Study guide
1.1 The Tanium Certified Operator Exam: Blueprint, Logistics and Certification Path
Tanium Certified Operator TCO
Track your progress as you read
Finished sections get a check mark.
1 Tanium Certified Operator Exam and Platform Foundations
1.1 The Tanium Certified Operator Exam: Blueprint, Logistics and Certification Path 1.2 Tanium Platform Components, Client Registration and Linear Chain Peering
2 Asking Questions (22% of the TCO Blueprint)
2.1 Sensors: Execution Model, Output Structure and Data Types 2.2 Parameterized Sensors and Question Parameter Syntax 2.3 Issuing Questions in Interact: Ask a Question, Question Builder and Question Anatomy 2.4 Creating Saved Questions: Reissue Intervals, Merge and Drill-Down Flags, and RBAC 2.5 Defending Tanium as an Efficient User of Network Resources
3 Refining Questions (23% of the TCO Blueprint)
3.1 Targeting Endpoints: from and with Filters, Operators and Boolean Logic 3.2 Drilling Down into Question Results 3.3 Merging Questions to Add Columns 3.4 Computer Groups: Management versus Filter, Dynamic versus Manual 3.5 Custom Tags and Tag-Based Grouping
4 Taking Action (15% of the TCO Blueprint)
4.1 Packages: Anatomy, Command Syntax, Parameters and File Distribution 4.2 Deploying Actions: Entry Points, Targeting, Distribution and Approval 4.3 Verifying Endpoint State and Automating with Scheduled Recurring Actions
5 Navigation and Basic Module Functions (23% of the TCO Blueprint)
5.1 Console Layout, the Main Menu and Where Things Live 5.2 Operations Modules: Deploy, Patch, Asset, Performance and Provision 5.3 Security and Risk Modules: Threat Response, Comply, Enforce, Reveal, Discover and Integrity Monitor 5.4 Interpreting Module-Specific Historical Results and Tanium Data Service 5.5 Choosing the Right Area: Client Status, Direct Connect and Action History 5.6 Content Sets, Roles and Personas: Why You Can See What You Can See
6 Report Generation and Data Export (17% of the TCO Blueprint)
6.1 Exporting Question Results: CSV, Headers, Flatten Rows and Copy 6.2 Creating Reusable Reports with Tanium Reporting 6.3 Dashboards, Boards and Metric Sources: Trends, Its Replacement and Migration 6.4 Scheduled Delivery and Exporting to External Systems with Tanium Connect
1.1 The Tanium Certified Operator Exam: Blueprint, Logistics and Certification Path
Key Takeaways Explain This Topic AI
The Tanium Certified Operator exam (SKU TAN-EXAM-TCO, exam code TAN-1000) is worth 60 score points, combines multiple-choice with practical application items, and has a 105-minute seat time.
Tanium does not publish a TCO passing score: the Candidate Handbook states exams are pass/fail and cut scores are set statistically and may change, so any quoted percentage is unofficial.
The published TCO fee is $225 USD, delivered through Pearson VUE at a test centre or online through OnVUE, with no prerequisites and a recommended 3-6 months of hands-on Tanium experience.
The blueprint has five domains: Refining Questions 23%, Navigation and Basic Module Functions 23%, Asking Questions 22%, Report Generation and Data Export 17%, and Taking Action 15%.
TCO is valid for two years and is uniquely recertified by passing any Tanium certification exam, while every other Tanium credential must be recertified with its own exam.
Last updated: August 2026
1.1 The Tanium Certified Operator Exam: Blueprint, Logistics and Certification Path
Quick overview: The Tanium Certified Operator (TCO) is Tanium's entry-level credential. It is sold as SKU TAN-EXAM-TCO and delivered under exam code TAN-1000 . The exam is worth 60 score points , mixes multiple-choice items with practical application items , and has a 105-minute seat time . Tanium does not publish a passing score — the exam is reported as pass/fail. The published fee is $225 USD , and delivery is through Pearson VUE , either at a test centre or online through OnVUE .
