Skip to main content
qorionix
ZQ-400X

Qorionix Certified Delivery Architect — exam blueprint

Forty items in two hours, proctored, plus a design submission scored against a published rubric. The design carries as much weight as the exam, because no multiple-choice item measures whether somebody can write a deployment document that states its own limits.

The mechanics

Items
40
Duration
120 min
Pass mark
75%
Weighted domains
4

Item format

  • Sixteen single-answer multiple choice, all scenario-framed.
  • Eight multiple-response, no partial credit.
  • Four ordering items on rollout and migration sequencing.
  • Four case studies of two items each, sharing one described regulated organisation.
  • Four free-response items of up to 300 words, human-scored: a limits paragraph, a residency answer, a committee response and a recommendation against a sale.
  • A design submission: a full deployment design for a real or realistic 500–1,000 identity organisation, scored against a five-part published rubric — sizing, sequencing, limits, autonomy justification, and rollback.

Proctoring

As ZQ-200X for the items: designed for remote proctoring with identity verification, and in honour mode until a provider is configured, with the credential recording which. The design is reviewed by a human and may be returned once with specific feedback.

Retakes

Items: 24 hours, then 14 days, then 60 days. Design: two resubmissions, then a twelve-month wait, because a third failed design is a signal about readiness rather than about the rubric.

Languages

English only. A design review requires nuance in the reviewer's language and we will not pretend otherwise.

Accommodations

As ZQ-200X for the items. The design has no time limit beyond a submission window, so no accommodation is required for it.

Weighted domains

Every weight is set by the cost of getting that domain wrong in a live tenant, not by how much content there is to teach. Each line below is a scoreable objective.

  1. Domain 1. Deployment design and sizing

    25%

    • Estimate log volume for a described organisation and compare it against the allowance.
    • Identify where the search architecture stops being adequate, and what to do then.
    • Explain home-region binding precisely, distinguishing it from a residency guarantee.
    • State the AI inference position accurately, including that the add-on is priced and unavailable.
    • Sequence the modules with a gate and a verifiable exit criterion per stage.
    • Write a limits section that a reader can restate correctly back to you.
    • Recognise the organisation shape that should not buy this.

  2. Domain 2. Privileged access rollout

    20%

    • Explain credential injection to an administrator about to lose direct access.
    • State session fidelity per protocol, including the absence of pixel replay for Windows sessions.
    • Determine what proportion of a described estate's privileged access can actually be mediated.
    • Produce a rotation plan by target type with a verification step for each.
    • State the never-automate list and defend it.
    • Distinguish target types verified against real systems from those tested against mocks only, and stage accordingly.
    • Design an approval topology with no self-approval and no single point of human failure.

  3. Domain 3. Autonomy governance

    30%

    • Place a capability on the autonomy ladder and justify the placement.
    • Explain each of the three gated transitions and the failure it prevents.
    • Explain why the model's proposal is not an input to its own permission.
    • Produce a per-action-class justification with blast radius, reversal path and signatory.
    • Apply the principle that the preferred autonomous action is one the affected user can undo by proving who they are.
    • Answer 'what happens when it is wrong?' and 'who is accountable?' with mechanisms rather than reassurances.
    • Define the measurements needed before the first quarterly envelope review, and recognise high agreement produced by an unread queue.

  4. Domain 4. Procurement and migration

    25%

    • Answer residency, sub-processor, encryption and AI-governance questions accurately.
    • Identify the questions requiring a contractual commitment and route them.
    • Use a published refusal as a credibility argument.
    • Produce a migration plan with a dual-send period and a measurable cutover criterion.
    • Compare coverage against an incumbent honestly, including where they are ahead.
    • Define a rollback with a named authoriser.
    • Produce a recommendation against a sale, with reasons and an alternative.

Sample items

Published with their answers and their rationale, which is unusual and deliberate: the samples are how a candidate or an employer judges whether the blueprint is honest. Every item here is held to one rule — if it could be answered by somebody who had memorised the navigation, it is a screenshot rather than a question, and it has been rewritten.

  1. Item 1Autonomy governance

    A risk committee has read that AI agents can be manipulated through the content they process. The chair asks: 'If an attacker puts instructions in a filename or a log line, can your AI be talked into isolating our production database server?' You have ninety seconds. Answer it.

