Appearance
13.10 — The Certification Map
Two candidates. One holds four cloud certifications and has never operated a production system. The other has run a payments platform for three years and holds none.
Most hiring managers prefer the second, and the first gets more interviews — because certifications are read by recruiters and screening filters before anyone technical sees the application. That gap is the entire practical case for certifications, and being clear-eyed about it is more useful than either enthusiasm or dismissal.
1. What they are and are not
What a certification genuinely provides:
A syllabus. The most underrated benefit. Studying for an associate-level cloud exam forces you across services you would otherwise never touch, and you learn what exists, which is what lets you recognise later that a managed service already solves your problem.
A screening signal. Automated filters and recruiters match on them. Whether or not that is a good system, it is the system, and a certification measurably increases the number of interviews you are invited to.
Partner requirements. Consultancies need certified staff to maintain partner status, which is why they pay for exams and sometimes for passing them.
A deadline. A booked exam produces study that "I should learn Azure" does not.
What it does not provide:
Evidence you can do the job. Exams test recall and recognition under time pressure. They do not test debugging at 3am, or judgement about when not to use something.
Depth. A multiple-choice question cannot distinguish someone who has designed a system from someone who memorised a question bank — and question banks of real exam content circulate, which everyone in hiring knows.
Durability. Cloud services change, certifications expire, and a five-year-old certification describes a platform that no longer exists.
The honest summary: a certification opens doors and does not walk through them. Pair one with something you have actually built, and it works. Alone, it is a filter pass.
2. The cloud ladders
AWS
| Level | Certification | For |
|---|---|---|
| Foundational | Cloud Practitioner | Non-engineers, sales, a first orientation |
| Associate | Solutions Architect – Associate | The one most people take; broad service knowledge |
| Associate | Developer, SysOps | Narrower; SysOps is the more operational |
| Professional | Solutions Architect – Professional | Genuinely hard; multi-account, migration, cost |
| Professional | DevOps Engineer | Pipelines, automation, monitoring |
| Specialty | Security, Networking, Machine Learning, Database | Deep and narrow |
Azure
| Level | Certification | For |
|---|---|---|
| Fundamentals | AZ-900, AI-900, DP-900 | Orientation, one exam each |
| Associate | AZ-104 Administrator | The operational core |
| Associate | AZ-204 Developer, DP-203 Data Engineer, AI-102 AI Engineer | By role |
| Expert | AZ-305 Solutions Architect | Requires AZ-104 |
| Expert | AZ-400 DevOps Engineer | Requires AZ-104 or AZ-204 |
| Specialty | SC-100 Security Architect, and the SC-200/300 series | Security and identity |
Google Cloud
Associate Cloud Engineer, then Professional Cloud Architect — widely regarded as one of the harder architect exams — plus Data Engineer, DevOps Engineer, Security Engineer and Machine Learning Engineer.
Which platform? The one your employer or target employers use. AWS has the largest market share and the most job listings; Azure dominates in organisations already committed to Microsoft; Google Cloud is strong in data and machine learning. There is no portable advantage in learning the least relevant one.
3. The vendor-neutral ones worth having
Kubernetes (CNCF) — and these are different in kind, because they are hands-on:
- CKA (Administrator) — cluster operation.
- CKAD (Application Developer) — deploying and configuring workloads.
- CKS (Security Specialist) — requires a current CKA.
All three are performance-based: a live cluster, a terminal, real tasks, two hours. You cannot pass by recognising answers, which is why they carry more weight with technical interviewers than multiple-choice certifications do. If you take one certification from this page, take a CNCF one.
HashiCorp — Terraform Associate is a reasonable, inexpensive way to structure learning Chapter 13.8, and it is not hard.
Linux Foundation — LFCS and LFCE, also performance-based, and the right choice if your gap is Linux itself (Chapter 2.8).
Security — a genuinely different market. CompTIA Security+ is the entry filter for many roles including government-adjacent ones. CISSP is management-oriented and requires five years of verified experience, and it appears in job requirements constantly. CCSP is its cloud counterpart. OSCP is hands-on offensive security with a 24-hour practical exam and is respected precisely because it cannot be crammed.
