CKS exam guide: the hands-on format, domains, cost, and a free practice quiz covering cluster setup & hardening, system hardening, microservice vulnerabilities, supply chain, and runtime security.
The Certified Kubernetes Security Specialist (CKS) is a hands-on, performance-based certification from the CNCF focused entirely on securing Kubernetes. You solve real security tasks on live clusters from the command line.
It's the security specialization of the Kubernetes ladder and requires an active CKA to sit — proving you can harden clusters, secure workloads and the supply chain, and detect threats at runtime.
▶ Start the free CKS practice quiz| Certification | Certified Kubernetes Security Specialist (CKS) |
|---|---|
| Exam code | CKS |
| Level | Specialty |
| Format | Performance-based (live cluster tasks) |
| Questions | ~15–20 hands-on tasks |
| Duration | 120 minutes |
| Passing score | 67% |
| Cost (USD) | $395 (includes one free retake) |
| Validity | 2 years |
| Prerequisites | A current Certified Kubernetes Administrator (CKA) is required to take the CKS |
Exam details change over time — always confirm the current specifics on the official exam page before you book.
The official exam is organized into these domains. Our practice bank mirrors them so you can drill each area:
| Domain | Exam weight | Practice questions |
|---|---|---|
| Cluster Setup | 15% | 11 |
| Cluster Hardening | 15% | 8 |
| System Hardening | 10% | 6 |
| Minimize Microservice Vulnerabilities | 20% | 10 |
| Supply Chain Security | 20% | 7 |
| Monitoring, Logging and Runtime Security | 20% | 8 |
Harden clusters: NetworkPolicies, CIS benchmarks (kube-bench), RBAC least privilege, restricting the API server/kubelet, and verifying platform binaries.
Secure workloads and the OS: Pod Security Admission, securityContext, seccomp/AppArmor, secrets encryption at rest, mTLS, and sandboxed runtimes (gVisor, Kata).
Cover supply chain (minimal/signed images, scanning with Trivy, admission control) and runtime security (Falco, audit logging, immutability). The free quiz below spans all six domains.
Our free CKS practice quiz has 50 scenario-based questions covering every exam domain. Each question includes the correct answer, a plain-English explanation of why it is right (and why the alternatives are wrong), and a reference to the relevant topic — so you learn as you go, not just test yourself.
▶ Practice CKS now — 50 questions, freeYes. You must hold an active CKA certification to take the CKS exam.
No — it's entirely performance-based on live clusters, and it's considered one of the tougher CNCF exams.
Two years currently (shorter than the CKA/CKAD's three). Confirm on the CNCF page.
Yes, official Kubernetes documentation (and a few allowed domains) can be used; practice navigating them quickly.