Exam facts you can rely on
Everything in the table below comes from two Tanium-published documents: the Tanium Certified Operator exam overview (the official blueprint sheet) and the Tanium Certifications Candidate Handbook . Third-party training sites circulate several other numbers — "50 questions", "60 minutes", "70% to pass", "free exam" — and none of them appear in Tanium's own documents. Treat only the values below as exam facts.
- Exam parameter Official value
- Credential Tanium Certified Operator (TCO)
- Product SKU TAN-EXAM-TCO
- Exam code TAN-1000
- Score points 60
- Item types Multiple-choice items and practical application items
- Seat time 105 minutes
Passing score Not published. Tanium exams are pass/fail; cut scores are set by statistical analysis and change with the item pool
- Fee $225 USD (paid to Pearson VUE at registration, or redeemed from a Tanium voucher)
- Delivery Pearson VUE test centre or OnVUE online proctoring
- Prerequisites None
- Recommended courses Getting Started with Tanium; Tanium Essentials
Candidate profile 1–3 years of IT operations and/or security experience, plus 3–6 months of hands-on Tanium experience
- Validity 2 years
- Digital badge Issued through Credly
Important
Do not memorise a passing percentage. The Candidate Handbook states plainly that "passing score requirements are not published, as exam questions and passing scores may adjust as exam content changes." Any prep source quoting "70%" or "72%" for TAN-1000 is guessing. Prepare to demonstrate competence across all five domains rather than to clear a specific number.
Why "score points" is not the same as "questions"
The blueprint says the exam is 60 score points , not 60 questions. Practical application items — the ones where you interact with a simulated console rather than pick a letter — can carry more than one score point, and a single scenario can be scored on several independent decisions. The practical consequence for your preparation is direct: rote recall of sensor names will not carry you. You need to know where things are in the console and which workflow solves a given operational problem.
The official exam blueprint
The TCO blueprint has five domains and sixteen objectives . Note what the weights actually emphasise: nearly half the exam (40%) sits in Navigation and Basic Module Functions plus Report Generation and Data Export — the two areas candidates most often under-prepare because they assume the exam is all Interact syntax.
Domain Weight Objectives
Asking Questions 22% Query endpoints for real-time information; use basic Tanium features to gather relevant information; determine the appropriate method to create a saved question; defend why Tanium is an efficient user of network resources
Refining Questions 23% Target endpoints using natural language questions or the Question Builder; identify the methods to drill down and merge questions; explain manual and dynamic groups and custom tags; generate a report to identify computers sharing a common characteristic
Taking Action 15% Make changes to an endpoint; verify the state of an endpoint before and after making changes; automate remediation using scheduled recurring actions
Navigation and Basic Module Functions 23% Navigate to a module to perform a basic module-specific task; interpret module-specific historical results; determine the appropriate area to gather task-specific information
Report Generation and Data Export 17% Determine the correct method to export required data for use outside of the application; create reusable reports TCO BLUEPRINT WEIGHTS (60 score points)
- Refining Questions ................ 23% |=======================|
- Navigation & Basic Module Funcs ... 23% |=======================|
- Asking Questions .................. 22% |======================|
- Report Generation & Data Export ... 17% |=================|
- Taking Action ..................... 15% |===============|
Tanium adds a standing caveat to the blueprint sheet: it "provides general guidelines for the content likely to be included on the exam. Related topics may also appear on any specific delivery of the exam. Blueprints may change at any time without notice." Check the live blueprint PDF on the Tanium certifications page before you book.
How this guide maps to the blueprint
This guide is organised so that each chapter is one blueprint domain. Chapter 1 is orientation — the exam itself plus the platform architecture that every other domain assumes. Chapters 2 through 6 are Asking Questions, Refining Questions, Taking Action, Navigation and Basic Module Functions, and Report Generation and Data Export, in blueprint order.
- Registration, exam day and results
- Before you book
Create a profile in the Tanium Certifications candidate portal , using a company email address where possible. The account must be registered to your legal name exactly as it appears on your government-issued ID.
Review and accept the Tanium Certification Exam Agreement in the portal.
Schedule through Pearson VUE . You must be 18 years old and hold valid government-issued identification establishing residence in a non-sanctioned country.
