Skip to main content
qorionix
ZQ-250X

Qorionix Certified Evidence and Audit Analyst — exam blueprint

Forty-five items in ninety minutes, proctored, weighted heavily towards audit-trail integrity — the one domain in this credential that is genuinely technical and the one an auditor will press hardest on.

The mechanics

Items
45
Duration
90 min
Pass mark
72%
Weighted domains
4

Item format

  • Twenty-four single-answer multiple choice, all scenario-framed around an audit or a request.
  • Ten multiple-response, no partial credit.
  • Six document-critique items: an extract from an evidence bundle or a questionnaire response, with the question 'what would an auditor challenge here?'
  • Five free-response items of up to 250 words, human-scored against a published rubric. Three of them require the candidate to write a sentence they would actually send to an auditor.

Proctoring

As ZQ-200X: designed for remote proctoring with identity verification, and in honour mode until a provider is configured, with the credential recording which.

Retakes

As ZQ-200X: 24 hours, then 14 days, then 60 days.

Languages

English at launch. The regulatory-delta section of the renewal is member-state specific and will be authored per jurisdiction rather than translated, because a translated summary of another country's transposition is worse than none.

Accommodations

As ZQ-200X.

Weighted domains

Every weight is set by the cost of getting that domain wrong in a live tenant, not by how much content there is to teach. Each line below is a scoreable objective.

  1. Domain 1. Obligations and framework mapping

    25%

    • Map each NIS2 Article 21 measure category onto a platform capability, a policy document or an organisational behaviour.
    • State the Article 23 reporting sequence and its deadlines.
    • Explain how management liability changes who the evidence is for.
    • Trace a finding to its DORA and ISO 27001 references and judge whether the mapping is defensible.
    • Describe the categories of personal data the platform holds about an employee, and the retention that applies.
    • Identify a control that exists for the audit rather than for the risk.

  2. Domain 2. The evidence bundle

    25%

    • Name the subsystem that produced each section of a bundle.
    • Distinguish an artefact derived from measured data from one derived from configuration.
    • Review a bundle adversarially and identify what an auditor would challenge.
    • List the Article 21 measures for which the platform produces nothing.
    • Draft a twenty-four-hour early warning from an incident record, and separate it from the later notification.
    • Recognise a bundle whose apparent cleanliness is an absence of data.

  3. Domain 3. Audit-trail integrity

    30%

    • Explain hash chaining and keyed digests to a non-cryptographer.
    • Interpret a verification result and distinguish a linkage failure from a content failure.
    • State the divergent first-hour procedure for each result.
    • Explain why a linkage-only verifier reports an edited attribution field as intact.
    • State three things an intact chain does not prove, and distinguish integrity from completeness.
    • Distinguish a machine actor from a human actor and produce the list of changes made without a human in the loop.
    • Recognise that a representation mismatch and real tampering produce the same result, and act correctly under that uncertainty.

  4. Domain 4. Answering people, and coverage honesty

    20%

    • Produce and review a data-subject export, including third-party data in it.
    • Answer a residency question accurately, including the unverified inference position.
    • Answer a zero-day question without lying or losing the deal.
    • Identify the questions requiring a contractual commitment and route them rather than answer them.
    • Produce a complete coverage-gap register with a reason per line.
    • Explain a skipped check to an auditor in a way that does not read as an excuse.

Sample items

Published with their answers and their rationale, which is unusual and deliberate: the samples are how a candidate or an employer judges whether the blueprint is honest. Every item here is held to one rule — if it could be answered by somebody who had memorised the navigation, it is a screenshot rather than a question, and it has been rewritten.

  1. Item 1Audit-trail integrity

    A scheduled verification returns content at row 40,112, in a tenant where the operations team deployed a database maintenance script the previous night. Your colleague says this is almost certainly a serialisation artefact from the maintenance and proposes closing it. It is 09:20. What do you do in the next hour, and what do you tell the customer?

