Search...

Back to Certification

Certified Kubernetes Security Specialist Exam Guide

Everything you need to know about the CKS certification exam, from preparation strategies to exam day tips.

Exam Information

120 minutes

Duration

15-20 performance tasks

Questions

67%

Passing Score

$395 USD

Exam Cost

Recommended Study Plan

Week 1

Cluster Setup

Cluster Setup (10%)

8-10 hours

Use NetworkPolicy to restrict cluster access
Review CIS benchmarks for kubelet, etcd, and kube-apiserver
Configure Ingress with TLS termination
Protect node metadata and endpoints; minimize GUI access
Verify platform binaries before deployment

Recommended Resources:

Kubernetes NetworkPolicy docs

CIS Kubernetes Benchmark

kube-bench

Week 2

Cluster Hardening

Cluster Hardening (15%)

8-10 hours

Restrict access to the Kubernetes API
RBAC least privilege: Roles, ClusterRoles, and bindings
Service account hygiene and token mounting
API server hardening (anonymous-auth, authorization modes)
Prompt Kubernetes upgrades and version hygiene

Recommended Resources:

Kubernetes RBAC docs

API server hardening guide

Week 3

System Hardening

System Hardening (15%)

8-10 hours

Minimize host OS footprint and use least-privilege IAM
Minimize external network access from nodes and pods
Apply AppArmor profiles to workloads
Apply seccomp profiles (RuntimeDefault, Localhost)
Kernel hardening and host-level isolation

Recommended Resources:

Kubernetes AppArmor tutorial

Kubernetes seccomp tutorial

Week 4-5

Minimize Microservice Vulnerabilities

Minimize Microservice Vulnerabilities (20%)

14-16 hours

Pod Security Admission and Pod Security Standards
securityContext: runAsNonRoot, readOnlyRootFilesystem, drop capabilities
OPA Gatekeeper policies and constraints
Manage Secrets and enable encryption at rest
Container runtime sandboxes (gVisor, Kata Containers)
Pod-to-pod mTLS with a service mesh (Istio, Linkerd)

Recommended Resources:

Pod Security Standards docs

OPA Gatekeeper docs

Istio security docs

Week 6

Supply Chain Security

Supply Chain Security (20%)

12-14 hours

Minimize base image footprint (distroless, multi-stage builds)
Scan images for vulnerabilities with Trivy
Sign and verify images with Cosign
Generate and consume Software Bill of Materials (SBOM)
Whitelist approved container registries
Static analysis of manifests and Dockerfiles

Recommended Resources:

Trivy docs

Sigstore/Cosign docs

kubesec

Week 7

Monitoring, Logging and Runtime Security

Monitoring, Logging and Runtime Security (20%)

12-14 hours

Detect threats at runtime with Falco
Configure Kubernetes audit logging and audit policies
Behavioral analytics and anomaly detection
Immutability and read-only filesystems
Detect and respond to security threats

Recommended Resources:

Falco docs

Kubernetes audit logging docs

Week 8

Full Exam Simulation & Review

All domains - Integrated Review

10-12 hours

Timed practice tasks across all 6 domains
Drill the three 20%-weight domains (microservice, supply chain, monitoring)
Speed up kubectl and security tooling commands
Exam-day logistics and environment setup

Recommended Resources:

Killercoda CKS scenarios

CKS practice exams

Exam Tips & Strategies

⚡

Master kubectl and security tooling

Learn aliases like 'k=kubectl' and get fluent with kube-bench, trivy, cosign, and falco. Speed with security tooling is critical in this exam.

📚

Know the allowed docs

You can access kubernetes.io/docs during the exam. Memorize where the Security, NetworkPolicy, Pod Security Standards, AppArmor, and seccomp pages live.

🔧

Practice on real clusters

Use kind or minikube with AppArmor/seccomp enabled, deploy Falco and OPA Gatekeeper, and run kube-bench. Security controls must be practiced hands-on.

🔄

Context switching

The exam uses multiple clusters. Always run 'kubectl config use-context <context>' at the start of each question to avoid mistakes.

📝

Read the task precisely

Security tasks specify exact names, namespaces, and controls. Apply exactly what is asked - an over-broad policy or wrong label loses points.

✅

Verify your controls

Prove each control works: test NetworkPolicy traffic, confirm a pod is admitted/rejected under PSA, and re-scan or verify signatures after signing. Partial credit is often available.

