Certification practice for cloud, DevOps, Kubernetes, platform, FinOps, and security engineers.
Cloud certification readiness for modern engineers. The adaptive engine works like a reconciliation loop: every answer moves your difficulty band toward your actual level.
All 37 live certifications hold 500 questions and 500 flashcards. Bank size is not the same as exam readiness, and the gap between them is measured rather than asserted — see docs/EXAM-READINESS.md.
| Certifications scaffolded | 95 across six disciplines (37 live, 55 planned, 3 retired) |
| Live (launchable, with content) | 37 — including 19 of the Top 20 roadmap priorities plus AWS, Azure, GCP, GitHub, Kubernetes, CNCF, FinOps, and HashiCorp tracks |
| Questions authored / live | 20,014 — 18,500 in live banks, 1,004 in the three retired Azure certifications, and 510 in planned certifications (500 in the withdrawn cncf-opa, 10 in starter packs), of a 46,000 target (500 × 92 live and planned) |
| Flashcards authored / live | 20,014 — 18,500 in live banks, 1,004 in retired certifications, and 510 in planned certifications |
Run npm run stats for detailed domain and difficulty distributions across the bank.
Three audits qualify that count, and each is printed into every CI run's job summary.
npm run audit:distractors: 32 of 43 banks give nothing away through the form of their
options. npm run audit:filler: 2,000 questions and 2,000 flashcards across 8 banks are
templated placeholders whose answers cannot be verified. npm run audit:repeats: 29 of
the 37 live banks serve the same item or card more than once — hashicorp-vault draws its 500
questions from 21 distinct option sets. Only aws-sap and the seven banks authored in the
2026-09 wave (azure-az305, azure-ai-apps-agents, aws-soa, aws-aif, cncf-kcna,
cncf-kcsa, gcp-cdl) do not; those seven pass every audit. Nine certifications therefore
need a bank authored from scratch. Starter packs for aws-dea and linux-lfcs are written
to the standard npm run lint:pack enforces and pass it.
The 55 planned certifications appear on the roadmap panel but cannot be launched; 13 of
them still carry placeholder blueprints. Microsoft retired AZ-204, AI-102, and AZ-500 in
2026; those three are marked retired and hidden from the catalogue, and their banks are kept. That is the honest state of things,
and it is exactly where contributions land: see CONTRIBUTING.md.
Everything that makes 500 questions per certification tractable is built: per-certification folders, scaffolders, a machine-enforced validator, lazy per-pack chunks, and progress tracking. What remains is authoring the planned track.
CertOps features official digital certification badge tracks with comprehensive question banks, spaced-repetition flashcards, and verified blueprints. Badges are organized below in ascending order of complexity:
High-level cloud concepts, core architecture principles, digital transformation, and foundational governance.
 |
 |
 |
 |
 |
 |
|---|---|---|---|---|---|
AWS Cloud PractitionerCLF-C02 |
AWS AI PractitionerAIF-C01 |
Azure FundamentalsAZ-900 |
GCP Digital LeaderGCP-CDL |
FinOps PractitionerFOCP |
FinOps FOCUS AnalystFOCUS |
Hands-on implementation, administration, core development, security engineering, and cloud operations.
 |
 |
 |
 |
|---|---|---|---|
AWS Solutions ArchitectSAA-C03 |
AWS DeveloperDVA-C02 |
AWS CloudOps EngineerSOA-C03 |
AWS ML EngineerMLA-C02 |
 |
 |
 |
|---|---|---|
GCP Associate EngineerGCP-ACE |
Azure AdministratorAZ-104 |
Azure AI Apps & Agents DeveloperAI-103 |
 |
 |
 |
 |
 |
 |
|---|---|---|---|---|---|
Kubernetes & Cloud Native AssociateKCNA |
Kubernetes Security AssociateKCSA |
GitOps AssociateCGOA |
OpenTelemetry AssociateOTCA |
Backstage AssociateCBA |
Platform AssociateCNPA |
 |
 |
 |
 |
|---|---|---|---|
Terraform AssociateTA-004 |
Vault AssociateVAULT-003 |
GitHub ActionsGH-200 |
GitHub Advanced SecurityGH-500 |
Advanced distributed systems architecture, enterprise DevOps, deep security specialization, and performance-based engineering.
