Skip to main content
qorionix
ZQ-200X

Qorionix Certified Administrator — exam blueprint

Sixty items in two hours, proctored. Two domains carry a per-domain floor as well as contributing to the overall mark, because a candidate can pass on aggregate while being dangerous in a specific area.

The mechanics

Items
60
Duration
120 min
Pass mark
72%
Weighted domains
6

Item format

  • Thirty-four single-answer multiple choice, scenario-framed.
  • Fourteen multiple-response with an explicit 'select all that apply', no partial credit.
  • Six ordering items — rollout sequences, diagnostic sequences, policy evaluation order.
  • Four case studies of three items each, sharing one described tenant.
  • Two free-response items of up to 200 words, scored against a published rubric by a human. These are the items that carry the 'explain it to a manager' objective, which no multiple-choice format measures.

Proctoring

Designed for remote proctoring with identity verification, because this is a paid credential a buyer may rely on. Until a proctoring provider is configured the exam runs in honour mode — timed, one active attempt, nobody watching — and the credential it issues records proctored: no, so the public verifier shows the difference rather than hiding it.

Retakes

First retake after 24 hours, second after 14 days, third after 60 days. No fourth attempt within twelve months. The escalating waits are there because immediate retakes reward item memorisation rather than learning.

Languages

English at launch. Same intended order as ZQ-100X.

Accommodations

Time-and-a-half or double time, and a separate room where a proctored centre is used. Requires documentation, as proctoring makes an unverified accommodation an integrity problem rather than a kindness.

Weighted domains

Every weight is set by the cost of getting that domain wrong in a live tenant, not by how much content there is to teach. Each line below is a scoreable objective.

  1. Domain 1. Identity, policy and delegation

    22%

    • Predict the outcome of an ordered sign-on policy for a given sign-in, and identify a rule made unreachable by ordering.
    • Read a per-rule decision trace and explain why each non-winning rule did not apply.
    • Configure risk-conditioned step-up authentication and interpret a stored signal breakdown.
    • Rank available factors by phishing resistance and justify the ranking mechanically.
    • Predict the interaction between an allow zone and a deny zone, and identify the traveller failure mode.
    • Build a delegated role granting exactly one capability, and verify the boundary by attempting a second.

  2. Domain 2. Federation and provisioning

    13%

    • Configure inbound SAML and complete a real sign-in.
    • Name the assertion checks beyond signature validity and state what each prevents.
    • Given a refused assertion, decide whether the fix is in the platform or the identity provider.
    • Choose between an OIDC client and an API key for a described integration.
    • State the current limitation of inbound SCIM provisioning and decide whether to depend on it.
    • Design a leaver process, given that deprovisioning is never automated.

  3. Domain 3. Log collection and verification

    17%

    • Choose the ingest paths for a described estate and sequence their enablement.
    • Prove a log source works by locating a specific injected event, not by reading a status indicator.
    • Diagnose a source that is configured, reachable and delivering nothing.
    • Inspect an ingested event and determine which fields are actually populated.
    • Trace a rule match through tenant overrides, aggregation, cooldown and the shadow gate, and name the suppressing gate.
    • State which ingest paths should not be relied upon today, and why.

  4. Domain 4. Endpoint deployment and response

    18%

    • State per-platform telemetry availability and predict which detections cannot fire where.
    • Deploy the sensor at fleet scale and produce an update plan given that no auto-updater exists.
    • Run a telemetry-depth probe and distinguish a reporting host from a merely present one.
    • Take and reverse a quarantine, and locate the vaulted original.
    • Isolate and un-isolate a host, and state what was snapshotted before the change.
    • Explain why an action class with no undo handle is never taken unattended.

  5. Domain 5. Detections and tuning

    13%

    • Read a rule and state its required telemetry, firing condition and documented false positives.
    • Distinguish a rule you shadowed from one shadowed because its fields are unpopulated.
    • Tune a noisy rule using threshold and window rather than severity, and predict the risk-score effect.
    • Choose correctly between suppression, shadow mode and a threshold change.
    • Use the ATT&CK mapping to answer a coverage question in a form an auditor accepts.

  6. Domain 6. Sentinel-Q: reading, bounding, defending

    17%

    • Read a decision record in the correct order and identify the limiting factor.
    • Explain the ordering of the grounding check relative to the confidence floor.
    • Predict which actions a given autonomy tier makes available, and which remain capped.
    • State the autonomy of a multi-step sequence given the autonomy of its steps.
    • State the fallback when the tenant policy lookup fails, and why the alternatives are worse.
    • Determine whether a decision came from the grounded agent or the deterministic fallback.
    • Explain a decision to a non-technical manager in under two minutes.

