Certification Program
What this is about
Section titled “What this is about”Anyone using the noris Sovereign Cloud (nSC) should be able to do more than operate the platform: they should be able to apply it properly. That means designing networks cleanly, assigning permissions tightly, storing data encrypted, testing backups, and estimating consumption.
That is exactly what this program aims at. It is role-based and follows established job profiles in cloud operations, because the requirements of a person designing architectures differ significantly from those of a person who automates operations, runs databases, or manages budgets and teams.
The exams are based on the public documentation here on noris.cloud. In other words: you can prepare entirely with freely accessible content, without paid training materials.
Who the program is for
Section titled “Who the program is for”Within these groups, the program addresses everyone who works with the platform, from administration and development to architecture and consulting. Non-technical roles such as procurement and project management will also find a suitable entry point with the entry certificate and the Cloud Service Owner profile.
Structure: ten profiles, two levels
Section titled “Structure: ten profiles, two levels”All learning paths build on a role-independent entry certificate. Ten profiles sit on top of it, each with an entry level (Associate) and an advanced level (Professional). The exception is the Cloud Service Owner, a non-technical profile that only offers the entry level.
| Foundation | Entry | Advanced | |
|---|---|---|---|
| All profiles | noris Cloud Essentials | ||
| Architecture | Platform Architect Associate | Platform Architect Professional | |
| System operations | Infrastructure Administrator Associate | Infrastructure Administrator Professional | |
| Application operations | Application Operations Engineer Associate | Application Operations Engineer Professional | |
| Development | Cloud Native Developer Associate | Cloud Native Developer Professional | |
| Automation | Automation Engineer Associate | Automation Engineer Professional | |
| Security | Security Engineer Associate | Security Engineer Professional | |
| Data | Data Platform Engineer Associate | Data Platform Engineer Professional | |
| Databases | Database Reliability Engineer Associate | Database Reliability Engineer Professional | |
| Artificial intelligence | AI Engineer Associate | AI Engineer Professional | |
| Leadership and management | Cloud Service Owner |
The entry certificate is recommended but not mandatory. For a Professional level, the Associate of the same profile is a prerequisite.
The learning paths in detail
Section titled “The learning paths in detail”The percentages indicate the planned weighting in the exam. Each row links to the documentation you can use to prepare.
noris Cloud Essentials
Section titled “noris Cloud Essentials”Role-independent fundamentals, also suitable for non-technical roles such as procurement and project management. Planned effort: about 8 to 12 hours.
| Learning objective | Weight | Preparation |
|---|---|---|
| Positioning of the platform, sovereignty, locations | 20 % | nSC overview |
| Basic concepts: project, instance, flavor, image, network, router, security group, floating IP | 30 % | OpenStack |
| Users, projects, and roles | 15 % | Zitadel IAM |
| Distinguishing block and object storage | 10 % | S3 Object Storage |
| Placing managed Kubernetes in context | 10 % | Gardener Kubernetes |
| Billing via cloud points | 15 % | Cloud points calculator |
Platform Architect
Section titled “Platform Architect”Designs solutions and justifies decisions.
Associate (entry), planned effort about 25 hours
| Learning objective | Weight | Preparation |
|---|---|---|
| Network fundamentals: networks, subnets, routers, security groups, floating IPs | 25 % | OpenStack |
| Selecting and provisioning instances and images | 20 % | Operating system images |
| Assigning storage: block versus object | 15 % | S3 Object Storage |
| Estimating sizing and consumption | 20 % | Points calculator, Benchmarks |
| Standard processes and security policies | 20 % | see below |
Professional (advanced), planned effort about 40 hours
| Learning objective | Weight | Preparation |
|---|---|---|
| Network architecture: weighing dual-stack against IPv6-only, reverse DNS | 25 % | Dual-stack, IPv6-only |
| Kubernetes architecture: cluster sizing, extensions, handover to operations | 20 % | Gardener Kubernetes |
| Identity federation and tenant separation | 15 % | Zitadel IAM |
| Availability, backup, and recovery as architecture criteria | 15 % | OpenStack, S3 |
| Sovereignty and compliance in architecture | 10 % | nSC overview |
| Standard processes and security policies, advanced | 15 % | see below |
Infrastructure Administrator
Section titled “Infrastructure Administrator”Operates instances, networks, images, and volumes day to day.