 |
 |
 |
 |
 |
|---|---|---|---|---|
AWS Solutions Architect ProSAP-C02 |
AWS DevOps Engineer ProDOP-C02 |
AWS Security SpecialtySCS-C03 |
Azure Solutions Architect ExpertAZ-305 |
Azure DevOps Engineer ExpertAZ-400 |
 |
 |
 |
|---|---|---|
GCP Cloud ArchitectGCP-PCA |
GCP Cloud DevOps EngineerGCP-PCDE |
GCP ML EngineerGCP-PMLE |
 |
 |
 |
 |
|---|---|---|---|
Kubernetes AdministratorCKA |
Kubernetes App DeveloperCKAD |
Kubernetes Security SpecialistCKS |
Platform EngineerCNPE |
 |
 |
|---|---|
Terraform AdvancedTF-ADV |
ISC2 Cloud Security ProCCSP |
git clone https://github.com/mchittineni/certops.git
cd certops
node server.js # http://localhost:3000 — no install, no build stepThat is not a simplification: the app has zero runtime dependencies and runs straight
from source as native ES modules. npm install is only needed for the dev tooling:
npm install
npm run dev # Vite dev server with HMR
npm run build # production bundle → dist/ (one lazy chunk per content pack)Node 20 or newer. CI tests on Node 24 and 26.
| Mode | What it does |
|---|---|
| Exam Simulation | Timed, domain-weighted sampling, scored against the real passing threshold, per-domain and per-difficulty breakdown, flag-for-review, question navigator. |
| Practice & Study | Untimed, with an explicit Check Answer step so multi-answer questions aren't spoiled by the first click, then the full architecture explanation. |
| Quick Quiz | Ten questions, instant verdict, answers lock once checked. |
| Flashcards | Flip cards with Leitner-box spaced repetition. Due cards return first, "Again" requeues in-session, mastery persists. |
| Question Bank | Full-text search over every scenario, answer, and explanation with certification / difficulty / domain filters. |
Ten questions drawn from three certifications, the same set for everyone that day and reproducible from the date alone — no backend involved. Tracks a completion streak.
One selector governs every mode:
- Easy — recall and single-service questions
- Medium — applied scenarios with plausible distractors
- Hard — multi-service trade-offs, multi-answer, cost/RTO constraints
- Mixed — sampled across bands and domains in published blueprint proportions
- Adaptive — starts medium; two right escalates a band, two wrong eases one. Linear, no going back — and in exam mode it adapts silently without revealing correctness.
☁️ Cloud Engineering · 🚀 DevOps & SRE · ☸️ Kubernetes & Cloud Native · 🏗️ Platform Engineering · 💰 FinOps · 🔐 DevSecOps & Security
All 95 certifications and the priority order: docs/CERTIFICATION-ROADMAP.md.
| Document | What's in it |
|---|---|
| CONTRIBUTING.md | Setup, the one command that matters, and the ground rules for content |
| docs/CONTENT-ARCHITECTURE.md | Authoring reference: schemas, difficulty conventions, how to get a bank to 500 |
| docs/CERTIFICATION-ROADMAP.md | All 95 certifications, priority order, and the planned → live walkthrough |
| docs/EXAM-READINESS.md | What separates a 500-item bank from an exam-ready one, and which blueprints are verified against their official guides |
| docs/CI-AND-SECURITY.md | Pipelines, SHA-pinned actions, CSP, coverage thresholds, and where the tests live |
| docs/adr/0001-content-architecture.md | Why the content layout is what it is, with measurements and rejected alternatives |
| docs/adr/0002-licensing.md | Why the code and the questions carry different licenses |
| CODE_OF_CONDUCT.md | Contributor Covenant 2.1, plus the no-braindumps rule |
| SECURITY.md | What counts as a vulnerability here, and how to report one |
| CHANGELOG.md | Release history |
npm run check # backup → regenerate index → validate → test with coverage.