Pay $225 directly to Pearson VUE, or redeem a Tanium voucher. Vouchers are valid for up to 12 months, cover one attempt, and are never extended.
Rescheduling
Reschedule or cancel at least 48 hours before the appointment. Inside 48 hours, or if you simply fail to appear, the fee is forfeited .
Identification
Delivery method ID requirement
Pearson VUE test centre Two original, unexpired IDs — one primary (government-issued, with name, photo and signature) and one secondary (name and signature, or name and recent photo)
OnVUE online One current, unexpired government-issued photo ID with signature. Restricted IDs such as U.S. military cards cannot be used online because they may not be photographed
Arrive 15 minutes early at a test centre; log in 30 minutes early for OnVUE. Arriving more than 15 minutes late in either channel generally forfeits the appointment and the fee.
Results
Test-centre candidates receive a printed score report from the administrator. OnVUE candidates get an email pointing to the Pearson VUE dashboard. Results normally appear in the Tanium candidate portal within 24 hours . Candidates who pass receive no additional breakdown; candidates who do not pass receive section-level performance feedback , which is the fastest way to find the domain to re-study.
Retake policy
The retake ladder is fixed and applied without exception. Wait time begins the day after the failed attempt.
- Attempt that failed Wait before the next attempt
- 1st 7 days
- 2nd 14 days
- 3rd 14 days
- 4th 21 days
- 5th 21 days
Beyond the fifth attempt, retakes are granted case by case only after contacting certifications@tanium.com , and Tanium may refuse. Retakes are not permitted at all for one calendar year following the fifth attempt . You also cannot re-sit an exam you have already passed unless you are doing so to satisfy a recertification requirement.
The Tanium certification portfolio and recertification
Tanium currently offers five certifications. There is no "Tanium Certified Enterprise Architect" — if a study source mentions one, that source is unreliable.
Certification Focus Fee
TCO — Tanium Certified Operator Entry level: console navigation, questions, basic module use, actions, reporting $225
TCA — Tanium Certified Administrator Operationalise, maintain and troubleshoot the platform in a Tanium Cloud environment $250
TCSCD — Tanium Certified Specialist Cloud Deployment Qualifying, planning, configuring and operationalising Tanium Cloud deployments $225
TCPEM — Tanium Certified Professional Endpoint Management Managing, reporting on and administering the operations-focused modules $250
TCPRS — Tanium Certified Professional Endpoint Risk and Security Security, risk and compliance use cases $250
All Tanium certifications are valid for two years . The recertification rule differs by credential, and TCO is the most permissive one in the portfolio:
- Certification Exam that recertifies it
- TCO Any Tanium certification exam
- TCA TCA
- TCSCD TCSCD
- TCPEM TCPEM
- TCPRS TCPRS
Because any exam recertifies TCO, an operator who goes on to pass TCA, TCPEM or TCPRS keeps TCO current automatically. Plan to recertify roughly two months before expiry — Tanium makes no exceptions for lapsed credentials, and an expired TCO must be earned again from scratch.
Preparing efficiently for a 105-minute practical exam
Because practical application items are console-driven, hands-on time in a real or lab Tanium environment is worth more than extra reading. A workable preparation sequence:
Take the recommended courses. Getting Started with Tanium and Tanium Essentials are the courses the blueprint's candidate profile assumes; the Credly badge criteria name Tanium Essentials explicitly.
Ask questions until the syntax is automatic. You should be able to write a targeted question with a filter and a parameterized sensor without pausing.
Walk every module's landing page. Objective NAV-1 asks you to navigate to a module and perform a basic task — you cannot bluff this from a glossary.
Deploy and verify one real action. Ask the question, deploy the package, ask the question again. That loop is objectives TA-1 and TA-2 in one exercise.
Export something. Export question results to CSV and build one report. That is 17% of the exam that takes an afternoon to learn.
Tip
With 60 score points across 105 minutes you have roughly 1 minute 45 seconds per score point on average — but practical items legitimately take longer than recall items. Move quickly through the items you know, flag anything console-heavy, and come back with the time you banked.