Certified Kubernetes Security Specialist (CKS) Exam Guide
The Certified Kubernetes Security Specialist (CKS) exam validates practical ability to secure container-based applications and Kubernetes platforms during build, deployment, and runtime. It is intended for Kubernetes practitioners who already hold the CKA certification and want to demonstrate security competence across cluster, system, workload, supply-chain, and runtime concerns. This guide helps you decide whether your current administrator skills are ready, which domains deserve the most study time, and how to rehearse the command-line work and remote exam setup before scheduling.
What the CKS certification validates
CKS is a globally recognized, vendor-neutral Linux Foundation certification focused on securing Kubernetes platforms and container-based applications. It tests implementation rather than simple recognition: candidates solve performance-based tasks from a Linux command line in a Kubernetes environment. The credential therefore suits practitioners who need to configure, inspect, harden, and troubleshoot security controls directly.
The build-to-runtime security scope
The official scope spans build, deployment, and runtime. That scope matters when planning preparation: learning only Kubernetes admission controls or only container scanning leaves important gaps. A useful study plan follows the lifecycle of an image and workload—from source and image provenance, through cluster admission and configuration, to monitoring and response after deployment.
Who should schedule it
CKS candidates must have achieved the CKA certification before attempting the exam, but the CKA does not need to be active. The Linux Foundation states that a CKA status of Achieved, Renewed, or Expired can satisfy the prerequisite. Candidates without that administrator foundation should strengthen cluster operations first rather than treating CKS as an introductory security exam.
What the prerequisite changes in your preparation
Treat the CKA prerequisite as an operational baseline, not as proof that every CKA topic is exam-ready. Before beginning CKS-specific work, check whether you can move confidently through namespaces, workloads, services, RBAC, kubeconfig contexts, node configuration, and troubleshooting from the terminal. If ordinary administration still requires extensive searching, repair that bottleneck before adding security tooling.
How the domains are weighted
The current blueprint has six domains. Supply Chain Security and Monitoring, Logging and Runtime Security each carry 20%, as do Minimizing Microservice Vulnerabilities. Cluster Setup and Cluster Hardening each carry 15%, while System Hardening carries 10%. Use those labels with the percentages when allocating practice time; do not study from an unlabeled list of figures.
Cluster Setup — 15%
Cluster Setup represents 15% of the CKS domain weight. Prepare to reason about secure cluster configuration and the security consequences of the way control-plane and node components are established. Your practice should involve reading configuration, identifying an unsafe setting, applying a controlled correction, and verifying that the change has the intended effect without breaking administration.
Cluster Hardening — 15%
Cluster Hardening represents 15% of the CKS domain weight. This is the place to connect Kubernetes authorization and exposure decisions to concrete operations. Practice inspecting permissions and configuration, reducing unnecessary access, and validating behavior with the least privilege that still permits the required task. Record the commands and verification checks rather than memorizing isolated fragments.
System Hardening — 10%
System Hardening represents 10% of the CKS domain weight. Study the host and operating-system layer as part of the cluster attack surface. Rehearse identifying risky host settings or processes, applying a narrowly scoped hardening change, and checking the result. Keep a clear boundary between a Kubernetes object problem and a node-level problem so that diagnosis starts in the right place.
Minimizing Microservice Vulnerabilities — 20%
Minimizing Microservice Vulnerabilities represents 20% of the CKS domain weight. Prepare for workload-level decisions involving how applications communicate, run, and expose capabilities. A strong exercise gives you a deliberately weak deployment, asks you to reduce its privileges or exposure, and requires a functional verification afterward. Security is not complete if the repaired workload no longer serves its intended purpose.
Supply Chain Security — 20%
Supply Chain Security represents 20% of the CKS domain weight. Build a repeatable workflow for examining images and deployment inputs, recognizing trust and provenance risks, and applying appropriate policy or validation. Practice distinguishing an image problem from a manifest problem. When a tool reports a finding, determine what should be changed and how you would prove that the correction is actually enforced.
Monitoring, Logging and Runtime Security — 20%
Monitoring, Logging and Runtime Security represents 20% of the CKS domain weight. The official outline includes behavioral analytics, threat detection, investigation of attack phases and bad actors, runtime immutability, and Kubernetes audit logs. Practice moving from an observable signal to a focused investigation: identify the relevant workload or identity, inspect evidence, and preserve a defensible explanation of what happened.
