Skip to content
CertGPS

Certified Kubernetes Security Specialist

Proves you can harden and monitor a live Kubernetes cluster in a two-hour command-line exam open only to CKA holders

AdvancedCNCF

The exam

Exam cost
$445
Study time
2-4 months
Passing score
67%
Valid for
2 years

Before you book

  • Required: CKA passed at any time (an expired CKA still qualifies)

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where it leads

Study guide

Last updated

CKS Study Guide: The Two-Hour Lab Exam, the Curriculum, and a Plan

The Certified Kubernetes Security Specialist (CKS) proves you can secure a running Kubernetes cluster from the command line: lock down the API server, write network policies, restrict system calls, scan images and catch suspicious behavior at runtime. It's a two-hour, performance-based exam with 15 to 20 tasks, run by the Linux Foundation for the Cloud Native Computing Foundation (CNCF). You must have passed the Certified Kubernetes Administrator (CKA) exam first, though since October 2024 your CKA no longer has to be current.

Who CKS suits, and who should start elsewhere

CKS is for platform engineers, Kubernetes administrators and DevSecOps engineers who operate clusters themselves. If you've already passed CKA and your job now includes cluster hardening, admission control or supply chain checks, it's the obvious next credential. It also suits security engineers who've been handed Kubernetes and need to learn it by doing.

If you mostly consume a managed Kubernetes service through a cloud provider's console and policies, a cloud security certification will match your work more closely: AWS Security Specialty, Azure Security Engineer or Google Cloud Security Engineer. And if you haven't sat CKA yet, that comes first: CKS assumes you can already build and repair a cluster under time pressure.

The exam at a glance

CKS
FormatPerformance-based tasks solved from a command line, 15 to 20 tasks
Time2 hours
Passing score67%
Price$445 exam only; $645 with the LFS260 course; $625 with a THRIVE-ONE subscription
AttemptsTwo, including one retake; 12 months to use them
DeliveryOnline, remotely proctored on the PSI Bridge platform
Kubernetes versionv1.35
PrerequisiteCKA passed at any time; it may be expired
Validity2 years; renew by passing the exam again before it expires

The six domains and what they ask

The CNCF curriculum gives these weights:

  • Cluster Setup: 15%
  • Cluster Hardening: 15%
  • System Hardening: 10%
  • Minimize Microservice Vulnerabilities: 20%
  • Supply Chain Security: 20%
  • Monitoring, Logging and Runtime Security: 20%

The three 20% domains carry 60% of the score. Minimize Microservice Vulnerabilities covers Pod Security Standards, Secrets, isolation techniques such as sandboxed containers, and pod-to-pod encryption with Cilium or Istio. Supply Chain Security asks you to shrink base images, understand software bills of materials (SBOMs), restrict registries, sign and verify artifacts, and run static analysis with tools such as Kubesec and KubeLinter. Runtime security means behavioral detection, immutable containers and Kubernetes audit logs.

The remaining 40% covers Center for Internet Security (CIS) benchmark checks on etcd, the kubelet and the API server, Ingress with Transport Layer Security (TLS), protecting node metadata, verifying platform binaries, role-based access control (RBAC), service account hygiene, upgrading Kubernetes, and kernel hardening with AppArmor and seccomp.

The allowed documentation tells you which tools to expect. Besides the Kubernetes docs and blog, you may open the documentation for Falco, bom, etcd, the NGINX Ingress Controller, Cilium and Istio. Each task runs on a named host you reach over Secure Shell (SSH), with sudo -i available and kubectl, yq, curl and wget installed. You switch hosts and contexts for every task, so time disappears quickly if you work slowly in the terminal.

How to prepare

Start from the curriculum and the allowed-documentation list, and fit any course around them. The Linux Foundation revised the exam on October 15, 2024, adding, removing and rewording competencies and changing several weights, so older material may not match.

Build a lab you can break and rebuild. A kubeadm cluster with one control plane node and one or two workers on local virtual machines is closer to the exam than a managed service, because you'll be editing static pod manifests and kubelet settings. Then practice each competency until you can do it from the docs in a few minutes:

  • Turn on audit logging with a policy file and find a specific request in the log.
  • Write default-deny network policies, then open only the traffic an application needs.
  • Load an AppArmor profile, apply a seccomp profile, and confirm a pod is actually confined.
  • Enforce Pod Security Standards at namespace level and fix pods that violate them.
  • Install Falco, trigger a rule, and adjust its output.
  • Generate an SBOM with bom, scan an image, and configure an admission control rule that rejects untrusted registries.

Your exam registration includes two Killer.sh simulator sessions, each with 36 hours of access. Save the first for after you've covered every domain, and use the second a few days before the exam.

For structured study, the Linux Foundation's Kubernetes Security Essentials (LFS260) is the official course and comes bundled with the exam for $645. Benjamin Muschko's Certified Kubernetes Security Specialist (CKS) Study Guide (O'Reilly, 2023) is useful but predates the October 2024 update, so check its chapters against the current curriculum. Liz Rice's Container Security, second edition (O'Reilly, 2025), explains the Linux namespaces, cgroups and seccomp behavior underneath much of System Hardening and runtime security.

We'd give about 60% of your time to the three 20% domains, 25% to cluster setup and hardening, and the rest to timed practice on Killer.sh and your own lab.

Renewal, CARE, and what comes next

CKS lasts two years, and you renew it by passing the current exam again before it expires. Under the Linux Foundation's CARE program, passing or recertifying CKS on or after June 18, 2026 also extends your CKA, or reinstates it if it has lapsed, with its expiry aligned to the new CKS date. Kubernetes and Cloud Native Security Associate (KCSA) and Kubernetes and Cloud Native Associate (KCNA) renew through the same chain if you hold them.

Next steps depend on where your clusters run:

  • AWS Security Specialty if you run Amazon Elastic Kubernetes Service (EKS) and need the identity and network controls around it.
  • Google Cloud Security Engineer for Google Kubernetes Engine (GKE) environments.
  • CCSP if you're moving toward cloud security architecture across providers.

Our view

CKS is respected because it's hard to fake: two hours of real tasks on live clusters, with a CKA pass required before you can book it. Its weaknesses are that it ages fast, since the exam environment tracks Kubernetes releases (v1.35 at the moment) and the tooling keeps changing, and that the time pressure tests terminal speed as much as security judgment. The June 2026 CARE change makes it better value, since one $445 exam now keeps both CKS and CKA current. If you secure Kubernetes clusters for a living, it's worth it. If Kubernetes is one service among many in your cloud account, a cloud provider's security certification will be more useful.

Sources