Associate (entry), planned effort about 25 hours
| Learning objective | Weight | Preparation |
|---|---|---|
| Creating and managing instances, flavor selection | 25 % | OpenStack |
| Using images and maintaining custom images | 20 % | Operating system images |
| Setting up network access: security groups, floating IPs, key pairs | 20 % | OpenStack |
| Attaching, resizing, and backing up volumes | 15 % | OpenStack |
| Standard processes and security policies | 20 % | see below |
Professional (advanced), planned effort about 40 hours
| Learning objective | Weight | Preparation |
|---|---|---|
| Network variants in operation: dual-stack and IPv6-only | 20 % | Dual-stack, IPv6-only |
| Monitoring and capacity management in ongoing operations | 20 % | OpenStack |
| Systematically isolating and resolving incidents | 20 % | Troubleshooting |
| Assessing performance and interpreting benchmarks | 15 % | Benchmarks |
| Standard processes and security policies, advanced | 25 % | see below |
Application Operations Engineer
Section titled “Application Operations Engineer”Looks after applications and Kubernetes workloads throughout their lifecycle.
Associate (entry), planned effort about 25 hours
| Learning objective | Weight | Preparation |
|---|---|---|
| Creating Kubernetes clusters and setting up access | 25 % | Gardener Kubernetes |
| Deploying and updating applications | 25 % | Gardener Kubernetes |
| Second day operations: scaling, monitoring, cleanup | 20 % | Gardener Kubernetes |
| Connecting object storage to applications | 10 % | S3 Object Storage |
| Standard processes and security policies | 20 % | see below |
Professional (advanced), planned effort about 40 hours
| Learning objective | Weight | Preparation |
|---|---|---|
| Planning cluster extensions and handover to operations | 20 % | Gardener Kubernetes |
| Securing service-to-service communication with a service mesh | 20 % | Istio Service Mesh |
| Handling vulnerabilities and updates | 20 % | Gardener Kubernetes |
| Availability and recovery of applications | 15 % | OpenStack, S3 |
| Standard processes and security policies, advanced | 25 % | see below |
Cloud Native Developer
Section titled “Cloud Native Developer”Builds applications that run on the platform and use its services.
Associate (entry), planned effort about 25 hours
| Learning objective | Weight | Preparation |
|---|---|---|
| Access for applications: application credentials and ACLs | 25 % | Application credentials |
| Using object storage from applications | 20 % | S3 Object Storage |
| Deploying applications on Kubernetes | 20 % | Gardener Kubernetes |
| Knowing platform limits: quotas and common failures | 15 % | OpenStack, Troubleshooting |
| Standard processes and security policies | 20 % | see below |
Professional (advanced), planned effort about 40 hours
| Learning objective | Weight | Preparation |
|---|---|---|
| Provisioning environments automatically: CLI, Ansible, Terraform | 25 % | CLI, Ansible, Terraform |
| Service communication and resilience with a service mesh | 20 % | Istio Service Mesh |
| Keeping access and permissions tight in the development process | 20 % | Zitadel IAM, Application credentials |
| Assessing performance and cost of applications | 15 % | Benchmarks, Points calculator |
| Standard processes and security policies, advanced | 20 % | see below |
Automation Engineer
Section titled “Automation Engineer”Automates provisioning and operation of the platform.
Associate (entry), planned effort about 25 hours
| Learning objective | Weight | Preparation |
|---|---|---|
| Working with the CLI | 25 % | CLI, Ansible, Terraform |
| Application credentials and their ACLs | 20 % | Application credentials |
| Provisioning instances and images automatically | 20 % | Operating system images |
| Isolating and fixing errors | 15 % | Troubleshooting |
| Standard processes and security policies | 20 % | see below |
Professional (advanced), planned effort about 40 hours
| Learning objective | Weight | Preparation |
|---|---|---|
| Infrastructure as code with Terraform and Ansible | 25 % | CLI, Ansible, Terraform |
| Kubernetes operations: access, second day operations, extensions, cluster teardown | 25 % | Gardener Kubernetes |
| Monitoring and backup in ongoing operations | 15 % | OpenStack |
| Handling vulnerabilities and updates | 15 % | Gardener Kubernetes |
| Standard processes and security policies, advanced | 20 % | see below |
Security Engineer
Section titled “Security Engineer”Owns permissions, hardening, and audit trails.
