CKS: Kubernetes Security Exam Guide

By Kokil Thapa | Last reviewed: September 2026

The CKS: Kubernetes Security Exam Guide you need is not a list of flashcards. The Certified Kubernetes Security Specialist exam is a two-hour, hands-on, performance-based test where you fix broken clusters under time pressure. You must harden nodes, lock down RBAC, write NetworkPolicies, and audit workloads before an attacker would. If you already passed CKA exam preparation, you know the kubectl rhythm. CKS adds a security lens to every task. This guide maps the 2026 curriculum, shows copy-paste YAML you will actually use, and gives you a study plan that matches real exam weight.

What is the CKS exam and who should take it?

The Certified Kubernetes Security Specialist (CKS) is a CNCF certification built on top of CKA. You cannot register without an active CKA credential. The exam costs USD 395 (~Rs 52,500 at typical 2026 exchange rates) and includes one free retake if taken within 12 months of purchase.

CKS suits platform engineers, DevOps leads, and security-minded developers who operate production Kubernetes. It is less about writing application manifests and more about stopping privilege escalation, container breakout, and lateral movement inside a cluster. If you maintain Kubernetes deployed with Kubespray or run workloads on managed services, the skills transfer directly.

The exam runs on Kubernetes 1.29 or 1.30 class clusters in 2026. Always check the current version on the official CNCF CKS certification page before booking. Documentation allowed during the test includes kubernetes.io, github.com/kubernetes, github.com/falcosecurity, and a handful of other whitelisted domains.

How does CKS compare to CKA and CKAD?

All three CNCF Kubernetes exams are performance-based. CKA tests cluster administration. CKAD tests application deployment. CKS assumes both and adds defensive security. Many engineers take CKA first, skip CKAD, and go straight to CKS if security is their focus.

If you are still building kubectl muscle memory, finish CKAD exam preparation or CKA before CKS. CKS tasks assume you can create Roles, debug failing Pods, and edit manifests quickly. Speed matters because partial credit is rare.

What domains does the CKS curriculum cover?

The CNCF publishes six domain groups. Treat the percentages as study time allocation, not exact question counts. Heavier domains deserve more repetition.

1. Cluster Setup (10%) — RBAC Roles and ClusterRoles, RoleBindings, ServiceAccount tokens, Pod Security Admission (PSA), audit policy configuration.
2. Cluster Hardening (15%) — API server flags, etcd encryption at rest, kubelet hardening, anonymous auth disabled, NodeRestriction admission.
3. System Hardening (15%) — AppArmor and seccomp profiles, host OS updates, minimizing host attack surface, CIS benchmark alignment.
4. Minimize Microservice Vulnerabilities (20%) — NetworkPolicies, mTLS concepts, Ingress TLS, resource limits, distroless images for security, image scanning workflows.
5. Supply Chain Security (20%) — Image provenance, admission controllers, OPA Gatekeeper or Kyverno policies, signed images, SBOM awareness.
6. Monitoring, Logging, and Runtime Security (20%) — Audit log analysis, Falco runtime security for Kubernetes, detecting crypto-mining and privilege escalation.

Each domain maps to tasks you perform on a live cluster. There are no multiple-choice questions. You either produce a working configuration or you do not.

How do you harden a Kubernetes cluster for the CKS exam?

Cluster hardening is the backbone of this certification. Examiners love tasks that combine API server configuration, etcd encryption, and kubelet settings. Practice each in isolation first, then chain them together.

Encrypt etcd secrets at rest

By default, Secrets in etcd are base64-encoded, not encrypted. CKS expects you to enable encryption at rest with a KMS provider or local encryption config.

# /etc/kubernetes/encryption-config.yaml
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
      - secrets
    providers:
      - aescbc:
          keys:
            - name: key1
              secret: <base64-32-byte-key>
      - identity: {}

Mount this file on the control plane node. Then add the flag to the API server manifest:

--encryption-provider-config=/etc/kubernetes/encryption-config.yaml

Restart kube-apiserver. Verify with:

kubectl get secrets -n kube-system -o json | head
etcdctl get /registry/secrets/kube-system/<name> --prefix

The etcd value should show k8s:enc:aescbc:v1:key1 prefix when encryption is active. This pattern appears often. Memorize the file structure, not just the flag name.

