What Is the CKS?

The Certified Kubernetes Security Specialist (CKS) is the most advanced CNCF Kubernetes certification. Unlike knowledge-based exams, CKS is a performance-based, hands-on exam in a live Kubernetes cluster. Candidates must identify and remediate security issues under time pressure. It validates expertise across cluster setup hardening, system hardening, minimizing microservice vulnerabilities, supply chain security, monitoring/logging/runtime security, and compliance. The CKA certification is a mandatory prerequisite and must be active/valid at registration time.

Cluster Setup & Hardening

2–3 weeks

CIS Kubernetes Benchmark checks with kube-bench

API server hardening flags — anonymous-auth, authorization-mode, admission plugins

Kubelet security — webhook auth/authz, no anonymous, no read-only port

etcd encryption at rest — EncryptionConfiguration, aescbc/KMS provider

Kubernetes audit logging — policy file, log path, monitoring levels

Network policies — default deny, selective ingress/egress, DNS egress

Ingress TLS with cert-manager certificates

Service mesh mTLS — Istio PeerAuthentication STRICT mode

RBAC & Workload Security

2 weeks

Least-privilege RBAC — Roles vs ClusterRoles, no wildcards

ServiceAccount token security — automountServiceAccountToken: false

Pod Security Standards and Admission (restricted level)

Pod security context — non-root, readOnlyRootFS, no privilege escalation

Linux capabilities — drop ALL, add specific caps only

Seccomp profiles — RuntimeDefault, custom Localhost profiles

AppArmor profiles — loading profiles, pod annotations

Container breakout prevention — privileged, hostPID, hostPath risks

Supply Chain Security

2 weeks

Image scanning with Trivy — scanning images, interpreting CVE output

Distroless and minimal base images — attack surface reduction

Multi-stage Docker builds — no build tools in production images

Image signing with cosign (Sigstore) — keyless signing, verification

OPA Gatekeeper — ConstraintTemplates, Constraints, Rego policies

Kyverno ClusterPolicies — no latest tag, required labels, image verification

Kubernetes CertificateSigningRequest (CSR) workflow for user certs

SBOM (Software Bill of Materials) — Syft for generation, concepts

Monitoring, Logging & Runtime Security

2 weeks

Falco — rules, macros, lists, alert output, rule tuning and exceptions

Falco threat detection — shell in container, sensitive mount, exfiltration

RuntimeClass — gVisor (runsc), Kata Containers for untrusted workloads

Kubernetes audit log analysis — reading and interpreting raw logs

Incident response — contain (NetworkPolicy), preserve evidence, investigate

Immutable container principle — never patch running containers

CKS Exam Practice & Speed

2–3 weeks

Killer.sh CKS simulator — 2 sessions included with exam purchase

kubectl speed — aliases, imperative commands, jsonpath

vim proficiency — .vimrc settings (:set et ts=2 sw=2)

etcdctl commands — endpoint health, get, put, backup

openssl commands — generate keys, CSRs, view certs

systemctl — restart services, check status, follow logs

📚 Recommended Study Resources

Kim Wüstkamp (Killer.sh)

"Certified Kubernetes Security Specialist (CKS)" course — best curriculum aligned to the actual exam format and tasks

Killer.sh Simulator

Included free with exam purchase — the closest simulation to the actual CKS hands-on environment, run it twice

k8s.io Documentation

Official docs are open during exam — practice navigating NetworkPolicy, SecurityContexts, Falco rules docs quickly

Aqua Security Blog

In-depth CKS preparation guides covering kube-bench, Trivy, Falco, and supply chain security topics

Ready to Test Your Knowledge?

Take our CKS practice exam covering cluster hardening, RBAC, network policies, runtime security, and supply chain

Start CKS Practice Exam →

🔒 Certified Kubernetes Security Specialist (CKS)

What Is the CKS?

Cluster Setup & Hardening

RBAC & Workload Security

Supply Chain Security

Monitoring, Logging & Runtime Security

CKS Exam Practice & Speed

📚 Recommended Study Resources

Kim Wüstkamp (Killer.sh)

Killer.sh Simulator

k8s.io Documentation

Aqua Security Blog

Ready to Test Your Knowledge?