4. Choosing by role
| Role | Start with | Then |
|---|---|---|
| Backend engineer | Your cloud's associate architect | CKAD, Terraform |
| DevOps / platform | Cloud associate | CKA, Terraform, then the professional DevOps exam |
| Cloud architect | Associate → Professional architect | A networking or security specialty |
| Security engineer | Security+ | Cloud security specialty, then CCSP or OSCP |
| Data engineer | Cloud data engineer exam | Databricks or Snowflake if you use them |
| ML engineer | Cloud ML engineer exam | Often less valuable than a portfolio |
| Manager | A foundational exam for vocabulary | CISSP if security-adjacent |
And the case for skipping them entirely is legitimate. If you have shipped systems, have a public portfolio, and are not applying through automated filters, your time is better spent building something. Certifications matter most early in a career, when changing specialism, and in consultancies.
5. How to actually pass
Do not study only the videos. The single biggest predictor of failing an associate-level cloud exam is having watched a course and never opened the console.
Build things. A free-tier account and a small project across networking, compute, storage, identity and monitoring teaches more than any course. The lab in Chapter 13.7 covers a large share of a DevOps syllabus by itself.
Practice exams to calibrate, not to memorise. Consistently scoring 80%+ on unseen practice questions is the readiness signal. Reputable providers only — dumps of real questions are against the terms, void your certification when detected, and teach you nothing.
Read the exam guide and weightings. They state the domains and their percentages, and studying in proportion is more efficient than studying evenly.
Know the exam mechanics. Time per question, whether questions can be flagged and revisited, whether there is a penalty for a wrong answer (usually not — so never leave one blank), and whether it is proctored online, which has strict environment requirements that catch people out on the day.
Book the exam before you feel ready. The deadline is the mechanism.
6. Money, renewal and badges
Costs run from around $100 for a fundamentals exam to $300–$400 for professional and specialty levels, with practice materials on top. Many employers reimburse, and vendors run free or discounted vouchers through training events — ask before paying.
Renewal is the part people forget. Most cloud certifications last two to three years. AWS lets a higher-level pass renew lower ones; Microsoft renews free with an annual online assessment, which takes under an hour. A lapsed certification is worth nothing on a filter, so budget the renewal time when you take the first exam.
Credly is the digital badge platform most vendors use. A badge is a verifiable credential with an issuer, a date, an expiry and a link anyone can check — which is genuinely better than a line on a CV, because it cannot be invented. Add badges to your professional profile; recruiters filter on them.
And a caution worth stating: a wall of badges without depth reads badly to technical interviewers. Six certifications and no described project invites the question of what you have actually built. Two relevant certifications plus one thing you can talk about for twenty minutes is a much stronger position than eight of the first and none of the second.
Recall
- A certification opens doors and does not walk through them. Its real value is a syllabus (you learn what exists), a screening signal, a partner requirement, and a deadline. It is not evidence you can operate a system.
- Pick the platform your target employers use. AWS has the most listings, Azure dominates Microsoft estates, Google Cloud is strong in data and machine learning. There is no portable advantage in the least relevant one.
- CNCF exams (CKA, CKAD, CKS) are performance-based — a live cluster and a terminal — so they cannot be passed by recognition, and technical interviewers weight them accordingly. If you take one certification, take one of these.
- Vendor-neutral options: Terraform Associate (cheap, structures Chapter 13.8), LFCS/LFCE for Linux, and the security track — Security+ as an entry filter, CISSP (five years' experience, appears in requirements constantly), CCSP, and OSCP for hands-on offensive work.
- Passing depends on building, not watching. Use practice exams to calibrate (80%+ on unseen questions), read the exam guide's domain weightings, never leave an answer blank, and book before you feel ready.
- Renewal is two to three years, and a lapsed certification is worth nothing to a filter. Budget the renewal when you take the exam.
- Credly badges are verifiable — issuer, date, expiry, public link — which beats a CV line. But a wall of badges with no described project reads badly: two relevant certifications plus one thing you can discuss for twenty minutes beats eight and nothing.
Self-test: What is the most underrated benefit of studying for a certification? · Why do technical interviewers weight CNCF exams differently? · Which certification requires five years of verified experience? · What is the readiness signal from practice exams? · What happens to a certification's screening value when it lapses? · What is the failure mode of collecting many badges?
Next: Part 14 turns from systems to the craft itself — Git as it actually works, debugging as a discipline, writing for engineers, and what changes as a career moves from junior to principal.