How the blueprint should affect your calendar
The weights should influence time allocation, but they should not become a reason to ignore the 10% System Hardening domain or any competency you cannot perform. Start with a diagnostic across all six domains, then spend the largest blocks on the three 20% domains while returning regularly to the 15% and 10% domains. Interleave topics near the end so that a random task does not derail you.
What the delivery format demands
The CKS is an online, remotely proctored, performance-based exam. Candidates solve 15-20 performance-based tasks on the command line running Linux and have 2 hours to complete the CKS exam. This format rewards fast diagnosis, reliable shell habits, and verification under time pressure more than long-form theoretical recall.
Practice the task loop
Use the same loop for every lab: read the objective, identify the affected resource or host, inspect before editing, make the smallest safe change, test the requested behavior, and review the final state. This prevents a common failure mode in hands-on tests—making a plausible change without proving that the requested security property now exists.
Build terminal fluency without shortcuts that hide understanding
Use documentation and command help during ordinary study to understand syntax, then repeat the task from a clean starting point. Keep a compact personal reference for command patterns, file locations, context selection, and verification commands. The purpose is retrieval speed, not memorizing copied answers. Avoid any material claiming to reproduce live exam tasks; it cannot replace legitimate practice and may violate exam rules.
Manage two hours deliberately
A useful recommendation is to divide practice sessions into an initial pass and a review pass. On the initial pass, take the points you can secure quickly and flag tasks that require deeper diagnosis. On review, return to incomplete work, check for syntax or context errors, and verify that changes persisted. Do not spend an uncontrolled block of time polishing one uncertain fix.
Do not confuse an explanation with a completed task
A written explanation of Pod Security, image provenance, or audit logging is useful only if you can translate it into an operational change. For every study note, add a command-line action and a verification method. If you cannot identify what output would demonstrate success, the topic is not yet ready for performance-based assessment.
A practical preparation sequence
Prepare in layers: establish CKA-level administration, map the six CKS domains, learn the security mechanism behind each objective, and then rehearse mixed timed labs. This sequence reduces wasted effort because it separates missing Kubernetes fundamentals from missing security knowledge and finally tests whether you can combine both while working at the terminal.
Stage one: diagnose the administrator foundation
Begin with a cold diagnostic rather than a course catalog. Choose representative tasks involving cluster inspection, RBAC, workload configuration, node access, and troubleshooting. Note whether each delay comes from Kubernetes vocabulary, shell navigation, YAML editing, or security reasoning. Your diagnosis should produce a short list of skills to repair, not a vague conclusion that you need to study everything.
Stage two: create a domain-to-lab matrix
Make six rows—one for each official domain—and add columns for concepts, hands-on actions, failure symptoms, and verification commands. For example, a supply-chain row might connect an image or manifest concern to a policy decision and then to an enforcement check. This matrix turns the blueprint into observable skills and makes weak areas visible before you book an attempt.
Stage three: learn mechanisms, not product names
Security tools are useful only when you understand the control they implement and the evidence they produce. For each tool or feature in your approved study material, write four notes: the risk addressed, the configuration surface, the expected successful behavior, and the quickest diagnostic when it fails. This approach transfers better when a task changes the surrounding resource names or presents an unfamiliar symptom.
Stage four: repeat from clean states
Reset your lab after meaningful exercises. A fix that works only because a previous experiment changed the environment is not reliable preparation. Keep a minimal setup procedure, then rebuild or restore it often enough to expose hidden dependencies. Practice both applying a control and removing a mistaken change safely, because troubleshooting frequently requires distinguishing the original fault from your latest edit.
Stage five: add mixed timed sessions
Once each domain has a basic lab, combine them. A single scenario might require a workload correction, a permission review, an image decision, and a runtime investigation. Time the session, but review it afterward by category: recognition, command construction, navigation, verification, or time management. The category tells you what to improve; a raw completion time does not.
A six-week study roadmap
A six-week roadmap works well when you can study consistently, but the calendar is a recommendation rather than an official requirement. Use the first weeks to establish coverage and the final weeks to improve execution. If your CKA foundation is weak, extend the first phase instead of compressing administrator practice to meet an arbitrary exam date.
