, so the exercises run against your real Microsoft 365 — which is deliberate: every one of them is a read or a reversible change.
  • Microsoft 365 with a global administrator who can grant application consent. If that is not you, Module 2 needs fifteen minutes of their time.
  • One Windows or Linux machine you are allowed to install software on, for the single sensor exercise in Module 4.