IICTI Certified Firewall Administrator

Holders demonstrate that they can apply and evaluate firewall architecture, segmentation and Zero Trust design, rulebase engineering, optimisation and lifecycle governance, application identification, user identity and TLS inspection and intrusion and threat prevention tuning, plus 7 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Firewall Administrator.

Who it is for: Professionals working, or preparing to work, in security roles.

1. 01Firewall architecture, segmentation and Zero Trust design13% of the exam

   • Architect segmentation strategies that contain lateral movement while preserving business connectivity.
   • Scope: Zone and trust models, internal segmentation and microsegmentation, NIST SP 800-41 Rev. 1 and SP 800-207 Zero Trust architecture.
2. 02Rulebase engineering, optimisation and lifecycle governance12% of the exam

   • Evaluate and optimise complex rulebases to enforce least privilege and reduce policy risk.
   • Scope: Rule ordering, shadowed and redundant rule analysis, object hygiene, rule usage analytics, periodic recertification and policy management tools.
3. 03Application identification, user identity and TLS inspection6% of the exam

   • Design next-generation inspection policies that balance visibility, performance and privacy obligations.
   • Scope: Application identification, directory and identity-provider integration, TLS 1.3 decryption trade-offs, ECH impact, certificate pinning and legal or privacy exemptions.
4. 04Intrusion and threat prevention tuning5% of the exam

   • Evaluate threat prevention efficacy and tune signatures to maximise detection with acceptable noise.
   • Scope: IPS profile tuning, Snort 3 and Suricata rules, false-positive management, virtual patching, sandboxing, DNS security and STIX/TAXII threat feeds.
5. 05NAT, IPsec and remote access architecture15% of the exam

   • Design secure, scalable site-to-site and remote access connectivity with future-proof cryptography.
   • Scope: NAT design patterns, IKEv2 and route-based VPN, crypto policy and CNSA 2.0, post-quantum hybrid key exchange readiness (RFC 9370), ZTNA as VPN replacement.
6. 06High availability, clustering and performance engineering6% of the exam

   • Architect firewall deployments that meet availability and throughput targets under full inspection.
   • Scope: Active/passive and active/active clustering, state synchronisation, asymmetric flow handling, session table sizing, hardware offload and inspection throughput.
7. 07Cloud-native and virtual firewall deployment5% of the exam

   • Design consistent network security controls across hybrid and multi-cloud environments.
   • Scope: AWS Network Firewall, Azure Firewall, security groups and NSGs, Gateway Load Balancer insertion, Kubernetes network policies and SSE/FWaaS.
8. 08Firewall policy automation and policy-as-code4% of the exam

   • Lead automation of firewall policy lifecycles with validated, auditable and reversible changes.
   • Scope: Vendor REST APIs, Terraform and Ansible, CI validation of policy changes, drift detection and automated change workflows.
9. 09Logging, monitoring and SIEM integration9% of the exam

   • Design firewall telemetry pipelines that support detection, investigation and compliance evidence.
   • Scope: Traffic and threat log design, syslog/CEF and IPFIX export, SIEM correlation use cases, retention requirements and alert tuning.
10. 10Traffic flow analysis and advanced firewall troubleshooting16% of the exam

    • Diagnose complex connectivity and inspection failures through systematic traffic flow analysis.
    • Scope: Packet processing order, session table and flow debugging, packet captures, NAT and routing interaction, MTU and asymmetric routing faults.
11. 11Compliance, audit and firewall change governance9% of the exam

    • Evaluate firewall governance against regulatory and standards requirements and lead remediation of audit findings.
    • Scope: PCI DSS 4.0 requirement 1, ISO/IEC 27001:2022 network controls (A.8.20 to A.8.22), NIS2, CIS Benchmarks, change approval and audit evidence.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner