SA-APEX · exam structure

You can’t break what you can’t build.

Every other certification hands you a target somebody else configured. SA-APEX makes you build one first — and then puts you in front of one you have never seen, built by somebody who is not us.

Check your eligibility Full exam structure

Why

A target you were handed teaches you the target. A target you built teaches you the technology.

There is a kind of tester who can run a methodology against a prepared range and produce a credible-looking result, and who falls apart the moment the estate is inconsistent, undocumented, half-migrated and configured by four different people over six years — which is every real client.

The gap is not tooling. It is that they have never had to make the decisions the defender made. They do not know why that firewall rule exists, because they have never had to write one that someone depended on. They do not know where the seam is between the hypervisor and the storage network, because they have never built one.

So the exam makes you build it. Then it takes your build away and gives you someone else’s.

Phase B

The build

You design, deploy and configure a working enterprise estate. Not a lab of three virtual machines — a routed, segmented, multi-platform environment with identity, remote access, perimeter control, endpoint management, mobile devices and a voice platform that actually carries calls.

Cloud and virtualisation

AWSAccounts, identity, network, workloads and control-plane logging built and configured by the candidate.
VMwareHypervisor cluster, virtual networking, storage and management plane.
ProxmoxA second, differently-administered virtualisation stack — heterogeneous estates behave differently under attack.

Network

BGPWorking external routing with policy, not a default route.
OSPFA routed interior with areas, adjacencies and redistribution the candidate can explain.
VPNRemote access and site-to-site, with authentication and split-tunnel decisions documented.
FirewallSegmentation, policy, NAT, inspection and logging — configured, not defaulted.

Endpoints and servers

WindowsDirectory services, servers and workstations, joined and administered.
LinuxServers and workstations with real service configuration and access control.
macOSManaged workstations, including enrollment and policy.
Endpoint securityEndpoint protection and telemetry deployed and tuned across the fleet.

Mobile and voice

Apple mobileEnrolled, managed devices with policy applied.
AndroidEnrolled, managed devices with policy applied.
VoIPA working voice platform — signalling, media, trunking, provisioning and call routing.

What the build is graded on

Conformance and comprehension — whether every required component is present, reachable and functional, and whether you can explain the design decisions you made and the ones you rejected.

It is deliberately not graded on how hard your estate is to break. Rewarding a hostile build would turn the exam into an arms race between candidates instead of a measurement of engineers.

Phase C

The tooling: a bare Kali box and one API token

You get a clean Kali server and a single AI API token. That is the whole starting inventory. No agent framework, no prepared prompt library, no orchestration layer, and nothing of ours.

You build the system that does the testing: scoped agents with narrow jobs, typed tools with server-side scope checks, evidence capture that survives a replay, cost and time budgets, and a kill switch that actually kills.

And you build the part most people skip: the controls that stop engagement data reaching the model at all.

What has to work before you are scored on findings

Included:Classification of what may and may not enter a model, enforced in code rather than written in a policy.
Included:Outbound inspection for secrets, identifiers, regulated fields and large source blocks.
Included:Per-engagement isolation — no shared index, no shared cache, no cross-contamination.
Included:Canary strings that trip the block and never appear downstream.
Included:Fail-closed behaviour when a provider is unavailable or a policy decision is ambiguous.
Included:An audit trail that reconstructs every model and tool action after the fact.

Fail condition

A thin wrapper around a chat API does not pass this phase. Neither does a system that works right up until it is attacked — the leakage tests are adversarial, and one confirmed exfiltration of protected data ends the attempt regardless of your score elsewhere.

Phase D

The attack: never your own estate

Once your build passes conformance it is anonymised and enters the target pool. You draw a different one. Neither of you knows whose you drew, and the assignment is made by the platform rather than by a person.

How the cross-assignment is kept fair
The risk	What we do about it
Your exam validity depends on somebody else’s build quality.	No build enters the pool until it passes an automated conformance run across every required component. A build that does not stand up is remediated, not assigned.
A candidate builds something deliberately hostile to sabotage whoever draws it.	The build is scored on conformance and comprehension only. Hostility earns nothing, and a build that fails conformance in order to be hard is simply a failed build.
Two candidates draw estates of very different difficulty.	Scored defects are seeded after conformance, from a fixed set per exam form. Everyone is measured against the same objective obligations regardless of whose estate they drew.
Candidates collude — you go easy on mine, I go easy on yours.	Assignment is anonymous and platform-controlled, the seeded defect set is not visible to the builder, and the pool includes reference estates that no candidate in the cohort built.
Somebody’s work becomes exam material for a stranger.	Build submissions are covered by the candidate agreement, held under the same confidentiality terms as exam content, and destroyed to the retention schedule.
A solo candidate has nobody to swap with.	Security Arsenal maintains a reference estate pool built by staff and drawn from retired cohort builds, so the attack phase never waits on scheduling.

Scored

Seeded

A fixed set of defects introduced after conformance. This is what makes scoring comparable across candidates and across forms.

Expert review

Unseeded

Whatever the builder left in the estate on their own. Genuine discoveries here go to a senior reviewer and can earn credit.

Non-compensable

Critical

A designated critical issue that the coverage map makes reasonably discoverable. Missing one is a fail even if everything else you submitted is correct.

The point

This is the part that cannot be studied around.

You can memorise a methodology. You can memorise a range. You cannot memorise an estate that did not exist until another engineer built it three weeks ago, and you cannot bluff your way through a routing design you have never had to make work.

It also means the exam regenerates itself. Every cohort produces the next cohort’s targets, so the content pool grows in a direction nobody can predict — including us.