Certification guide
CKSCertified Kubernetes Security Specialist: the honest guide
CKS is a two-hour hands-on exam against live clusters, and it is the security specialization of CKA rather than a separate track. You are given tasks and a terminal, it is open book against the documentation, and the work either runs or it does not.
It has an entry requirement that no other exam in this catalog enforces: you must have taken and passed CKA before you may sit CKS. That makes this a sequencing decision rather than a choice, and it means a candidate starting from nothing is planning two exams.
Who CKS is for
A good fit if
- You hold CKA and secure clusters as part of the job rather than as a project.
- You work in platform engineering or security and Kubernetes is production infrastructure your team owns.
- You want a credential that cannot be passed by recognition, because every task is something you type against a real cluster.
- Your employer needs certified staff for a partner requirement or a customer security commitment.
Probably not, if
- You do not hold CKA. This is not advice about study order; the Linux Foundation gates the exam on it.
- You want Kubernetes security theory. KCSA covers the threat model and the vocabulary in multiple choice form and costs less than half as much.
- Your Kubernetes work is entirely on a managed platform where somebody else owns admission control, audit policy and node hardening. The exam tests the parts your provider is doing for you.
Is CKS worth it?
For a platform or security engineer who already holds CKA, this is the strongest Kubernetes security credential available, and the format is the reason. A hands-on exam that asks you to write a network policy or fix an over-permissive RBAC binding under time pressure cannot be crammed, and hiring managers who know the exam know that.
The economics are better than the headline. $445 includes a second attempt and two simulator sessions, which priced separately would cost more. What the headline hides is the prerequisite: CKA is another $445 and another study effort, so the honest question is whether you want the pair.
It is the wrong exam if cluster security is aspirational. Sixty percent of the curriculum sits in microservice vulnerabilities, supply chain security and runtime monitoring, and none of those can be learned from reading in the fortnight before a sitting.
What the exam actually asks you to do
Entirely hands-on: tasks in a terminal against live clusters, open book against allowed documentation. No multiple choice at all.
Item formats
- Performance-based
The highlighted formats are the ones you cannot answer from memory alone. Linux Foundation, CKS exam details ↗
Domain breakdown and official weightings
From the official published CNCF curriculum. Minimize Microservice Vulnerabilities is the heaviest domain at 20 percent, followed by Supply Chain Security at 20 percent.
- Cluster Setup15%
- Cluster Hardening15%
- System Hardening10%
- Minimize Microservice Vulnerabilities20%
- Supply Chain Security20%
- Monitoring, Logging and Runtime Security20%
Study plans by experience level
Holding CKA, securing clusters at work
5 to 6 weeksat 6 hours
- 1Week 1: read the curriculum against what your platform already does for you. Managed clusters supply admission control defaults and audit configuration, and the exam expects you to set both.
- 2Weeks 2 to 3: the three 20 percent domains, one per block. Microservice vulnerabilities, supply chain security, then runtime monitoring, logging and detection.
- 3Week 4: cluster and system hardening, which are 15 and 10 percent. RBAC, network policies, seccomp and AppArmor, written by hand until the shapes are familiar.
- 4Weeks 5 to 6: both simulator sessions, a fortnight apart, each treated as a real sitting rather than a review.
Holding CKA, no security background
10 to 12 weeksat 8 hours
- 1Weeks 1 to 2: the security primitives in the documentation. Service accounts, RBAC, secrets handling and Pod Security Admission, on a local cluster.
- 2Weeks 3 to 5: supply chain work. Image scanning, admission policy that rejects an unsigned or vulnerable image, and minimizing base images.
- 3Weeks 6 to 8: runtime detection. Falco or an equivalent, audit logging, and what a suspicious syscall pattern actually looks like in output you have generated yourself.
- 4Weeks 9 to 10: cluster and system hardening end to end on a cluster you built, including node-level controls.
- 5Weeks 11 to 12: both simulator sessions, plus timed practice on the documentation pages you keep reaching for.