Week one: baseline and environment
Confirm the CKA prerequisite in your Linux Foundation account, read the current official CKS domains and competencies, and build a disposable Kubernetes practice environment. Run a baseline lab without notes. Measure practical friction: context mistakes, slow YAML editing, unfamiliar logs, or uncertainty about where a setting lives. Finish the week with a prioritized backlog.
Week two: cluster and system controls
Focus on Cluster Setup, Cluster Hardening, and System Hardening. Practice inspection before modification and verification after modification. Include exercises that deliberately create authorization or host-configuration problems, then document the smallest correction. Keep the domain labels attached to your notes so the 15%, 15%, and 10% areas remain visible rather than disappearing behind more interesting tools.
Week three: workload vulnerability reduction
Make Minimizing Microservice Vulnerabilities the central theme of the third week. Work through deployments, service exposure, identities, privileges, and communication boundaries using your approved learning resources. For every change, test both the security constraint and the application’s intended operation. Finish by explaining why the original configuration was risky and what evidence supports the new one.
Week four: supply-chain controls
Spend the fourth week on Supply Chain Security. Organize practice around the path from image selection to admission and deployment. Compare vulnerable and corrected inputs, inspect the resulting behavior, and note where a policy is evaluated. Avoid tool-only memorization: the important skill is choosing and verifying a control when the scenario describes a risk in different words.
Week five: monitoring and runtime investigation
Use week five for Monitoring, Logging and Runtime Security. Generate controlled events in your lab, locate the relevant audit or runtime evidence, and practice narrowing a noisy signal to a particular identity, workload, or action. Include investigation notes that distinguish observation from conclusion. Then repeat the exercise with less guidance so that evidence gathering becomes a terminal habit.
Week six: full rehearsals and repair
Run mixed, timed simulations during the final week, leaving enough time to review every miss. Revisit only the skills that caused failure: perhaps a wrong context, an incomplete policy, an unverified file edit, or a slow investigation. Use the official simulator access included with a standard CKS exam purchase as an opportunity to rehearse the interface and timing, not as a source of guaranteed exam content.
How to use simulators and other study resources
Simulators are most valuable when treated as diagnostic instruments. The standard CKS offering includes access to two exam simulation attempts, and each simulator session has 17 questions with a different set of questions in each attempt. Use the first attempt to expose weak workflows and the second after targeted repair; do not mistake simulator familiarity for mastery of the underlying controls.
Review every missed task by cause
After a simulation, classify each miss as knowledge, interpretation, command, environment navigation, verification, or time management. Then reproduce the underlying skill in a fresh lab. If you only read the solution, you may remember the path without learning how to recognize the same security problem when the namespace, resource name, or symptom changes.
Use official scope before third-party topic lists
Start with the Linux Foundation certification page and its current competencies. Third-party courses, labs, and notes can provide repetition, but they should be checked against the official scope. This is especially important because the CKS domains remained recognizable while competencies and domain percentages changed for exams taken after 12:01am UTC on September 12, 2024.
Keep study notes operational
A useful note has a trigger, an inspection command, a correction pattern, and a verification result. For instance, instead of writing only “review audit logs,” record what event or identity would lead you there, where you would inspect, what evidence matters, and how you would avoid drawing a conclusion from a single unrelated event.
Scheduling, eligibility, and purchase decisions
Schedule only after confirming both eligibility and readiness. CKA achievement is required, but it may be active, renewed, or expired. A standard CKS exam purchase includes 12 months to schedule and take the exam, two exam attempts, and access to two exam simulation attempts. Check the live catalog and your order terms before relying on any package or price detail.
Check the CKA status rule first
The CKS prerequisite is achievement of CKA at any time; an active CKA is not required for scheduling. This removes a common planning error: delaying CKS solely because the CKA certificate has expired. Confirm your own record before purchasing or contacting support, particularly if the account uses a different email address or older certification profile.
Understand the registration window and retake
The exam registration gives eligibility within 12 months of the registration date, or until a corporate subscription expires, whichever happens first. One retake per eligible exam purchase may be granted when a passing score is not achieved, subject to the terms. Plan the initial attempt early enough that a permitted retake can still fit within the applicable window.
Make changes before the cutoff
An exam reservation may be rescheduled or cancelled up to 24 hours before its start time. Changes are unavailable when 24 hours or less remain, and a no-show forfeits the registration fees and is not eligible for a retake. Treat the reservation as a commitment: verify your environment, room, and availability before the cutoff rather than improvising on exam day.
