Best Certifications for DevOps Engineers

Half the "top DevOps certifications" lists still circulating in 2026 recommend the Docker Certified Associate — an exam that was discontinued after Mirantis acquired Docker Enterprise and has no successor. If a list you are reading includes it, the list is stale, and its other advice deserves suspicion too. The DevOps credential landscape has genuinely shifted: Kubernetes certifications now expire after two years instead of three, HashiCorp's Terraform Associate moved to version 004 in January 2026, GitHub exams moved to Pearson VUE with Microsoft-style codes, and Microsoft retired one of the two prerequisite routes into AZ-400.

This guide is written for engineers already working in DevOps or platform roles who want the certifications that best signal senior competence — not for people trying to break into the field. If you are pivoting into DevOps from another discipline, the sequencing advice in our guide to certifications for switching careers is the better starting point.

Why hands-on exams carry outsized weight

Before ranking anything, one principle explains most of the ranking: performance-based exams signal more than multiple-choice exams. The Certified Kubernetes Administrator (CKA), Certified Kubernetes Application Developer (CKAD) and Certified Kubernetes Security Specialist (CKS) are solved from a command line in live Kubernetes clusters over two hours, proctored remotely through the PSI Bridge platform. There is no bank of options to eliminate — either your Deployment schedules or it does not. HashiCorp's Terraform professional-level exam is likewise lab-based.

Hiring managers know this, which is why the CNCF ladder tends to outrank multiple-choice credentials of similar difficulty in screening. It is also why this article weights Kubernetes and IaC credentials heavily for experienced engineers: they are the closest a certificate gets to a work sample.

The cost calculus differs too. CKA, CKAD and CKS purchases each include a 12-month eligibility window, one free retake and two sessions of the killer.sh exam simulator — which materially changes the cost of a failed first attempt compared with AWS or Microsoft exams, where a retake is a fresh fee.

The core three for a practising engineer

1. Certified Kubernetes Administrator (CKA) — the anchor credential

• Provider: Cloud Native Computing Foundation (CNCF) / The Linux Foundation
• Format: 2-hour performance-based exam on live clusters, based on Kubernetes v1.35 as of August 2026
• Cost: US$445 list price exam-only (frequent sitewide promotions; bundles with training or a THRIVE-ONE subscription cost more)
• Passing score: 66% • Prerequisites: none • Validity: 2 years, renewed by retaking

The CKA's domain weighting rewards exactly what senior operations work looks like: Troubleshooting alone is 30% of the exam, with cluster architecture/installation at 25%, services and networking at 20%, workloads and scheduling 15%, and storage 10%. Note the curriculum was revised on 18 February 2025 — Gateway API now sits alongside Ingress, Helm and Kustomize are in scope, as are CRI/CSI/CNI troubleshooting, dynamic volume provisioning and Pod Security Standards. Study material predating that revision will leave gaps.

Does managed Kubernetes (EKS, GKE, AKS) make the CKA redundant? No — troubleshooting workloads, networking and storage remains your job even when the control plane is managed, and those domains are most of the exam.

Watch the validity change: certifications earned on or after 1 April 2024 are valid two years, not the three years older articles quote. Renewal is a full retake; there is no continuing-education route. Budget for that cycle before committing to the whole ladder.

2. HashiCorp Certified: Terraform Associate (004) — the IaC signal

• Provider: HashiCorp (an IBM company)
• Format: 1-hour online-proctored multiple choice, tested on Terraform 1.12
• Cost: US$70.50 plus taxes — no free retake at this tier
• Prerequisites: none formal • Validity: 2 years

Version 004 became the current exam on 8 January 2026; the 003 exam ended the previous day, so make sure your prep targets 004. At roughly seventy dollars this is the cheapest meaningful credential on this list, and infrastructure-as-code literacy is now assumed in almost every platform-engineering job description. It is multiple choice, so treat it as a floor, not a differentiator — the differentiator at senior level is the Terraform Authoring and Operations Professional: a 4-hour, lab-based-plus-multiple-choice exam at US$295 (one free retake included) aimed at engineers running Terraform in production. If you write modules daily, the Professional is one of the most credible senior signals HashiCorp offers.

