- How the EX210 Blueprint Is Organized
- What the Four-Hour Hands-On Format Means for the Domains
- Domain 1: Control Plane Management
- Domains 2 and 3: Infrastructure and User Security
- Domains 4 and 9: Deployment Resources and Automation
- Domains 5 and 6: Storage and Networking
- Domains 7, 8 and 10: Compute, Monitoring and Troubleshooting
- Sequencing the Domains in Your Preparation
- Logistics That Touch the Domains: Fees, Retakes, Results, Renewal
- Frequently Asked Questions
- EX210 lists 10 top-level objective headings, and Red Hat publishes no percentage weights for any of them.
- The exam is one four-hour, hands-on session in a live Red Hat OpenStack Platform cloud, not multiple choice.
- Configurations must survive reboot without intervention, so persistence matters in every domain.
- The credential is current for 3 years; the standard Red Hat exam list price is USD 500.
How the EX210 Blueprint Is Organized
The Red Hat Certified Specialist in Cloud Infrastructure exam, code EX210, is built around ten top-level objective headings. Red Hat publishes those headings as a list of what a candidate should be able to do, not as a weighted blueprint. There is no official statement of which domain carries the most marks, and no published task count. Any third-party site claiming "Domain 5 is 18% of the exam" is inventing a number. If you want a refresher on what the credential actually is and where the name comes from, see What Is EX210 Certification? and What Does EX210 Stand For?.
Two naming details are worth knowing before you read any study material. Current Red Hat pages use the title Red Hat Certified Specialist in Cloud Infrastructure, while legacy URLs and some older text still say Red Hat Certified System Administrator in Red Hat OpenStack. They describe the same exam code. Also, the public exam page does not state a numeric platform version or blueprint revision year; it says the objectives reflect the most recent available product and points candidates to a version selector. The related CL211 course uses RHOSP 16.1 and RHEL 8.2, but that is a training baseline, not proof of what version your exam session will run. Confirm the version at booking time rather than assuming.
The ten headings, in the order Red Hat lists them, are:
- Manage the Red Hat OpenStack Platform control plane
- Manage infrastructure security
- Manage user security
- Manage application deployment resources
- Manage storage in Red Hat OpenStack Platform
- Manage networking
- Manage compute node operations
- Monitor operations
- Automate cloud application deployment
- Troubleshoot operations
This guide walks through each one, explains what hands-on work it implies, and shows how the domains overlap in a real exam session. For a broader plan that wraps these domains into a preparation schedule, pair this article with the EX210 Study Guide.
What the Four-Hour Hands-On Format Means for the Domains
EX210 is a performance-based exam. You sit one four-hour section and complete systems-administration tasks inside a working Red Hat OpenStack Platform cloud. Results are evaluated against objective outcomes: either the instance boots, the volume attaches, the policy denies the action, or it does not. There is no partial credit for knowing the theory and no multiple-choice fallback. The exact number of tasks and the scored/unscored split are not publicly specified, and a numeric passing score has not been verified in the current official exam page or program guide. Do not trust sources quoting "60 questions in 90 minutes"; that does not describe this exam. The EX210 Passing Score article covers what is and is not known about scoring.
Because grading is outcome-based, domains blur together. A single task such as "launch an instance that mounts a volume and is reachable on a floating IP" touches Domains 4, 5, 6 and 7 at once. Treat the ten headings as a checklist of skills, not ten separate sections of the test. If you are weighing how demanding that is, How Hard Is the EX210 Exam? gives the difficulty picture, and the practice questions on the main practice test site are a useful way to rehearse the reasoning before you move to a lab.
Domain 1: Control Plane Management
The first heading is "Manage the Red Hat OpenStack Platform control plane." This is the foundation for every other domain, because the control plane is where the API services, the message bus, the database and the scheduler live. A candidate who cannot reason about which service owns a function will lose time everywhere else.
Domain 1: Manage the Red Hat OpenStack Platform control plane
Know what runs where, how to inspect it, and how to bring it back when it misbehaves.
- Identify the core services (identity, compute, networking, block storage, image, orchestration) and the role of each in a request lifecycle.
- Check service and endpoint status from the command line and confirm the catalog points to the right addresses.
- Understand how the control plane is deployed and which nodes host which roles, since this shapes where you look for logs and configuration.
- Restart or re-enable a failed service in a way that persists across reboots.
