Skip to main content
qorionix
ZQ-100X

Qorionix Certified Operator — exam blueprint

Thirty items in forty-five minutes, free and unproctored. Weighted towards judgement about escalation rather than towards product navigation, because that is the decision this credential exists to certify.

The mechanics

Items
30
Duration
45 min
Pass mark
70%
Weighted domains
4

Item format

  • Twenty-two single-answer multiple choice, all scenario-framed.
  • Six multiple-response, where selecting a wrong option costs the item.
  • Two short ordering items: given four findings, put them in the order you would work them.
  • No drag-and-drop, no simulations, no code. Nothing requiring a mouse-precision skill this learner does not need.

Proctoring

None, by design. An unproctored free credential can be cheated and that is an accepted cost: its purpose is that the holder can operate their own tenant, and somebody who cheats their way past it has only harmed themselves. The two paid technical exams are a different matter.

Retakes

Immediate, unlimited, free. A second attempt draws different items from the same blueprint.

Languages

English at launch. German, French, Dutch, Romanian and Polish are the intended order, driven by where customers actually are rather than by market size.

Accommodations

Time-and-a-half available on request with no documentation required, on the reasoning that requiring a diagnosis letter for an unproctored free assessment filters out honest people and nobody else.

Weighted domains

Every weight is set by the cost of getting that domain wrong in a live tenant, not by how much content there is to teach. Each line below is a scoreable objective.

  1. Domain 1. What the product does, and does not

    20%

    • State the coverage claim, including the qualifier about known attack patterns.
    • Apply the published hard limits to a described organisation.
    • Identify the two disqualifying conditions: no ability to deploy software to endpoints, and a requirement for a named human on call.
    • Recognise which capabilities are priced and unavailable rather than included.
    • Explain why the first fortnight of behavioural detection is quieter, and that this is a property of the data.

  2. Domain 2. Connecting Microsoft 365, and the first hour

    20%

    • Sequence the steps from organisation creation to a completed posture report.
    • Identify which requested permissions allow change and which are read-only.
    • Distinguish a discovery run still working from one that has stalled.
    • Determine which checks a given Microsoft licence permits, and what happens to the rest.
    • Explain why a skipped check must never be reported as a passed check.

  3. Domain 3. Reading the report and working the queue

    30%

    • Interpret a finding, including its identifier, severity and mapped obligations.
    • Order findings by what to do first, using both severity and blast radius.
    • Sort a change correctly into done, approve or decide.
    • State which changes the platform makes without asking, and why every multi-factor and Conditional Access change is deliberately excluded.
    • Reverse a change and locate both entries in the audit trail.

  4. Domain 4. Alerts, decisions and escalation

    30%

    • Distinguish a posture finding from an alert and choose the right response pattern.
    • Read a decision record and state whether the platform acted, proposed or escalated, and why.
    • Decide between act now, act tomorrow and no action, given a decision record and a time of day.
    • Recognise a low-confidence escalation as correct behaviour and say what it implies about the evidence.
    • Assemble the information that makes a support request answerable on the first reply.

Sample items

Published with their answers and their rationale, which is unusual and deliberate: the samples are how a candidate or an employer judges whether the blueprint is honest. Every item here is held to one rule — if it could be answered by somebody who had memorised the navigation, it is a screenshot rather than a question, and it has been rewritten.

  1. Item 1Alerts, decisions and escalation

    At 03:14 an alert fires on a laptop belonging to your bookkeeper. Sentinel-Q's record shows a confidence of 0.4, a disposition of true positive, and a classification of escalate to human. The rule is set to the acting tier and your organisation has opted in to endpoint isolation. Nothing was isolated. What does that combination tell you, and what do you check first?

    Model answer
    It tells you the platform reached a true-positive conclusion but could not support it well enough to act, and that the block was the confidence floor rather than your configuration — the tier and the opt-in were both permissive. Check the cited evidence first: specifically which citations failed to corroborate, because that is what held the confidence at 0.4.
    Why, and what the wrong answers get wrong
    The instinct is to check whether autonomy is misconfigured, and here it demonstrably is not — the tier and the opt-in permitted the action, so the limiter must be one of the gates the server applies regardless. Confidence below the floor degrades an action to a recommendation and records both numbers. The evidence is the productive place to look because a low confidence on a true positive nearly always means a source was unavailable or a corroborating lookup failed, and that is a fixable operational problem in your tenant rather than a fact about the threat. Answering 'raise the floor' or 'lower the floor' fails the item: the floor did its job, and an operator who reaches for it first is the operator who will later disable it.
    The judgement being assessed
    Whether the candidate reads a decision record in the correct order — configuration, then gate, then evidence — rather than reaching for the setting they most recently learned about.
  2. Item 2Reading the report and working the queue

    Your report contains four findings. (1) A critical finding that legacy sign-in protocols are enabled; fixing it will break a networked printer and one contractor's laptop. (2) A high finding that two administrator accounts are used for daily email. (3) A medium finding that mailbox auditing was disabled, which the platform has already enabled. (4) A low finding that a service account has not signed in for 200 days. It is Thursday afternoon. What do you do, and in what order?

    1. A. 1, 2, 3, 4 — strictly by severity.
    2. B. 2 first, then 4, then 1 next week with the printer owner, and nothing for 3.
    3. C. 3 first since it is already done, then 1, then 2, then 4.
    4. D. Nothing today; schedule all four for a change window.
    Keyed answer
    2 first, then 4, then 1 next week with the printer owner, and nothing for 3.
    Why, and what the wrong answers get wrong
    Finding 3 requires no action at all — it is in the done column, and an operator who does not notice that is about to duplicate work. Finding 2 is high severity with a near-zero blast radius: separating administrative accounts from daily email affects two people who both work for you and can be told this afternoon. Finding 4 is low severity and near-zero blast radius, so it is cheap to clear and shortens the list. Finding 1 is the highest severity and by far the highest blast radius, and it is Thursday: turning off legacy authentication before a weekend, when the person who owns the printer is not reachable, converts a security improvement into a Monday outage. Strict severity ordering is the wrong answer and it is the most common one.
    The judgement being assessed
    Whether the candidate can hold severity and blast radius in mind at once, and whether they notice that one of the four items is not theirs to action.
  3. Item 3What the product does, and does not

    A prospective customer runs a 40-person accountancy practice. They are entirely on Microsoft 365 Business Premium, they have no IT staff, they have a compliance deadline in six weeks, and their managing partner says the requirement is that 'somebody is watching overnight so we can sleep'. What do you tell them?

    Model answer
    That the platform will investigate every alert within minutes around the clock, and that no human is watching overnight unless they employ one — those are different things and the second is what they asked for. The compliance evidence requirement is met and the six-week timeline is comfortable. If a named human on call is a firm requirement, they need to buy that separately, and we would tell them where.
    Why, and what the wrong answers get wrong
    The item is built on the exact substitution the programme exists to prevent. Continuous automated investigation is real and valuable; a human being awake is neither offered nor implied, and human escalation is priced and unavailable. A candidate who answers 'yes, we monitor 24/7' has failed in the way that produces a cancelled contract in month four. A candidate who answers 'no, we cannot help' has also failed: the compliance requirement and the timeline are both well within what the product does, and the practice is squarely the target customer.
    The judgement being assessed
    Whether the candidate can separate what the product does from what the customer heard, and still recognise a good fit when the stated requirement is partly unmeetable.

Prepare with ZQ-100’s course

Every objective in every domain above maps to a lesson. The course is free in the console and it is the only preparation material there is — there is no separate paid study guide and there will not be one.

Open the course