# Run before every commit. If it passes, CI passes.
npm run build:content # regenerate catalog/registry/manifest from the filesystem
npm run validate # schema, duplicate, markup, option-letter, and coverage gate
# (--verbose expands planned certs)
npm test # selection · libraries · loader · migration · app flows · scaffolds · server
npm run coverage # the same suite under c8, thresholds from .c8rc.json enforced
npm run audit # fail on any advisory in the shipped (production) dependency tree
npm run stats # progress toward 500 questions per certification
npm run backup # snapshot all authored content to .content-backups/
npm run audit:explanations # fail if any explanation names an option letter (part of validate)
npm run audit:answers # flag questions whose explanation argues against its own keyed answer
npm run audit:filler # inventory templated placeholder content (reports, never fails)
npm run audit:repeats # count items reissued under another framing, and duplicated cards
# (--min-clean 1 is the CI gate; --cert <id> scores one)
npm run lint:pack # score one pack against the authoring rules before it is registered
# (--file <pack> --cert <id> --start <n> --end <m> --quota 7/12/6)
npm run audit:distractors # score how much each bank gives its answer away by form
# (--min-passing 25 is the CI gate; --cert <id> scores one)
npm run audit:length # worklist of option sets whose key is longer than every distractor
npm run fix:explanations # strip parenthesised option-letter references in bulk
npm run fix:options # apply authored option rewrites from a JSON patch, keyed by hash
npm run shuffle # re-randomise option order and re-key answers across every pack
npm run build # build:content → validate → vite build
npm run new:cert -- --id aws-dop --provider AWS --code DOP-C02 \
--title "AWS Certified DevOps Engineer - Professional" \
--category "DevOps & SRE" --tier professional
npm run new:pack -- --cert aws-dop --kind questions --count 50 --difficulty medium
npm run seed:catalog # (re-)seed the Top-50 roadmap; idempotent
npm run icons # regenerate brand marks from simple-icons (devDependency)Filesystem as source of truth. Everything about a certification lives in its own
folder; nothing outside it needs editing to add content. npm run build:content scans the
tree and regenerates three committed index files, so the app still runs with no build step.
src/data/certs/aws-saa/
├── cert.js # blueprint: domains, weights, category, tier, status
├── questions/pack-1.js # default-exported array, ≤150 items
└── flashcards/pack-1.js
Delivery is not the bottleneck; authoring is. At a measured 1.5 KB per question and a 3.06× gzip ratio, one certification's 500 questions is ~244 KB gzipped — fetched once, browser-cached, and never needed alongside another certification's. So the design spends its complexity on making 26,000 items writable: scaffolders, a validator that fails the build on the errors bulk authoring actually produces, and packs small enough to review. Full reasoning and the rejected alternatives are in ADR 0001.
The catalogue renders from counts, never from content, so the landing page costs the same whether the bank holds 47 questions or 26,000.
Full project structure
certops/
├── index.html # single entry point; CSP meta fallback for GitHub Pages
├── server.js # zero-dependency static server with security headers
├── vite.config.js # optional: dev HMR + production bundling
├── .c8rc.json # coverage thresholds, enforced by npm run coverage
├── public/_headers # production security headers (Netlify / Cloudflare)
├── docs/ # architecture, roadmap, CI & security, ADRs
├── scripts/ # stdlib Node only, no dependencies
│ ├── build-content-index.mjs # filesystem → catalog + registry + manifest
│ ├── validate-content.mjs # the content gate
│ ├── seed-catalog.mjs # Top-50 roadmap seeder
│ ├── new-cert.mjs / new-pack.mjs # scaffolders
│ ├── backup-content.mjs # content snapshots
│ ├── content-stats.mjs / coverage-summary.mjs
│ ├── lib/dom-shim.mjs # headless DOM: runs the whole app in Node
│ └── test-*.mjs # seven suites, 123 checks
└── src/
├── app.js # router + one delegated data-action dispatcher
├── state.js
├── data/
│ ├── certs/<certId>/ # ← everything about a certification lives here
│ ├── loader.js # lazy per-certification loading + cache
│ └── *.generated.js # GENERATED — never edit by hand
├── lib/
│ ├── select.js # difficulty filter, weighted sampling, adaptive engine
│ ├── daily.js # date-seeded daily challenge
│ ├── srs.js # Leitner-box spaced repetition
│ ├── progress.js # attempt history + per-difficulty accuracy
│ └── storage.js # localStorage keys, in one place
├── views/ # home · cert module · quiz · results · flashcards · bank
└── styles/main.css # light-first token system
| Role | Face | Used for |
|---|---|---|
| Display | Chakra Petch | headings, brand, cert codes, chips, all figures (tabular) |
| Body | Sora | exam scenarios, explanations, card backs |
| Data | JetBrains Mono | CLI commands in flashcards, key hints |
Light-first: :root holds the complete light palette, [data-theme="dark"] overrides the
same token names. Components reference only tokens — there are no literal colours below the
token layer, because a hardcoded hex shows up as invisible text in the other theme.