Back to Certification

Certified Kubernetes Security Specialist Exam Guide

Everything you need to know about the CKS certification exam, from preparation strategies to exam day tips.

Exam Information

120 minutes

Duration

15-20 performance tasks

Questions

67%

Passing Score

$395 USD

Exam Cost

Recommended Study Plan

Week 1

Cluster Setup

Cluster Setup (10%)

8-10 hours

Use NetworkPolicy to restrict cluster access
Review CIS benchmarks for kubelet, etcd, and kube-apiserver
Configure Ingress with TLS termination
Protect node metadata and endpoints; minimize GUI access
Verify platform binaries before deployment

Recommended Resources:

Kubernetes NetworkPolicy docs

CIS Kubernetes Benchmark

kube-bench

Week 2

Cluster Hardening

Cluster Hardening (15%)

8-10 hours

Restrict access to the Kubernetes API
RBAC least privilege: Roles, ClusterRoles, and bindings
Service account hygiene and token mounting
API server hardening (anonymous-auth, authorization modes)
Prompt Kubernetes upgrades and version hygiene

Recommended Resources:

Kubernetes RBAC docs

API server hardening guide

Week 3

System Hardening

System Hardening (15%)

8-10 hours

Minimize host OS footprint and use least-privilege IAM
Minimize external network access from nodes and pods
Apply AppArmor profiles to workloads
Apply seccomp profiles (RuntimeDefault, Localhost)
Kernel hardening and host-level isolation

Recommended Resources:

Kubernetes AppArmor tutorial

Kubernetes seccomp tutorial

Week 4-5

Minimize Microservice Vulnerabilities

Minimize Microservice Vulnerabilities (20%)

14-16 hours

Pod Security Admission and Pod Security Standards
securityContext: runAsNonRoot, readOnlyRootFilesystem, drop capabilities
OPA Gatekeeper policies and constraints
Manage Secrets and enable encryption at rest
Container runtime sandboxes (gVisor, Kata Containers)
Pod-to-pod mTLS with a service mesh (Istio, Linkerd)

Recommended Resources:

Pod Security Standards docs

OPA Gatekeeper docs

Istio security docs

Week 6

Supply Chain Security

Supply Chain Security (20%)

12-14 hours

Minimize base image footprint (distroless, multi-stage builds)
Scan images for vulnerabilities with Trivy
Sign and verify images with Cosign
Generate and consume Software Bill of Materials (SBOM)
Whitelist approved container registries
Static analysis of manifests and Dockerfiles

Recommended Resources:

Trivy docs

Sigstore/Cosign docs

kubesec

Week 7

Monitoring, Logging and Runtime Security

Monitoring, Logging and Runtime Security (20%)

12-14 hours

Detect threats at runtime with Falco
Configure Kubernetes audit logging and audit policies
Behavioral analytics and anomaly detection
Immutability and read-only filesystems
Detect and respond to security threats

Recommended Resources:

Falco docs

Kubernetes audit logging docs

Week 8

Full Exam Simulation & Review

All domains - Integrated Review

10-12 hours

Timed practice tasks across all 6 domains
Drill the three 20%-weight domains (microservice, supply chain, monitoring)
Speed up kubectl and security tooling commands
Exam-day logistics and environment setup

Recommended Resources:

Killercoda CKS scenarios

CKS practice exams

Exam Tips & Strategies

⚡

Master kubectl and security tooling

Learn aliases like 'k=kubectl' and get fluent with kube-bench, trivy, cosign, and falco. Speed with security tooling is critical in this exam.

📚

Know the allowed docs

You can access kubernetes.io/docs during the exam. Memorize where the Security, NetworkPolicy, Pod Security Standards, AppArmor, and seccomp pages live.

🔧

Practice on real clusters

Use kind or minikube with AppArmor/seccomp enabled, deploy Falco and OPA Gatekeeper, and run kube-bench. Security controls must be practiced hands-on.

🔄

Context switching

The exam uses multiple clusters. Always run 'kubectl config use-context <context>' at the start of each question to avoid mistakes.

📝

Read the task precisely

Security tasks specify exact names, namespaces, and controls. Apply exactly what is asked - an over-broad policy or wrong label loses points.

✅

Verify your controls

Prove each control works: test NetworkPolicy traffic, confirm a pod is admitted/rejected under PSA, and re-scan or verify signatures after signing. Partial credit is often available.