Get Your CertKubernetesPlayCompete
‹ Kubernetes

Certified Kubernetes Security Specialist (CKS)

1 test · 10 questions
Browse all 10 questions ›
Your progress
Test 110 questions

Study guides

Kubernetes interview questions: scenarios for experiencedScenario-based Kubernetes interview questions for experienced engineers: CrashLoopBackOff, DNS, RBAC, drains and etcd, with the commands and fixes.
How AI Is Changing Software Jobs: Where to PrepareHow AI is changing software jobs: what history shows, the evidence on junior developers, what Klarna learned, new AI roles and five domains to prepare for.
Best cloud security certification in 2026: which one firstCompare the top cloud security certifications for 2026, from AWS Security Specialty, SC-500 and Google PCSE to CKS and CCSP, and the order to take them.
Best Kubernetes certification: CKA vs CKAD vs CKSWhich Kubernetes certification to take first - CKA, CKAD or CKS compared on format, cost, prerequisites and role, plus KCNA and KCSA for beginners.
Kubernetes NetworkPolicy, explained for CKA, CKAD and CKSHow NetworkPolicy isolation works, why policies only add allows, the namespaceSelector AND/OR trap, DNS egress, and what your CNI has to support.

About the CKS exam

The Certified Kubernetes Security Specialist exam, run by the Linux Foundation with the CNCF, is the security follow-on to the CKA. It is for administrators and platform engineers who are responsible for locking a cluster down: hardening its components, restricting what workloads can do, controlling which images run, and spotting and investigating attacks.

You must have passed the CKA before you can sit the CKS. Like the CKA, the real exam is entirely hands-on. You get a remote Linux desktop and a set of tasks on live clusters: enable an audit policy, apply an AppArmor profile to a container, write a NetworkPolicy, find which Pod is doing something suspicious and stop it. You are graded on the result, under time pressure.

Exam format

  • Tasks: 15 to 20 performance-based tasks on the command line.
  • Time: 2 hours.
  • Passing score: 67%.
  • Prerequisite: a passed CKA exam.
  • Cost: 445 USD for the exam alone, with one retake and two practice simulator sessions included, and 12 months from purchase to take it.
  • Delivery: online, with a remote proctor. Besides the Kubernetes documentation and blog, you may open the docs for Falco, etcd, Cilium, Istio, the ingress-nginx controller and the bom SBOM tool.
  • Validity: 2 years.

What the exam covers

The curriculum has six domains:

  • Minimize Microservice Vulnerabilities (20%). Pod Security Standards enforced through Pod Security Admission, managing Secrets, isolating tenants and using sandboxed runtimes, and encrypting Pod-to-Pod traffic with Cilium or Istio.
  • Supply Chain Security (20%). Small base images, SBOMs, allowing only approved registries, signing and verifying artifacts, and static analysis of manifests and images with tools such as KubeLinter and Kubesec.
  • Monitoring, Logging and Runtime Security (20%). Detecting suspicious behaviour with tools such as Falco, investigating what an attacker did, keeping containers immutable at runtime, and reading Kubernetes audit logs.
  • Cluster Setup (15%). NetworkPolicies to restrict access, checking components against the CIS benchmark, Ingress with TLS, protecting node metadata and endpoints, and verifying Kubernetes binaries before use.
  • Cluster Hardening (15%). Least-privilege RBAC, careful use of ServiceAccounts and their tokens, restricting access to the API server, and upgrading to pick up security fixes.
  • System Hardening (10%). Shrinking the host's attack surface, least-privilege access on the node, limiting outbound network access, and kernel controls such as AppArmor and seccomp.

How the practice questions here are organised

There is one 10-question practice test for the CKS so far, covering every domain: kubelet anonymous access, ServiceAccount token automounting, RBAC rights that let a user escalate by creating workloads, the RuntimeDefault seccomp profile, Pod Security Admission, encrypting Secrets at rest, image policy admission, pinning images by digest, audit policy rule order and read-only root filesystems.

The real exam is hands-on labs, and these are multiple-choice questions. They check that you understand the controls (what a setting does, where it is configured, which option actually closes a hole) rather than your speed at applying them in a terminal. A wrong answer tells you what to go and do in a practice cluster. Each question explains the right answer and every wrong option, with a link to the documentation behind it.

A study plan that works

  • Make sure your CKA skills are still sharp. Most CKS tasks assume you can edit static Pod manifests, restart the kubelet and debug a broken API server without thinking about it.
  • Take the practice test to see which domains need work, then practise each control in a kubeadm cluster you can break freely.
  • Turn on encryption at rest and an audit policy by editing the API server manifest, and check that the server comes back up. A typo here can lose you the whole task.
  • Load an AppArmor profile on a node and attach it to a Pod, and apply seccomp profiles. Then write a Falco rule and trigger it.
  • Label namespaces for each Pod Security Standard level and see which Pods get rejected.
  • Practise finding things fast in the allowed docs, especially Falco's rule fields and the Kubernetes pages on audit logging and encryption.

These questions are original, written from the public Kubernetes and tool documentation and the official CKS curriculum. They are not real exam questions, and this site is not affiliated with the Linux Foundation or the CNCF.