    Model answer
    Treat it as tampering until proven otherwise. Preserve state before investigating — take a copy of the affected rows and the surrounding chain, and do not run anything that rewrites them. Notify whoever owns incident response, and establish whether the maintenance script had write access to that table, which is the fact that decides between the two hypotheses. Tell the customer that an integrity check has reported a discrepancy, that the cause is under investigation, and give a time for the next update. Do not tell them it is probably nothing.
    Why, and what the wrong answers get wrong
    The colleague's hypothesis is genuinely plausible: a representation mismatch — key ordering, numeric normalisation, timestamp precision, fixed-width padding — produces a content result identical to real tampering, and maintenance scripts are a realistic cause. It is still the wrong action, for two reasons. The default must be the worse hypothesis when both are consistent with the evidence, and 'probably a false positive' is a sentence you cannot walk back if it turns out to be an intrusion. The productive investigative step is narrow and specific: whether that script could write to that table. Candidates who lead with the false-positive explanation fail the item even where their technical reasoning is correct, because the failure here is one of sequencing and communication rather than of knowledge.
    The judgement being assessed
    Whether the candidate can hold a plausible benign explanation and still act on the adverse one, and whether they know that preservation precedes investigation.
  2. Item 2Answering people, and coverage honesty

    A prospective customer's questionnaire asks: 'Is all customer data, including data processed by AI models, stored and processed within the European Union? Yes/No, with evidence.' Your organisation is bound to a European home region. Write the answer.

    Model answer
    A partial yes with the boundary named. The organisation is bound to a declared home region and a request originating from another region is refused rather than served — that is an enforced architectural mechanism and it is evidenced. AI inference is a separate question and the honest answer is that it is reported as unverified, because the model provider offers no contractual guarantee about inference geography. A contractual residency addendum is available at the top tier; an EU-resident inference add-on is priced and not available, and we do not sell it until the guarantee exists.
    Why, and what the wrong answers get wrong
    A bare 'yes' is the failing answer and it is the tempting one, because the architectural binding is real and a candidate can convince themselves the question is answered. The question specifically includes AI processing, which is the part not covered. A bare 'no' is also failing: it discards a real and evidenced control and will lose a deal that did not need to be lost. The scored elements are naming the mechanism, naming the boundary, and stating the add-on's unavailability rather than implying it can be bought.
    The judgement being assessed
    Whether the candidate can give a partial answer with the boundary drawn in the right place, under commercial pressure to give a whole one.
  3. Item 3The evidence bundle

    You produce a bundle for a tenant onboarded five weeks ago. It shows 82 posture checks with 71 passed, 11 skipped and 0 failed; an incident history containing nothing; and a behavioural baseline marked as established. The compliance officer is delighted. What are the two things you tell her before this goes to the auditor?

    Model answer
    First, that zero failed with eleven skipped is not a clean result — the skipped checks are checks that could not run, most likely on licence grounds, and an auditor will ask what they were and whether any of them cover a measure the organisation claims. Second, that an empty incident history after five weeks is an absence of data rather than evidence of safety, and an experienced auditor reads it that way; the bundle should be accompanied by the coverage-gap register rather than presented alone.
    Why, and what the wrong answers get wrong
    Both findings are visible in the numbers and both are the opposite of the emotional reading. The skipped-check point is the one this credential exists for: a skipped check reported as anything other than skipped would be the worst defect in the product, and an analyst who does not proactively surface the eleven has left the organisation's weakest point for the auditor to discover. The empty-history point tests whether the candidate understands that a five-week-old tenant is thin rather than secure. A candidate who mentions only one of the two has half the answer and scores half the item.
    The judgement being assessed
    Whether the candidate reads an evidence artefact adversarially by default, and whether they distinguish absence of evidence from evidence of absence in a context where the organisational incentive is to conflate them.

Prepare with ZQ-250’s course

Every objective in every domain above maps to a lesson. The course is free in the console and it is the only preparation material there is — there is no separate paid study guide and there will not be one.

Open the course