Associate (entry), planned effort about 25 hours
| Learning objective | Weight | Preparation |
|---|---|---|
| Users, projects, and roles in Zitadel IAM | 25 % | Zitadel IAM |
| Limiting rights via application credentials and ACLs | 20 % | Application credentials |
| Defining tight security groups | 20 % | OpenStack |
| Encrypting object data | 15 % | S3 Object Storage |
| Standard processes and security policies | 20 % | see below |
Professional (advanced), planned effort about 40 hours
| Learning objective | Weight | Preparation |
|---|---|---|
| OIDC integration and role models | 25 % | Zitadel IAM |
| Tenant separation across projects | 20 % | Zitadel IAM, OpenStack |
| Handling vulnerability reports and update obligations | 20 % | Gardener Kubernetes |
| Data backup, recovery, and audit trails | 15 % | OpenStack, S3 |
| Sovereignty, data location, and compliance | 20 % | nSC overview |
Data Platform Engineer
Section titled “Data Platform Engineer”Owns data storage, transfer, and performance behavior.
Associate (entry), planned effort about 25 hours
| Learning objective | Weight | Preparation |
|---|---|---|
| Using S3: buckets, access, tooling | 30 % | S3 Object Storage |
| Block storage and volumes on instances | 20 % | OpenStack |
| Encrypting data at rest | 15 % | S3 Object Storage |
| Backup and recovery | 15 % | OpenStack, S3 |
| Standard processes and security policies | 20 % | see below |
Professional (advanced), planned effort about 40 hours
| Learning objective | Weight | Preparation |
|---|---|---|
| Storage architecture: selection, limits, known issues | 25 % | S3 Object Storage, OpenStack |
| Assessing performance and reproducing benchmarks | 25 % | Benchmarks |
| Designing backup and recovery concepts | 20 % | OpenStack, S3 |
| Estimating the cost of data storage | 15 % | Points calculator |
| Standard processes and security policies, advanced | 15 % | see below |
Database Reliability Engineer
Section titled “Database Reliability Engineer”Runs databases self-managed on top of the platform services.
Associate (entry), planned effort about 25 hours
| Learning objective | Weight | Preparation |
|---|---|---|
| Selecting instances and flavors for database workloads | 25 % | OpenStack, Points calculator |
| Storage for databases: performance storage versus local NVMe | 20 % | OpenStack |
| Backing up and restoring volumes | 20 % | OpenStack |
| Restricting database access at the network layer | 15 % | OpenStack |
| Standard processes and security policies | 20 % | see below |
Professional (advanced), planned effort about 40 hours
| Learning objective | Weight | Preparation |
|---|---|---|
| Assessing storage performance and reproducing benchmarks | 25 % | Benchmarks |
| Planning availability and recovery for databases | 25 % | OpenStack, S3 |
| Running database workloads on Kubernetes, weighing pros and cons | 20 % | Gardener Kubernetes |
| Estimating the cost of database operations | 15 % | Points calculator |
| Standard processes and security policies, advanced | 15 % | see below |
AI Engineer
Section titled “AI Engineer”Builds and operates applications with the models of noris AI (nAI) and connects the required data on the platform.
Associate (entry), planned effort about 25 hours
| Learning objective | Weight | Preparation |
|---|---|---|
| Placing the models and tier model of noris AI in context | 20 % | Models, Model selection |
| Setting up API access and sending first requests | 20 % | Quickstart |
| Basic concepts: tokens, context length, cost | 20 % | Token types and billing, AI points calculator |
| Storing data for AI applications on the platform | 15 % | S3 Object Storage |
| Standard processes and security policies | 25 % | see below |
Professional (advanced), planned effort about 40 hours
| Learning objective | Weight | Preparation |
|---|---|---|
| Designing and building RAG pipelines | 25 % | RAG, Building a RAG pipeline |
| Using embeddings and rerankers | 15 % | Embeddings and rerankers |
| Model lifecycle: tiers and deprecation periods | 15 % | Deprecation policy |
| Running AI applications on Kubernetes | 15 % | Gardener Kubernetes |
| Placing data protection and the EU AI Act in context | 10 % | Zero data retention, EU AI Act |
| Standard processes and security policies, advanced | 20 % | see below |
Cloud Service Owner
Section titled “Cloud Service Owner”Manages budgets, requirements, and teams around the platform without working hands-on in the systems. Planned as entry level only, effort about 15 hours. The entry certificate noris Cloud Essentials is mandatory for this profile.