Check the current catalog rather than relying on old pricing
The Linux Foundation catalog lists exam-only and bundled purchase options, but prices and package contents can change. Use the official certification page for the current offer that suits your needs. If refund eligibility matters, the terms state that both conditions must be met: the purchase was made less than three business days ago and the exam has not been scheduled or taken.
Consider the CKA renewal relationship where relevant
CNCF states that, beginning June 18, 2026, passing or recertifying CKS automatically reinstates or extends CKA to the new CKS expiration date, including when CKA has already expired. This is a scheduling consideration for candidates managing both credentials, but verify the applicable announcement and your timing before making a renewal decision.
Remote delivery and technical preparation
The exam is delivered through PSI Bridge using the PSI Secure Browser, with remote audio, video, and screen-sharing proctoring. You provide the computer and must satisfy PSI’s system requirements. Complete the official system check well before the appointment, then rehearse with one monitor, a working microphone, reliable connectivity, and the same browser-based workflow you expect to use.
Prepare the computer and network
The official instructions call for reliable internet access, a supported operating system, a microphone, and one active monitor; dual monitors are not supported. The Linux Foundation recommends a screen size of 15” or higher and a screen resolution of 1080p for the ExamUI. Reduce competing bandwidth use and disable bandwidth-intensive services before launching the exam.
Install the secure browser at the correct point
The PSI Secure Browser download is made available at exam launch, and the download or installation begins when you select “Launch exam” from the PSI Dashboard. Review the PSI Bridge FAQ and Linux OS troubleshooting guidance beforehand. Do not wait until the appointment to discover that a managed device, firewall, proxy, or operating-system restriction prevents launch.
Use an appropriate private space
Remote proctoring requires a controlled testing environment. Public spaces such as coffee shops, stores, and open office environments are not allowed. Choose a private location, remove avoidable distractions, and verify that the camera, microphone, screen sharing, and network behave correctly there. The proctoring feeds may be stored for a limited period if later review is needed.
Protect your terminal workflow
Keyboard mistakes can cost time. The official CKS instructions specify Ctrl+Alt+W instead of Ctrl+W because Ctrl+W closes the current tab in Google Chrome. In the Linux terminal, use Ctrl+Shift+C to copy and Ctrl+Shift+V to paste, or use the right-click context menu. Practice these habits before the exam so they are automatic under pressure.
Plan for the single-screen interface
Because dual monitors are not supported, practice switching between the exam interface and the permitted resources on one display without losing your place. Keep terminal panes or tabs organized, use short filenames and focused commands, and avoid opening unnecessary windows. The goal is a clean sequence: read, inspect, change, verify, and return to the task.
Language and result timing
The CKS exam is available in English, Japanese, and Simplified Chinese. Candidates may switch among available exam languages through the exam console’s language control. Results are emailed within 24 hours of exam completion, subject to the stated qualification for automatic scoring and technical exceptions.
Choose the language that reduces interpretation overhead
Select the available language in which you understand security instructions most precisely, not merely the language used in your study notes. If you may switch during the exam, learn where the language control appears before starting. Avoid changing language as a substitute for reading carefully; use it only when wording, rather than Kubernetes knowledge, is slowing interpretation.
Do not schedule around an instant result
The official result expectation is within 24 hours, not immediately at submission. If a result is needed for a work or renewal decision, leave room for that reporting window and verify the certification status through the Linux Foundation’s official systems when appropriate. Keep your own study outcome separate from informal simulator scores or third-party predictions.
Common preparation mistakes
Most avoidable failures come from practicing the wrong behavior: reading instead of configuring, memorizing tools instead of tracing risks, or ignoring the delivery setup until the appointment. Correct these by making every study session produce an observable change, a verification step, and a short note about why the control matters.
Mistake: studying only the largest domains
The three 20% domains deserve substantial attention, but Cluster Setup, Cluster Hardening, and System Hardening still contribute to the blueprint. More importantly, a task may require skills from several areas at once. Maintain minimum hands-on coverage across all six domains, then use the weights to decide where additional repetition produces the greatest benefit.
