CKS study plan

Label a namespace with pod-security.kubernetes.io/enforce=restricted and confirm a privileged test pod is rejected at admission

Apply a hardened securityContext to a Deployment (runAsNonRoot, allowPrivilegeEscalation=false, readOnlyRootFilesystem, drop ALL capabilities, seccompProfile RuntimeDefault) and verify each field survives the running pod

Mount a Secret as a volume instead of an env var, then enable encryption at rest for Secrets by supplying an EncryptionConfiguration to the API server

Attach a Localhost seccomp profile to a pod and demonstrate that a blocked syscall fails while the container still serves traffic

Scan a container image with trivy and fail a shell script when HIGH or CRITICAL CVEs are present

Rewrite a Dockerfile as a multi-stage build that runs as a non-root UID and pins the base image by digest

Sign an image with cosign and write a verification step that rejects an unsigned image before deployment

Install an admission policy (OPA Gatekeeper constraint or ValidatingAdmissionPolicy) that denies images tagged :latest or pulled from unapproved registries

Run static analysis over your Kubernetes manifests with kubesec or checkov and remediate every HIGH finding

Write an audit policy capturing RequestResponse for Secrets and Metadata for everything else, wire it into the API server, and extract a single event from the audit log

Deploy Falco and author one custom rule that fires when a shell is spawned inside a container

Trigger the rule by exec-ing into a pod, then capture the alert with timestamps

Investigate the simulated intrusion using pod process listing and crictl, then isolate the workload by applying a quarantine NetworkPolicy

Configure readOnlyRootFilesystem and a non-privileged container and confirm an in-container write to / fails

Implement a default-deny ingress and egress NetworkPolicy in a namespace, then add an allow-list and prove allowed traffic works while blocked traffic times out

Run kube-bench against the control plane and worker nodes and remediate at least three findings

Create an Ingress with TLS termination and verify the certificate is served correctly

Restrict anonymous access to the kubelet read-only port and confirm the metrics endpoint no longer answers unauthenticated requests

Author least-privilege Role and ClusterRole objects and prove them with kubectl auth can-i --as for both an allowed and a forbidden verb

Disable automountServiceAccountToken on workloads and bind a dedicated minimal ServiceAccount to each Deployment

Harden API server flags (anonymous-auth=false, authorization-mode=Node,RBAC, explicit audit log path) and verify the running config

Set a short serviceAccountToken expiration on a test token and confirm the stale token is rejected

Patch the KubeletConfiguration to set anonymous-auth=false, readOnlyPort=0 and protectKernelDefaults=true, then verify via the kubelet configz endpoint

Confirm the NodeRestriction admission plugin and Node authorizer are active and that a node cannot read unrelated Secrets

Load an AppArmor profile onto a pod and demonstrate that a write the profile forbids returns permission denied

Reduce the node attack surface by disabling or firewalling an unused host service and recording the before/after port scan

Re-run the weeks 1 through 3 labs under a 25-minute timer each without opening notes

Combine a signed-image gate, a restricted-PSA namespace and a Falco rule into one end-to-end deploy-and-detect pipeline

Locate and close the three weakest objectives from your own lab log

Write one-page command cheat sheets for PSA, NetworkPolicy, RBAC and Falco

Complete two full-length timed mock exams covering all six domains

Remediate every objective missed in either mock by rebuilding it hands-on in a fresh cluster

Re-verify the deliverable artifacts from weeks 1 through 6 still apply cleanly on a rebuilt cluster

Finalize a 15-minute pre-exam review sheet limited to imperative kubectl and openssl commands