CKS
Certified Kubernetes Security Specialist (CKS)
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The Certified Kubernetes Security Specialist (CKS) is a vendor-neutral credential created by the Cloud Native Computing Foundation in collaboration with The Linux Foundation. It attests that a holder can apply security best practices to container-based applications and Kubernetes platforms across build, deployment and runtime - hardening clusters and nodes, tightening access, securing the supply chain, and detecting threats rather than merely operating workloads. It suits platform engineers, DevOps and SRE practitioners, and consultants who already administer Kubernetes day to day and now want to demonstrate depth in security specifically. It is not an entry point: candidates must have taken and passed the CKA before attempting the CKS, although the CKA does not have to be active. The exam is entirely performance-based - you solve tasks from a command line in a live Kubernetes environment, remotely proctored, with two hours on the clock. Coverage spans six domains: Cluster Setup, Cluster Hardening, System Hardening, Minimize Microservice Vulnerabilities, Supply Chain Security, and Monitoring, Logging and Runtime Security, with the last three carrying the largest shares. Preparation should be hands-on: work through the open-source curriculum, practise the specific tools each domain names, and use every timed simulator attempt you receive, because pacing is as much a hurdle as knowledge. This guide is independent and is not affiliated with CNCF or The Linux Foundation.
What you'll study
About CKS preparation
What is the exam actually like on the day?
It is an online, proctored, performance-based test: you solve multiple tasks from a command line running Kubernetes, with a live proctor monitoring via webcam and screen sharing. Candidates have two hours to complete the tasks. Expect hands-on configuration work, not multiple choice, and plan to move quickly between clusters and namespaces.
Do I need to hold a CKA first?
Yes. CKS candidates must have taken and passed the Certified Kubernetes Administrator (CKA) exam prior to attempting the CKS. The CKA does not have to be currently active - passing it is the requirement, so an expired CKA does not block you from sitting the CKS.
What does the $445 fee include?
The cost is $445 and includes one free retake. The Linux Foundation storefront describes it as 12 months to schedule and take the exam, access to two exam simulation attempts, and two exam attempts. Bundles are also sold: exam plus an annual subscription for $625, or exam plus the LFS260 course for $645.
How long is the certification valid?
The certification remains valid for two years from the date it is awarded. Recertification therefore becomes a planning item roughly 18 months in, especially if you are stacking multiple Kubernetes certifications and want to avoid two renewals landing in the same quarter.
Which Kubernetes version is the exam based on?
The Linux Foundation page states the exam is based on Kubernetes v1.35. The CKS exam environment is aligned with the most recent Kubernetes minor version within approximately 4 to 8 weeks of the release date, and quarterly exam updates are planned to match Kubernetes releases, so verify the version before booking.
How are the six domains weighted?
The Linux Foundation storefront lists Cluster Setup 15%, Cluster Hardening 15%, System Hardening 10%, Minimize Microservice Vulnerabilities 20%, Supply Chain Security 20%, and Monitoring, Logging and Runtime Security 20%. The CNCF page lists a different split - Cluster Setup 10%, Cluster Hardening 15%, System Hardening 15%. Both total 100%; check the current curriculum overview before finalising your study plan.
What is the included exam simulator like?
Once enrolled you receive access to an exam simulator provided by Killer.sh. You get two simulation attempts, each with 36 hours of access from activation. Each CKS simulator session has 17 questions, and the second attempt gives you a different set of 17. The simulation provides graded results, so treat it as a timed rehearsal.
How hard is it, and where do candidates typically lose points?
Candidate reviews describe it as challenging and time-pressured. The recurring failure mode is pacing: spending too long on one task, fumbling routine cluster operations, or pausing to look up commands you should know cold. Practise single tasks against a clock, keep terminal shortcuts ready, and abandon and return rather than overrun.
In what order should I study the domains?
Build CKA-level fluency first, since every task depends on it, then work the heaviest domains hardest: Minimize Microservice Vulnerabilities, Supply Chain Security, and Monitoring, Logging and Runtime Security. Follow with Cluster Setup and Cluster Hardening, and finish with System Hardening, which carries the smallest share. Finish with full timed simulator runs.