Sample items

Published with their answers and their rationale, which is unusual and deliberate: the samples are how a candidate or an employer judges whether the blueprint is honest. Every item here is held to one rule — if it could be answered by somebody who had memorised the navigation, it is a screenshot rather than a question, and it has been rewritten.

  1. Item 1Sentinel-Q: reading, bounding, defending

    You set a rule to the acting tier and opted in to session revocation. A decision on that rule proposes a two-step sequence: revoke the user's sessions, then disable the account pending review. The record shows the sequence was queued for approval rather than executed, with confidence 0.97 and grounding passed. Your colleague concludes the opt-in did not save. Is he right, and what is the mechanism?

    Model answer
    He is wrong. The sequence waited because a chain's autonomy is the minimum of its links, not the maximum: account disablement sits below the acting tier on the capability ceiling regardless of your tier or your opt-in, so the whole sequence is capped at recommendation. Crucially it did not execute the permitted half and stop — that would leave you working out which parts ran.
    Why, and what the wrong answers get wrong
    Three plausible wrong answers are all available: that the opt-in failed to persist, that 0.97 fell below a raised floor, or that grounding blocked it. The record excludes all three explicitly, and a candidate who ignores that is not reading the record. The correct answer requires holding two independent limits at once — the per-rule tier and the per-action ceiling — and knowing the chain rule. The final sentence matters as much as the first: partial execution of a sequence is the behaviour an administrator most fears and it is specifically prevented.
    The judgement being assessed
    Whether the candidate can reason about two orthogonal permission systems combining, and whether they read the evidence in the stem before reaching for a hypothesis.
  2. Item 2Log collection and verification

    A syslog source has shown as connected for three weeks. The firewall it points at is definitely sending — you have confirmed with a packet capture on the listener. Searching for any string from those messages returns nothing. A colleague suggests raising a ticket for a search indexing bug. What is the more likely cause, and what would confirm it in under five minutes?

    Model answer
    The listener almost certainly has no organisation resolution for that source, so it accepts the traffic and discards all of it while appearing healthy. Confirm by checking whether the source is bound to an organisation; a listener with no binding drops one hundred percent of what it receives.
    Why, and what the wrong answers get wrong
    The packet capture is the important detail: it eliminates network and configuration-on-the-device causes and localises the loss to somewhere between receipt and storage. Search indexing is the wrong hypothesis because it would not explain a total absence with no partial results. This item is drawn from a real defect shape — a complete, working listener that dropped everything because nothing supplied it with a tenant resolver — and the general skill is recognising that 'accepted and discarded' is a distinct failure mode from 'never arrived', with a different diagnostic.
    The judgement being assessed
    Whether the candidate uses evidence to narrow a fault to a stage rather than guessing at the most recently learned subsystem, and whether they know that a healthy indicator is not evidence of delivery.
  3. Item 3Endpoint deployment and response

    You have deployed the sensor to 180 hosts. All 180 appear in the console, all show as healthy, and the fleet has produced four alerts in three weeks — all four from the same eight Linux servers. Your Windows estate is 150 of the 180. Is this good news? What is the single check you run, and what would a bad result look like?

    Model answer
    It is not good news; it is the shape of a telemetry problem. Run a depth probe: on a Windows host, spawn a chain that writes a distinctively named file, then confirm in the console that you can see the writing process, its parent, and both command lines. A bad result is the host being present and the activity absent, or present with the process name but no command line or parent — a fleet reporting heartbeats and nothing behavioural looks identical to a healthy one on any dashboard.
    Why, and what the wrong answers get wrong
    The distribution is the clue: 150 Windows hosts producing zero alerts while eight Linux servers produce four is not a plausible threat distribution, it is a plausible telemetry distribution. A candidate who answers 'good news, quiet estate' has made the single most consequential mistake available in this domain. A candidate who answers 'check agent health' has not understood that agent health is exactly what is misleading them. The depth probe is the habit the course installs and the reason this item exists.
    The judgement being assessed
    Whether the candidate distrusts a green dashboard when the data distribution contradicts it, and whether they know a concrete, repeatable check rather than a category of check.

Prepare with ZQ-200’s course

Every objective in every domain above maps to a lesson. The course is free in the console and it is the only preparation material there is — there is no separate paid study guide and there will not be one.

Open the course