The practical habit to build is reading state before changing it. Query the service list, endpoint list and agent status first; many later tasks and every troubleshooting task start with those same questions.
Domains 2 and 3: Infrastructure and User Security
Domains 2 and 3 are easy to confuse, so keep the distinction clear. "Manage infrastructure security" is about protecting the platform itself. "Manage user security" is about who can do what inside the cloud.
Domain 2: Manage infrastructure security
Expect to deal with the security posture of the platform layer: how traffic between services and to clients is protected, how the underlying hosts are hardened, and how security-relevant settings are applied consistently. Because this is a Red Hat exam, assume the underlying operating system's security tooling is fair game, including firewall rules and SELinux behavior on the hosts that run OpenStack services. A configuration that works only after you disable a protection is not a solution.
Domain 3: Manage user security
This is identity and access work. Think projects, users, groups, roles and role assignments, and the policy that decides which role may call which API operation. Typical tasks revolve around creating a user, scoping it to a project, assigning a role, and confirming that the user can perform exactly the allowed actions and nothing more.
Domain 3 high-value skills
Access-control tasks are verified by behavior, so always test as the user you configured.
- Create and manage projects, users and role assignments from the command line.
- Source credentials for a specific user and project, then confirm the allowed and denied operations.
- Manage quotas so a project cannot exceed its allotted resources.
- Recognize how an overly broad role assignment can mask a policy problem.
Domains 4 and 9: Deployment Resources and Automation
These two headings describe the user-facing side of a cloud operator's work: preparing the building blocks that workloads need, then automating how those workloads are launched.
Domain 4: Manage application deployment resources
Before an instance can run, the cloud needs images, flavors, key pairs, security groups and similar resources. This domain is about creating and maintaining them. Know how to upload and manage images, define flavors that match a workload's size, manage SSH key pairs, and set up security groups that permit exactly the traffic an application needs.
Domain 9: Automate cloud application deployment
Where Domain 4 prepares the pieces, Domain 9 assembles them repeatably. In OpenStack this points toward the orchestration service and template-driven deployment, plus first-boot customization of instances so they come up configured without manual login. The skill being tested is converting a manual procedure into a repeatable one and getting it to work the first time you run it.
Domains 5 and 6: Storage and Networking
Storage and networking are the two areas where candidates most often discover that "I read about it" is not the same as "I can do it under time pressure." Both are heavily tied to instance behavior, so they are best practiced alongside compute.
Domain 5: Manage storage in Red Hat OpenStack Platform
Storage in OpenStack comes in more than one form, and the exam heading is deliberately broad. Know the difference between ephemeral storage that disappears with an instance and persistent block volumes that outlive it, along with how images and any shared or object storage fit the picture. Core tasks include creating a volume, attaching it to an instance, making the filesystem usable inside the guest, detaching safely, and taking and restoring snapshots or backups. Because configuration must survive reboot, remember that an attached volume that is not set to mount automatically inside the guest will not satisfy a persistence check.
Domain 6: Manage networking
Networking is where isolation, routing and external reachability come together. Understand tenant networks, subnets, routers, external networks, floating IPs and security groups, and how the network service's agents realize them on the nodes. Most networking tasks end with a connectivity test: can the instance reach the outside, and can the outside reach the instance on the intended port only?
| Concern | Domain | What "done" looks like |
|---|---|---|
| Persistent data for an instance | Domain 5 | Volume attached, filesystem mounted, survives reboot |
| Instance reachable from outside | Domain 6 | Floating IP associated, security group permits intended port |
| Which traffic is allowed | Domains 4 and 6 | Security group rules match the stated requirement exactly |
| Resource limits per project | Domain 3 | Quota enforced and verified |
Domains 7, 8 and 10: Compute, Monitoring and Troubleshooting
The last cluster of headings is about running the cloud day to day: handling the hosts that run instances, observing the system, and fixing it when it breaks.
Domain 7: Manage compute node operations
Compute nodes are the hypervisor hosts. This domain covers adding, removing or maintaining them, controlling where instances are placed, and moving workloads when a node needs attention. Know how to disable a node from scheduling, evacuate or migrate instances, and confirm that the scheduler respects the change.
Domain 8: Monitor operations
Monitoring means being able to see the state of the cloud and its workloads: resource usage, service health, and the logs that explain behavior. The skill is knowing which command, metric or log answers a given question quickly. Practice building a short mental map from symptom to data source, such as an instance stuck in an error state leading you to the compute and scheduler logs.