Restrict kubelet and disable anonymous access

Kubelet misconfiguration is a common exam scenario. You must set --anonymous-auth=false, enable webhook authorization, and rotate certificates when asked.

# /var/lib/kubelet/config.yaml (excerpt)
authentication:
  anonymous:
    enabled: false
  webhook:
    enabled: true
authorization:
  mode: Webhook

On the control plane, verify API server flags include --anonymous-auth=false and --authorization-mode=Node,RBAC. These overlap with general Ubuntu security hardening practices I apply on production Linux servers.

How do you write RBAC and NetworkPolicies under exam pressure?

RBAC and NetworkPolicy tasks appear in nearly every CKS sitting. You must create least-privilege Roles fast and verify with kubectl auth can-i. Do not over-grant verbs.

RBAC pattern for a namespace-scoped developer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: dev
  name: pod-reader
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: dev
  name: read-pods
subjects:
  - kind: ServiceAccount
    name: dev-sa
    namespace: dev
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Verify immediately:

kubectl auth can-i list pods --as=system:serviceaccount:dev:dev-sa -n dev

ClusterRole tasks follow the same structure with wider resource scope. Read the task wording carefully. One wrong verb loses the point.

Default-deny NetworkPolicy with selective allow

Examiners often give you a namespace with overly permissive traffic. Your job is to deny all ingress, then allow only required paths. See our deep dive on Kubernetes NetworkPolicies explained for syntax details.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: payments
spec:
  podSelector: {}
  policyTypes:
    - Ingress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-api
  namespace: payments
spec:
  podSelector:
    matchLabels:
      app: api
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080
  policyTypes:
    - Ingress

Confirm the CNI supports NetworkPolicy. Calico and Cilium do. Flannel alone does not. Exam clusters ship with a compatible CNI, but always check kubectl get pods -n kube-system first.

How do you prepare for Pod Security, seccomp, and supply chain tasks?

Pod Security Admission replaced PodSecurityPolicy in modern clusters. CKS expects you to label namespaces with enforce, audit, and warn levels. Know the three standards: privileged, baseline, and restricted.

kubectl label namespace production \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/audit=restricted \
  pod-security.kubernetes.io/warn=restricted

For seccomp, attach a profile via the securityContext. Our guide on seccomp syscall restriction covers local profile creation. Exam tasks often give you a broken Pod spec to fix.

securityContext:
  seccompProfile:
    type: Localhost
    localhostProfile: profiles/audit.json

Supply chain tasks focus on admission control. You may need to deploy OPA Gatekeeper or a validating webhook that rejects unsigned images. Understand image digest pinning:

containers:
  - name: app
    image: ghcr.io/org/app@sha256:abc123...
    imagePullPolicy: Always

Image scanning and SBOM topics are conceptual on the exam. You will not run a full CI pipeline. You will configure policies that enforce scan results or block latest tags. This mirrors how teams secure Laravel workloads on Kubernetes in production — pin images and restrict what reaches the cluster.

What runtime security and monitoring skills does CKS test?

The monitoring domain separates candidates who only read docs from those who have touched Falco and audit logs. Install Falco via Helm or manifest, then create rules that detect shell spawn or sensitive file access.

- rule: Terminal shell in container
  desc: Detect shell execution
  condition: spawned_process and container and shell_procs
  output: Shell in container (user=%user.name container=%container.name)
  priority: WARNING

Audit policy configuration is equally important. Create a policy that logs Secret access at RequestResponse level:

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
  - level: None
    users: ["system:kube-proxy"]
  - level: RequestResponse
    resources:
      - group: ""
        resources: ["secrets"]

Pass the policy path to the API server with --audit-policy-file and set --audit-log-path. Then grep the log for unauthorized Secret reads during troubleshooting tasks.

Runtime defense also covers rootless containers for security and detecting crypto-miners by CPU limits plus Falco rules. Know how to identify a privileged Pod:

kubectl get pods -A -o json | jq '.items[] | select(.spec.containers[].securityContext.privileged==true) | .metadata.name'

These skills parallel the API security complete checklist mindset — assume breach, log everything meaningful, and restrict blast radius.

What is the best CKS study plan for 2026?