3. A professional-level cloud DevOps certification — match your platform

Pick one, based on where your employer's workloads live, not on abstract "which cloud is best" debates.

AWS Certified DevOps Engineer – Professional (DOP-C02). 75 questions, 180 minutes, US$300 (varies by region), passing score 750 scaled, valid 3 years. AWS sets no formal prerequisites — the Professional tier is open to anyone — but recommends two-plus years provisioning and operating AWS with a scripting background. Two economics points experienced engineers should exploit: passing DOP-C02 automatically renews the Developer Associate and CloudOps Engineer Associate certifications, and any active AWS certification earns a 50% discount voucher for your next AWS exam. When you are ready to benchmark, timed AWS DevOps Engineer Professional practice questions will expose which domains need another pass before you spend the $300.

Microsoft Certified: DevOps Engineer Expert (AZ-400). Covers DevOps processes, source-control strategy, build and release pipelines, security and compliance planning, and instrumentation — across both GitHub and Azure DevOps. Two things changed recently that Azure-side engineers must know. First, the prerequisite: AZ-400 requires Azure Administrator Associate (AZ-104) or Azure Developer Associate (AZ-204) — and AZ-204 was retired in mid-2026, so AZ-104 is now the practical route for new candidates. Second, the maintenance model: Microsoft role-based certifications expire after one year but renew free through an open-book online assessment, a genuinely lower cost of ownership than the paid-retake cycles elsewhere on this list. Exam pricing is set per country (commonly cited around US$165 in the US — confirm on Microsoft Learn). Working through AZ-400 practice questions is the fastest way to find out whether your pipeline knowledge generalises beyond the tools you use daily. If you hold AZ-104 and are weighing AZ-400 against the architect route, that fork is examined in detail in what to take after Azure Administrator.

Google Professional Cloud DevOps Engineer exists for GCP-centred teams; its current price and format were not verified for this article, so check cloud.google.com before booking.

Certifications by experience level

Two to four years in: prove breadth

At this stage the goal is demonstrating you can operate the standard toolchain unsupervised.

• CKA — the anchor, as above. If your work is more application-side (building and deploying onto clusters others run), CKAD is the better fit: same price, format and 66% pass mark, but weighted towards application environment, configuration, design and deployment. Neither is a beginner exam, and CKAD is not "CKA-lite".
• Terraform Associate 004 — cheap, quick, expected.
• GitHub Actions (GH-200) — since 1 July 2025 GitHub exams run exclusively through Pearson VUE in partnership with Microsoft Learn, with Microsoft-style codes. GH-200 is a 100-minute, intermediate, multiple-choice exam at US$99 in most regions. Worth taking if Actions is your CI system; skip if you live in GitLab or Jenkins.
• If you are genuinely new to Kubernetes, the KCNA (US$250, 90-minute multiple choice, two attempts included) is the honest entry point — but for engineers already running clusters at work it adds little over going straight to CKA, which has no prerequisites.

Five-plus years in: prove depth and judgement

• A cloud Professional-tier DevOps cert (DOP-C02 or AZ-400) — breadth plus architectural judgement on your primary platform.
• CKS (Certified Kubernetes Security Specialist) — the strongest specialisation signal in the cloud-native world. Two-hour hands-on exam, 67% to pass, US$445, and it requires a current, non-expired CKA before you may attempt it (KCSA, despite the name, is not a prerequisite). Its domains — supply-chain security, runtime security, cluster and system hardening — map directly onto what platform teams are being asked to own.
• Terraform Authoring and Operations Professional — as above, for IaC-heavy roles.
• If your trajectory is bending towards design rather than delivery, an architect credential may serve better than a fourth ops cert; the solutions architect certification path covers that track.

Leading a platform function: certify selectively

Beyond about eight years, certifications stop being the main signal — your systems and your teams are. Renew what your employer values, add CKS or a professional-tier exam where it fills a genuine gap, and ignore collection for its own sake. One exception worth knowing about: CNCF's Kubestronaut programme recognises engineers holding all five Kubernetes certifications (CKA, CKAD, CKS, KCNA, KCSA). It is a distinctive flag for consultants and trainers; verify the current perks on cncf.io before treating it as a goal.