| Learning objective | Weight | Preparation |
|---|---|---|
| Placing sovereignty, locations, and the operator model in context | 25 % | nSC overview |
| Understanding billing: managing cloud points and consumption | 25 % | Cloud points calculator |
| Knowing the offering and the limits of the platform | 20 % | OpenStack, S3 Object Storage, Gardener Kubernetes |
| Responsibilities: what noris delivers, what remains your responsibility | 15 % | nSC overview |
| Planning the qualification of your own team via this program | 15 % | Program structure |
Standard processes and security policies
Section titled “Standard processes and security policies”This content is part of every technical learning path at both levels, with increasing depth. It is the core of what we consider proper use of the platform.
| Topic | What you demonstrate | Preparation |
|---|---|---|
| Least privilege | Assigning roles for a defined purpose, application credentials with restricted ACLs instead of full access | IAM, Application credentials |
| Controlling network access | Defining tight security groups, not exposing administrative access to the open internet | OpenStack |
| Trusted base images | Using only verified images, documenting the origin of custom images | Operating system images |
| Protecting data at rest | Applying encryption to object storage | S3 Object Storage |
| Backup and recovery | Setting up backups and actually testing recovery | OpenStack, S3 |
| Handling vulnerabilities | Following security advisories, scheduling updates | Gardener Kubernetes |
| Incident handling | Isolating errors systematically, knowing the escalation path | Troubleshooting |
Planned exam procedure
Section titled “Planned exam procedure”| Essentials | Associate | Professional | |
|---|---|---|---|
| Format | Multiple choice, online | Multiple choice, online | depending on profile, a practical assignment or a scenario with a technical interview |
| Scope | about 40 questions, 60 minutes | about 60 questions, 90 minutes | 180 minutes hands-on, or a design plus a 45-minute interview |
| Passing score | 70 percent | 70 percent | criteria grid, two examiners |
| Validity | 3 years | 2 years | 2 years |
The Cloud Service Owner is examined in the same format and scope as an Associate.
Recertification should primarily be possible via a short delta exam when the platform changes, not via a full repeat exam.
Reasonable adjustments are granted on request, for example additional time or an adapted exam setup.
Proof of certification is a certificate as PDF with an exam number, plus a digital badge in an open format.
Partner program
Section titled “Partner program”For partner companies and system integrators, an incremental enablement program is planned. The tier depends on the number of people with valid certifications, not on a declaration of intent.
| Tier | Planned requirement | Planned benefits |
|---|---|---|
| Registered | 2 people with noris Cloud Essentials, 1 of them with an Associate | Access to the learning paths, technical contact, test access to the platform |
| Advanced | 4 people with an Associate from at least 2 profiles, 1 of them a Professional | additionally: listing in the partner directory, joint solution development, preferred support |
| Premium | 8 people with an Associate from at least 5 different profiles, at least 3 of them Professional | additionally: joint go-to-market, early information on platform changes, named technical contacts |
The classification is reviewed annually. Expired certifications do not count.
Classification
Section titled “Classification”Frequently asked questions
Section titled “Frequently asked questions”Can I register already? Exams are not yet bookable. Feel free to write to us and we will get in touch as soon as we start.
Can I participate if I am neither a customer nor a partner? Not in the initial phase. Participation is initially open to employees, customers with an active nSC contract, and direct partner companies. Independent of that, you are free to use the content of this page and the linked documentation.
What does participation cost? That has not been decided yet. The intention is to keep the entry certificate broadly accessible.
How do I prepare? With the documentation here on noris.cloud. The learning paths above link every exam topic to the appropriate page. No further materials are needed.
Do I need my own access to the platform? Not for the entry certificate. For the practical parts of the higher levels we provide an exam environment. If you want to practice independently, you can request test access via the cloud points calculator.
Does this also apply to the noris Enterprise Cloud (nEC) and noris AI (nAI)? The AI Engineer profile already draws on noris AI content. Beyond that, we are starting with the nSC; an extension to the noris Enterprise Cloud is planned.
Feedback and contact
Section titled “Feedback and contact”This draft lives on feedback. If you miss a learning objective, find a weighting inappropriate, or are interested as a partner company, write to anfrage@noris.de.