A focused eight-week plan works for most engineers who already hold CKA. Adjust based on your weekly hours available.

• Weeks 1–2: RBAC drills, PSA labels, audit policy. Use kubectl run imperatively to save time on simple Pods.
• Weeks 3–4: NetworkPolicy default-deny labs, Ingress TLS, resource quotas. Pair with pod security and network policies reading.
• Weeks 5–6: etcd encryption, kubelet hardening, AppArmor and seccomp profiles on Ubuntu nodes.
• Week 7: Falco install, custom rules, audit log forensics. Practice parsing JSON audit entries with a JSON formatter tool locally.
• Week 8: Two full timed mock exams. Fix every gap same day. Book the real exam only when mocks score above 75%.

Use a multi-node lab, not minikube alone. Killercoda and KodeKloud CKS courses align well with the exam style. Also spin up a cluster with kubeadm on two VMs to practice static Pod edits on the control plane.

Bookmark the Kubernetes security concepts documentation and the securing a cluster task guide. Those two pages cover half the exam surface.

Exam day tactics that actually help

Read every task twice before typing. Easy tasks hide strict verification steps. Use kubectl explain liberally — it is faster than scrolling docs for field names. Set aliases at the start:

alias k=kubectl
export do="--dry-run=client -o yaml"
complete -F __start_kubectl k

Flag tasks you cannot solve in five minutes. Return later. Partial clusters sometimes block downstream questions. Fix the control plane first when etcd or API server tasks fail.

PSI proctoring requires a clean desk, stable webcam, and one monitor. Close corporate VPNs that block remote desktop. I have seen engineers fail check-in over browser extensions alone.

Key Takeaways

• CKS requires active CKA and tests hands-on security hardening, not theory — budget 60–80 lab hours minimum.
• Master RBAC verification with kubectl auth can-i, default-deny NetworkPolicies, and etcd Secret encryption before exam day.
• Pod Security Admission labels, seccomp profiles, and admission controllers cover roughly 40% of the curriculum combined.
• Falco rules plus audit policy configuration are high-yield monitoring topics — practice log analysis until it feels routine.
• Pin images by digest, block :latest, and know OPA Gatekeeper syntax for supply chain enforcement tasks.
• Run two full timed mocks above 75% before booking; speed and verification beat memorizing every flag name.

People Also Ask

Is CKA required before taking CKS?

Yes. CNCF enforces an active CKA certification as a prerequisite. Your CKA must not be expired on exam day. CKAD does not substitute for CKA. Most candidates pass CKA first, then pursue CKS within 12 months while kubectl skills remain fresh.

How hard is the CKS exam compared to CKA?

CKS is narrower but deeper on security. CKA covers broader administration topics like etcd backup, node troubleshooting, and scheduling. CKS assumes that baseline and adds encryption, runtime detection, and policy enforcement. Candidates with CKA who skip security practice often find CKS harder than expected.

What Kubernetes version does the CKS exam use?

CNCF aligns the exam cluster with a recent stable Kubernetes release, typically within one minor version of current upstream. Check the certification page at booking time. Documentation tabs match that version. Do not study deprecated APIs like PodSecurityPolicy as active exam content.

Can you use kubectl aliases during the CKS exam?

Yes. You work in a remote Linux environment with kubectl pre-installed. You may set shell aliases and use vim or nano. You may not copy pre-written manifest files from your local machine. Only whitelisted documentation sites are available in the browser.

Build production-grade cluster security beyond the exam

Passing CKS proves you can secure a cluster under pressure. Production work extends into GitOps pipelines, ongoing patch cycles, and incident response. Teams running booking platforms like Adventure Third Pole Trek or multi-service apps need the same discipline — least privilege, encrypted secrets, and observable runtime behavior.

If your organisation needs hardened infrastructure but lacks in-house Kubernetes security expertise, structured Linux system administration and ongoing support and maintenance cover the gap between certification knowledge and day-to-day operations. For GitOps delivery after hardening, see ArgoCD GitOps for Kubernetes.

Start with one domain this week. Encrypt etcd Secrets or write a default-deny NetworkPolicy today. The CKS: Kubernetes Security Exam Guide only works if your fingers know the YAML before the clock starts. When you want help auditing a production cluster or building a secure deployment pipeline, contact us to discuss your environment.