ZTA-200
Halo Certified Engineer
What it measures
Whether you can plan, deploy, secure and run Glasswall Halo in production, and install, configure and operate the Safeware apps that extend it on-prem. Passing it earns the Halo Certified Engineer credential, which is the credential named by the Safeware partner certification gate.
Who it is for
Engineers who deploy, secure and operate Glasswall Halo on the single-node virtual appliance or on managed Kubernetes, and who run the Safeware apps next to it. Partner delivery engineers who must meet the Safeware partner certification gate.
Skills measured
| Domain | Weight |
|---|---|
| Architecture, planning and deployment on the virtual appliance and managed Kubernetes | 20 % |
| Authentication, single sign-on, roles and licensing | 10 % |
| Policies, protection settings and the Halo Portal | 10 % |
| The ICAP server and its integrations | 10 % |
| Glasswall add-ons: storage monitoring, file reputation, Foresight, prompt injection detection and Conform | 8 % |
| Day-two operations, retention, upgrades and support | 10 % |
| The Safeware apps: extension contract, Protect ingress, Email Relay, ICAP Client, Halo Quarantine and Genesis, Macro Analysis, Large Archive, AV Service, Signature Verification, Storage Monitoring Audit, telemetry and SIEM, air-gapped lifecycle | 22 % |
| Integration essentials: the API landscape and authentication, the synchronous API, policies as code | 10 % |
How it is delivered
Online proctored exam (provider to be confirmed by Safeware). 65 multiple-choice items (single answer and “select all that apply”), 90 minutes, pass mark 70 %. Delivered online with live or automated proctoring. Valid for 24 months. The exam targets Halo 2.23.1 (October 2026); it is refreshed when a release changes administrator-facing behaviour.
Prerequisites
ZTA-100 is recommended but not required.
Who issues it
The Zero-Trust Academy certifications are issued and operated by Safeware, a Glasswall partner, not by Glasswall Solutions Limited. Glasswall, Halo, Embedded Engine, Meteor and Foresight are trademarks of Glasswall Solutions Limited and are used to describe the products the exam covers.
Retakes and policies
Policies are confirmed when the delivery provider is announced. Candidates must present government-issued photo identification, sit the exam alone in a quiet room with no reference material, and accept the exam agreement before starting. A failed attempt may be retaken after 14 days; a third and later attempt after 30 days.
How to prepare
Complete every module and knowledge check of both the Glasswall Halo Administrator path and the Safeware Halo Apps Operator path. Hands-on time on a Halo appliance or cluster is strongly recommended. The integration essentials domain is covered by the API landscape and authentication, synchronous API and policies-as-code modules of the Glasswall Integration Developer path; that path is optional preparation and earns a certificate of completion only.