Mistake: treating YAML as the whole exam
Manifest editing is only one part of command-line security work. A task may require cluster inspection, host investigation, authorization reasoning, image or policy analysis, log interpretation, and behavioral diagnosis. Alternate declarative edits with imperative inspection and troubleshooting so that you can move between configuration and evidence.
Mistake: changing too much at once
Broad edits make it difficult to identify which change fixed the problem and can create new failures. Start with the smallest relevant configuration or command, save the original state when practical, and verify immediately. If the result is wrong, revert or isolate the change before trying another hypothesis. This is safer practice and faster diagnosis.
Mistake: skipping verification
A command that returns without an error does not necessarily satisfy the objective. Check the effective resource, permissions, policy result, process state, event, or log evidence that demonstrates the security property. Build verification into your notes and scripts so it becomes part of completion rather than an optional final step.
Mistake: rehearsing on an unfamiliar machine
A technically sound study plan can be undermined by an incompatible operating system, blocked endpoint, noisy network, dual-monitor setup, or malfunctioning microphone. Run the PSI system check, read the current instructions, and perform a complete practice launch on the machine and network you intend to use. Resolve uncertainty before reserving a time.
Mistake: relying on dumps or memorized answers
Exam dumps and purported live questions are not a sound preparation strategy. They cannot establish that you understand the security control, may be inaccurate after blueprint changes, and can conflict with exam confidentiality and misconduct rules. Build transferable skill through legitimate labs, official objectives, simulator feedback, and repeated verification instead.
The final readiness check
You are ready to schedule when you can take an unfamiliar security scenario, identify the relevant domain, work from the terminal without constant procedural prompting, and prove the result within a timed session. Readiness is demonstrated by repeatable execution across mixed tasks—not by recognizing a list of tool names or completing one familiar lab.
Use this evidence-based checklist
Before scheduling, confirm that you can: explain the risk behind each major competency; inspect before changing; select the correct Kubernetes context; apply a least-privilege correction; distinguish host, cluster, workload, supply-chain, and runtime evidence; recover from a failed change; and verify the final state. Mark a skill ready only after performing it from a clean environment.
Run one final mixed rehearsal
Complete a full practice session with no topic labels shown in advance. Track time lost to reading, navigation, commands, and debugging. Afterward, repair the largest cause of delay and repeat only the affected workflow. If you still need extensive hints to finish several domains, postpone scheduling and use the remaining registration window for targeted practice.
Prepare your appointment logistics
Confirm the reservation time, identification and candidate requirements in the current handbook, private room, supported computer, one active monitor, microphone, network, and PSI launch path. Review rescheduling rules before the cutoff. Keep the official instructions accessible during preparation, while recognizing that exam rules—not informal advice—control what is permitted during the session.
What to do after an attempt
After the attempt, wait for the official result email and use the outcome to guide the next decision. If you pass, record the certification achievement and expiration information. If you do not pass and the purchase is eligible for a retake, analyze domain and workflow weaknesses before trying again rather than repeating the same study routine.
If you pass
Linux Foundation certifications become non-current 24 months from the date the certification requirements are successfully met, unless another stated condition applies. Review the certification page for available renewal paths and plan before expiration. If you also hold CKA, check the applicable CNCF CARE information and the resulting certification dates rather than assuming the relationship from an older policy.
If you need the retake
Confirm that your purchase includes the eligible retake and that the applicable 12-month or corporate-subscription window has not closed. Reconstruct each failure as a skill gap: misunderstood objective, incorrect context, incomplete fix, weak evidence, or poor time allocation. Build a short repair cycle around those causes, then use fresh tasks to confirm the improvement.
Turn the preparation into operational capability
The most useful post-exam outcome is a reusable security workflow. Keep improving your ability to inspect configurations, reduce privilege, validate supply-chain decisions, monitor audit and runtime evidence, and explain the trade-offs behind a change. The certificate records achievement; disciplined verification is what makes the knowledge dependable in real Kubernetes administration.
Conclusion
A sensible CKS decision rests on three checks: you have the CKA prerequisite, you can perform security work across all six current domains, and your computer and private testing environment meet the remote-delivery requirements. Build from administrator fluency, prioritize the three 20% domains without neglecting the rest, rehearse mixed command-line tasks, and schedule only when your results are repeatable. Use the official Linux Foundation and CNCF pages for current competencies, terms, language options, and certification policy before committing to an appointment.