Swapping a typeface is one line in the token block plus the <link> in index.html.
Provider marks come from Simple Icons (CC0) where a freely
licensed mark exists, with contrast-checked colour pairs per theme. AWS and Azure were
removed from Simple Icons at the trademark owners' request, so those render a lettermark in
the official brand colour; supply your own path data in src/views/brand-icons.local.js
to override. See NOTICE.
| Key | Where | Action |
|---|---|---|
A–F |
Quiz | Select that option |
→ |
Quiz | Check answer, then advance |
← |
Quiz | Previous question (non-linear modes) |
Space / Enter |
Flashcards | Flip the card |
1 / 2 |
Flashcards | Grade "Again" / "Got it" |
No backend, no accounts, no analytics, no network calls of any kind — the CSP sets
connect-src 'self' and the app never uses it. Attempt history, flashcard scheduling, the
daily streak, and the theme live in localStorage in your own browser. Nothing is uploaded
anywhere.
Keys are prefixed certops_; data written under previous converge_ keys is migrated
once on boot and then removed (src/lib/storage.js).
The 37 live certifications hold 500 questions and 500 flashcards each (18,500 and 18,500 repo-wide). The most valuable contribution is not a new certification but a re-authored pack in one of the nine banks that need one, and npm run lint:pack scores a single pack before anything else runs. A wrong answer is the highest-priority bug, because it teaches someone the wrong thing before an exam they paid for. Start with CONTRIBUTING.md and docs/EXAM-READINESS.md.
npm run new:pack -- --cert <id> --kind questions --count 25
# author the templates, then:
npm run checkOne rule worth stating on the front page: every question must be written from public documentation. Material recalled from a real exam violates every certification body's NDA and puts candidates at risk of decertification. Those PRs are closed without discussion.
The build is a plain static directory — any host works.
npm run build # → dist/, for a root domain
BASE_PATH=/certops/ npm run build # for a GitHub Pages project siteTwo requirements: serve index.html for unknown paths, and send the headers in
public/_headers if your host supports them. Pushing to main deploys to
GitHub Pages automatically (deploy.yml).
Code — MIT. Everything in src/ except the content packs, plus scripts/,
server.js, index.html, and the configuration.
Content — CC BY-SA 4.0. The questions, scenarios, options,
explanations, and flashcards in src/data/certs/*/questions/ and
src/data/certs/*/flashcards/. Reuse them freely, including commercially — credit the
project and keep derived banks under the same license.
Writing a good exam question is the expensive part of this project, which is why the prose carries share-alike and the code does not.
Third-party assets and trademark notices: NOTICE.
CertOps is an independent project. It is not endorsed by, sponsored by, or affiliated with AWS, Microsoft, Google, the Linux Foundation, CNCF, HashiCorp, GitHub, Docker, the FinOps Foundation, the DevOps Institute, ISC2, OffSec, or any other certification body. Certification names and exam codes are trademarks of their respective owners, used only to identify which exam a study module prepares you for.