TELCOMA Certified 5G Security Specialist

What's assessed

7 domains, 49 questions in total — drawn from the course lessons.

• Cryptographic inventory, threat register and SUCI concealment

  7 questions

  Sorting an estate into symmetric-only and key-pair surfaces, and following every key to its parent before filing it; a threat register anchored on a product class and its assets, whose rows stay put when the attacker level changes; the SUCI seal stage by stage; and the protection-scheme list, where the SUCI is computed, and the conditions under which nothing is sealed at all.

• Identity exposure, credentials and the keys below the anchor

  7 questions

  What still exposes or links a subscriber once concealment works, per access type; what the 5G response binds that the 4G one did not, and who checks it; the second primary method and the key both routes land on; the six working keys and their two parents; how a stripped capability list is caught; and slice authorisation run with someone else's credentials.

• The service-based interface: TLS, tokens and delegated trust

  7 questions

  Support, use and the operator's own decision read apart on every segment of the service bus; an access token read claim by claim, and how far its audience actually reaches; a stolen token on a direct connection and behind a proxy; the four communication models and the property hop-by-hop protection does not deliver; and 3GPP's own zero-trust scorecard.

• N32 interconnect beyond the border guard

  7 questions

  The control and forwarding connections between two border proxies, and the path shape that fixes which modes are permitted; PRINS splitting a message into a sealed part and a readable one, with every intermediary edit travelling as a separately signed patch; the attributes no policy may leave readable; and the proxy's hardening set read by the failure each line prevents.

• Transport, substrate, slices and the management plane

  7 questions

  Implemented, in use and the outcome kept apart on every radio-access transport link, and what a physical perimeter actually covers; the four assumptions a virtualised function cannot check for itself; what two slices still share, and what an isolation promise can honestly say; the management plane's five requirements; and which question each piece of assurance evidence answers.

• Post-quantum readiness: the honest threat model

  7 questions

  What a key-recovering machine takes outright and what it only weakens, followed down every key-parent edge; harvest, forgery and identity told apart by what the attacker must already hold; who owns each migration, and the two the study expects 3GPP to drive itself; and the naming points that are negotiated against the ones welded at build or provisioning time.

• Post-quantum readiness: the migration

  7 questions

  The guidance's six phases and the considerations a ranking weighs, with the order left to the risk owner; the standalone and hybrid SUCI profiles and what each one changes; a measured prototype's cost for a post-quantum tunnel, read as the kind of number it is; and the clocks that bind an asset against the ones that only watch it.