What is the format of the QRadar SIEM exams?
The QRadar SIEM V7.5 family is four separate exams, all 90 minutes and all $200 USD: Foundations (C1000-175) with 62 questions and 41 to pass, Administration (C1000-156) with 62 questions and 38 to pass, Analysis (C1000-162) with 64 questions and 41 to pass, and Deployment (C1000-163) with 63 questions and 42 to pass. All four are delivered through Pearson VUE — at a test center or online with OnVUE from home — and all four are listed Live on IBM's credential pages.
The four exams side by side
Foundations (C1000-175) is the breadth credential: fourteen published sections running from SIEM Concepts and QRadar Architecture through the user interface, extensions, flows, rules and building blocks, offenses, AQL search and filtering, assets, reporting and dashboards, events, configuration and tuning, system errors, and user/role management. At 62 questions over fourteen sections, it rewards general fluency over deep specialization.
Administration (C1000-156) covers running the product day to day: system configuration, performance optimization, data source configuration, accuracy tuning, user management, reporting and offense management, tenants and domains, and troubleshooting. IBM's page carries a line worth quoting: 'Extensive hands-on product knowledge is required to pass the test.' Analysis (C1000-162) is the SOC analyst's exam — offense analysis, rules and building block design, threat hunting, dashboard management, searching and reporting. Deployment (C1000-163) is the implementer's exam — deployment objectives, architecture and sizing, installation, event and flow integration, X-Force integration, performance and troubleshooting, initial offense tuning, migration and upgrades, and multi-tenancy.
Two of the four carry replacement history worth knowing: the Analysis credential (C9005200) replaced C9002900, and the Deployment credential (C9005100) replaced C9003100. If your job requirement or study material cites those older codes, you are looking at the wrong generation — the V7.5 exams are the current ones.
| Exam | Code | Questions | Pass mark | Time | Price |
|---|---|---|---|---|---|
| Foundations of IBM Security QRadar SIEM V7.5 | C1000-175 | 62 | 41 | 90 min | $200 USD |
| IBM Security QRadar SIEM V7.5 Administration | C1000-156 | 62 | 38 | 90 min | $200 USD |
| IBM Security QRadar SIEM V7.5 Analysis | C1000-162 | 64 | 41 | 90 min | $200 USD |
| IBM Security QRadar SIEM V7.5 Deployment | C1000-163 | 63 | 42 | 90 min | $200 USD |
Scroll horizontally to view all columns.
How much do QRadar certifications cost?
$200 USD per exam, identical across all four V7.5 credential pages. There is no published free retake on any of them — a failed attempt is another $200 plus calendar time.
IBM does not publish bundled pricing for the family. If a role wants multiple QRadar credentials, plan $200 per exam across your calendar; the exams are separate credentials in IBM's Security group, not steps of one discounted path.
IBM publishes preparation material for these credentials — the Administration page links its own online prep course, and each credential page carries learning-path resources. Study aids change nothing about the published question counts or pass marks on exam day.
Can you take QRadar exams at home?
Yes. Pearson VUE's IBM program page states IBM certification exams can be taken 'in person at a Pearson VUE Authorized Test Center or online with OnVUE in the comfort and privacy of your home,' and all four QRadar exams appear in Pearson VUE's IBM exam catalog under the Security group.
OnVUE brings Pearson VUE's published requirements: Windows 10 or macOS 14 or higher, a working webcam, microphone, and speaker with no headphones, one display only, at least 6 Mbps down and 2 Mbps up, and the ability to close every application except OnVUE. Virtual machines, VPNs, phones, watches, and smart devices with recording or AI features are prohibited. Check-in includes photos of you and your ID and a 360-degree room view.
Same exams, same pass marks, whichever route you pick. SOC staff on rotating shifts tend to prefer OnVUE scheduling freedom; candidates in shared or noisy housing do better at a center where the room is someone else's problem.
Which QRadar exam fits which role?
Foundations fits people new to QRadar proving baseline fluency — including analysts moving into a QRadar shop. Administration fits the staff who run the deployment. Analysis fits SOC analysts working offenses, rules, and threat hunting daily. Deployment fits the engineers who size, install, integrate, and migrate the platform.
The deciding factor is your requirement's credential code, not instinct: check which certification the job, contract, or partner tier actually names before preparing, and check it against the current codes — C1000-175, C1000-156, C1000-162, C1000-163.
If the sitting itself is the obstacle — timing, pacing, or breadth outside your daily workflow — that is the gap a handled sitting closes: Exam Assist handles QRadar sittings end to end, and the service fee is due only after the agreed result posts.