    Model answer
    No, and the reason is structural rather than a matter of the model being careful. The function that resolves what may be done autonomously does not read the proposed action at all — it reads the rule's configured tier, the action's capability ceiling, the verified evidence and the confidence. A model persuaded to propose something outside the envelope produces a ticket that waits for a human, exactly as if it had asked politely. On top of that, isolation of a host marked business-critical is not permitted unattended at any tier, so a production database server is outside the envelope before the question of persuasion arises.
    Why, and what the wrong answers get wrong
    The failing answers are 'we prompt it carefully', 'the model is trained not to', and any answer that rests on the model's behaviour. The whole design is that permission resolution is independent of the model's output, and an architect who cannot articulate that in one breath cannot defend the product in this room. The second half of the answer matters too: naming a second independent control — the business-critical exclusion — is what turns a plausible answer into a convincing one, because a committee that has been told about one control will ask what happens when it fails.
    The judgement being assessed
    Whether the candidate can state a structural argument under time pressure, and whether they instinctively name a second independent control rather than resting on one.
  2. Item 2Deployment design and sizing

    A 700-identity manufacturing group, five sites in three countries, wants all four modules. Their security lead insists on deploying endpoint detection first, because their last incident arrived through a workstation and the board has asked what they are doing about endpoints. Identity is currently a mess: no single sign-on, shared accounts on the production line, and an unknown number of dormant accounts. What do you recommend and how do you win the argument?

    Model answer
    Identity first, endpoints second, and win the argument on the security lead's own terms rather than on principle. Endpoint detection deployed onto that estate will produce findings attributed to shared production-line accounts that nobody can act on, and alerts about dormant accounts nobody can attribute to a person — so the board will be shown a dashboard that cannot be acted upon, which is worse for the security lead than a delay. Offer a concession that costs little: deploy the sensor to a named pilot group in week one so there is something to show the board, while identity work proceeds. Their stated need is board evidence, and that need can be met without inverting the sequence.
    Why, and what the wrong answers get wrong
    The technically correct sequence is not the hard part; nearly every candidate will say identity first. The item is scored on the second half, because an architect who is right and loses the argument has delivered nothing. The winning move is recognising that the stated requirement — board evidence about endpoints — is separable from the proposed solution, and that a scoped pilot satisfies it. A candidate who answers only 'identity first, because the other modules produce unactionable findings' gets partial credit; a candidate who overrides the customer's stated need scores poorly regardless of being right.
    The judgement being assessed
    Whether the candidate can distinguish a customer's requirement from the customer's proposed solution, and construct a sequence that satisfies the first without conceding the second.
  3. Item 3Procurement and migration

    You are migrating a customer off an incumbent endpoint product with a strong published detection catalogue. Your coverage comparison shows the incumbent ahead in two areas that matter to this customer. The account manager asks you to leave those two rows out of the customer-facing comparison, on the grounds that the overall case is still strong. What do you do, and what do you write?

    Model answer
    Keep both rows and write them plainly, because the customer will find out during the dual-send period — which is the point of having one — and finding out then costs more than the deal is worth. The paragraph names the two areas, says what the customer loses, states what compensates for it if anything does, and says what would have to change for us to close the gap. If the overall case is genuinely strong it survives two honest rows; if it does not survive them, the migration was going to fail in month three and we have learned that cheaply.
    Why, and what the wrong answers get wrong
    This is the item that most directly tests whether the credential means anything. The commercial pressure in the stem is realistic and the requested omission is not obviously dishonest — nobody is asked to state a falsehood. The failing answers are complying, and refusing without producing the alternative. The scored elements are keeping the rows, writing the compensating detail, and the argument that the dual-send period will surface the gap anyway, which converts an ethical position into a commercial one and is what actually persuades an account manager.
    The judgement being assessed
    Whether the candidate holds an honest position under commercial pressure and can make the commercial argument for it, rather than the moral one.

Prepare with ZQ-400’s course

Every objective in every domain above maps to a lesson. The course is free in the console and it is the only preparation material there is — there is no separate paid study guide and there will not be one.

Open the course