Security engineer, new to Kubernetes operations
16 weeks, CKA firstat 8 hours
- 1Weeks 1 to 8: CKA. It is the prerequisite and it is not optional, and the operational fluency it builds is what makes CKS tasks finishable in the time.
- 2Weeks 9 to 11: the Kubernetes security model proper. Authentication, authorization, admission, and where each one actually intercepts a request.
- 3Weeks 12 to 14: supply chain and runtime domains, which together are 40 percent of the exam.
- 4Weeks 15 to 16: hardening practice and both simulator sessions.
Common mistakes
- Booking before CKA
- The Linux Foundation states that CKS candidates must have taken and passed the CKA exam before attempting CKS. Candidates who plan the two in parallel, or who assume the requirement is advisory, discover otherwise at the worst possible point in the process.
- Studying security without operating a cluster
- Every task lands in a terminal against a live cluster, so the security knowledge has to arrive attached to operational fluency. Somebody who can describe Pod Security Admission but cannot quickly find and edit the right manifest will run out of time on tasks they understood perfectly.
- Practicing away from the documentation
- The exam is open book, and the security primitives carry long YAML shapes that nobody writes from memory under a two-hour clock. Knowing which documentation page holds the network policy example, and getting to it in seconds, is part of what is being tested.
- Treating the simulator as a final check
- Two sessions come with registration, each with 36 hours of access from activation. Used as a confidence test at the end they are demoralising, because they are harder than the real exam. Used as scheduled study with a fortnight between them they are the best preparation available.
- Spreading study evenly across six domains
- Minimize Microservice Vulnerabilities, Supply Chain Security, and Monitoring, Logging and Runtime Security are 20 percent each. Sixty percent of the exam sits in those three, and System Hardening at 10 percent is where an extra week buys the least.
What comes after passing
CKS is valid for two years and renewal means sitting the current exam again. There is no continuing education route at the Linux Foundation, so nothing accumulates in place of a sitting.
You are now managing two expiry dates, because CKA is also a two-year certification and it is the one that gates CKS. Passing them in the same season keeps the dates together rather than staggered across the calendar.
The seasonal Linux Foundation discounts apply to renewals, so a renewal booked in a sale costs materially less than one booked in a hurry.
Two years is short and it is the right length for this subject. Admission control changed shape with Pod Security Admission, and supply chain attestation tooling has moved again since. A renewal here is genuine study.
Costs across the full renewal cycle are on the CKS cost page.
Frequently asked questions
Do I really need CKA before CKS?
Yes. The Linux Foundation states that CKS candidates must have taken and passed the CKA exam prior to attempting CKS, so it is enforced at registration rather than recommended in a study guide. Budget two exams at $445 each if both are still ahead of you.
Is the CKS retake free?
Registration includes one retake at no extra cost, which is why the retake line on the cost page is zero. A first failure costs you the wait and the preparation rather than another fee, and a third sitting would be a new registration at full price.
Can I use the documentation during the exam?
Yes, it is open book against the allowed documentation, and that changes how you should practice. Candidates who learn from a course and then meet the documentation for the first time under a two-hour clock lose time on tasks they knew how to do.
How is CKS different from KCSA?
KCSA is a 90-minute multiple choice exam covering the cloud native security threat model and vocabulary, with no prerequisites and a $250 fee. CKS is hands-on, requires CKA first, and asks you to implement the controls rather than describe them. KCSA is a reasonable step toward CKS; it is not a substitute for it.
How long is CKS valid?
Two years, which is shorter than the three-year cycle CompTIA and Cisco use. Renewal means passing the current version of the exam again, because the Linux Foundation runs no continuing education or credit scheme.
Keep reading
- CKS practice questions
Free sample questions with the full explanation on every answer.
- Free CKS practice test
10 original questions, playable now. No account, no card.
- CKS exam format
How many questions, how long, what the items look like, and how long it stays valid.
- CKS passing score
The exact cut score, what kind of number it is, and the retake terms.
- How hard is CKS?
An honest difficulty read from the format, the clock and the weights.
- What CKS costs
The voucher price, the retake, and what renewal costs across the cycle.
Practice CKS for free while you decide
Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.
Start free CKS questions