Domain 10: Troubleshoot operations
Troubleshooting is the heading that tests everything else. A broken task in the exam is rarely labeled with its domain; you have to diagnose whether the failure is identity, networking, storage, a stopped service or a bad configuration file. The workflow that serves candidates best is consistent: reproduce the failure, read the relevant log, check service and agent status, form one hypothesis, change one thing, retest.
Key Takeaway
Because Domain 10 depends on Domains 1 through 9, do not treat it as a final topic you cram. Introduce deliberate faults into your practice environment from the start, such as a stopped agent or a wrong role assignment, and fix them using only the logs and status commands available to you.
Sequencing the Domains in Your Preparation
Generic study methods matter less here than ordering. Because the domains build on one another, a sensible sequence follows dependency rather than the order Red Hat lists them. This is one possible arrangement, not an official plan.
Foundation: Domains 1 and 3
- Learn the service map and how to check service and endpoint health.
- Create projects, users and roles, and verify access by acting as each user.
Resources and networking: Domains 4 and 6
- Manage images, flavors, key pairs and security groups.
- Build networks, routers and floating IPs and test connectivity.
Persistence and hosts: Domains 5 and 7
- Attach, mount and snapshot volumes; confirm persistence after reboot.
- Practice taking a compute node out of scheduling and moving instances.
Hardening and repeatability: Domains 2 and 9
- Review infrastructure security settings on the hosts.
- Convert earlier manual builds into templates and first-boot customization.
Observation and repair: Domains 8 and 10
- Drill the symptom-to-log mapping.
- Run timed sessions with injected faults across every domain.
Red Hat says course attendance is not required, but the stated expectations are RHCSA or comparable skills, plus CL110 and CL210 or comparable Red Hat OpenStack Platform experience. The details are in EX210 Requirements, and training options are covered in EX210 Training. When your hands-on practice is solid, use the EX210 practice tests to check that your reasoning about each domain holds up, and keep the EX210 Cheat Sheet nearby for quick fact review.
Logistics That Touch the Domains: Fees, Retakes, Results, Renewal
A few administrative facts shape how you prepare, so it helps to have them straight.
- Delivery: Red Hat runs its own proctored individual, remote and classroom delivery, subject to booking availability for EX210. Remote testing needs compatible equipment and live proctoring. Scheduling specifics are in EX210 Exam Dates.
- Fee: The standard Red Hat certification-exam list price is USD 500. Regional pricing and the exact EX210 checkout amount were not independently confirmed, and no member/non-member differential is published. See EX210 Certification Cost for the broader picture.
- Retake: The program guide includes one free second attempt for an initially purchased paid exam, and the EX210 page also states a retake is available after an unsuccessful first attempt.
- Results: The EX210 page says results usually arrive within 3 US business days as total scores, while the general guide says within 5 business days with objective-area feedback. The two sources differ, so do not count on a single turnaround. Neither gives item-level feedback.
- Validity and renewal: The credential is current for 3 years. The May 2026 framework describes several renewal routes, while older Red Hat pages describe renewal only by retaking the specialist's own exam. Retaking EX210 is the commonly verified route, and you should renew before the credential lapses.
No independent credential-wide pass-rate dataset was located, so treat any specific percentage you see online with suspicion; EX210 Pass Rate explains what can and cannot be said. For career context, see EX210 Jobs, EX210 Salary Guide and Is the EX210 Certification Worth It?.
Frequently Asked Questions
Red Hat's current EX210 page lists 10 top-level exam-objective headings, from managing the control plane through troubleshooting operations. They are objective headings, not a weighted taxonomy.
Red Hat does not publish percentage weights or identify a highest-weighted heading. Because tasks are hands-on and often span several domains, prepare for all ten rather than guessing at emphasis.
No. It is one four-hour section of hands-on tasks performed in a working Red Hat OpenStack Platform cloud and evaluated against objective results. The exact number of tasks is not publicly specified.
Red Hat states that course attendance is not required. It does expect RHCSA or comparable skills and CL110 and CL210 or comparable Red Hat OpenStack Platform experience, plus a review of the objectives.
Configurations must remain in effect after a reboot without manual intervention. Enable services persistently, edit the files services actually read, and verify the result after restarting rather than assuming a runtime change will stick.