Cloud Native Computing Foundation (CNCF)

CKS

Certified Kubernetes Security Specialist

A hands-on, performance-based certification validating the skills to secure container-based applications and Kubernetes platforms across build, deployment, and runtime. Requires a prior CKA pass and is highly valued for platform-security roles.

$4452 hours

What's on the exam

CKS Curriculum (Kubernetes v1.35; exam tracks new minor releases within ~4–8 weeks)

Cluster Setup

15%

Network security policies · CIS benchmark hardening · Ingress with TLS · Securing node metadata and endpoints · Verifying platform binaries

Cluster Hardening

15%

Restricting API access · Role-Based Access Control (RBAC) · ServiceAccount minimization · Updating Kubernetes frequently · Securing the kubelet

System Hardening

10%

Minimizing host OS footprint · Restricting IAM roles · Minimizing external access · AppArmor and seccomp · Kernel hardening tools

Minimize Microservice Vulnerabilities

20%

Pod security standards and admission · SecurityContexts · Managing Secrets · Container runtime sandboxes (gVisor, Kata) · mTLS between pods

Supply Chain Security

20%

Minimizing base image footprint · Image signing and validation · Static analysis of workloads · Scanning images for known CVEs · Allowed image registries

Monitoring, Logging, and Runtime Security

20%

Behavioral analytics and syscall detection · Detecting threats with Falco · Immutable container runtimes · Audit logging · Investigating runtime activity

Frequently asked questions

How much does the CKS cost?

The CKS costs $445. Exam-only price; includes one free retake and a 12-month window to schedule. Bundles with training cost more; price set by the Linux Foundation.

How long is the CKS and how many questions does it have?

Real-world tasks performed in live Kubernetes clusters — 2 hours.

What do you need to pass the CKS?

67%.

Can you retake the CKS?

One free retake included; further retakes require a new registration.

What is the best way to study for the CKS?

Start from the official outline and your primary study materials: the exam is weighted by domain (Cluster Setup 15%, Cluster Hardening 15%, System Hardening 10%, Minimize Microservice Vulnerabilities 20%, Supply Chain Security 20%, Monitoring, Logging, and Runtime Security 20%). Once you've learned the material, spaced-repetition flashcards organized by those domains are an efficient way to retain it and refresh it before test day.

Program in development

We're building a program for this exam. Meanwhile, explore live programs across 84 exams.

Explore programs →