CKS — CKS vs CKA vs CKAD
Three Certifications Compared
The CNCF offers three Kubernetes certifications. Each targets a different role and skill set:
| Attribute | CKAD | CKA | CKS |
|---|---|---|---|
| Full Name | Certified Kubernetes Application Developer | Certified Kubernetes Administrator | Certified Kubernetes Security Specialist |
| Focus | Application design, build, deploy | Cluster admin, installation, troubleshooting | Cluster & workload security |
| Exam Type | Performance-based | Performance-based | Performance-based |
| Prerequisite | None | None | Valid CKA required |
| Difficulty | Intermediate | Intermediate | Advanced |
| Duration | 2 hours | 2 hours | 2 hours |
| Passing Score | 66% | 66% | 67% |
| Cost | $395 | $395 | $395 |
| Validity | 2 years | 2 years | 2 years |
| Questions | 15–20 tasks | 17 tasks | 15–20 tasks |
| Domains | 5 | 5 | 6 |
| Target Audience | Developers, App Engineers | SREs, DevOps, Platform Engineers | Security Engineers, DevSecOps |
Key takeaway: All three are hands-on, performance-based exams. CKS is the only one that requires a prerequisite and is classified as advanced.
CKS vs CKA: Topic-by-Topic Comparison
CKS doesn’t repeat CKA content — it extends it into security. Here’s how key topics evolve:
| Topic | CKA Level | CKS Level |
|---|---|---|
| RBAC | Create Roles, ClusterRoles, Bindings | Least-privilege RBAC, audit RBAC for overpermission, restrict wildcards |
| Networking | Services, Ingress, DNS, CNI basics | NetworkPolicy mastery — ingress/egress, default deny, namespace isolation |
| Pods | Create Pods, Deployments, manage lifecycle | SecurityContext, runAsNonRoot, readOnlyRootFilesystem, drop ALL capabilities |
| etcd | Backup and restore | Encryption at rest for Secrets, securing etcd communication |
| API Server | Basic flags, audit | Admission controller configuration, audit policy levels, anonymous auth |
| ServiceAccounts | Create and bind to Pods | Disable automounting, restrict token permissions, bound service account tokens |
| Nodes | Join to cluster, troubleshoot kubelet | OS hardening, AppArmor/Seccomp profiles, minimize attack surface |
| Images | Pull and use container images | Scan for CVEs (Trivy), allowlist registries, ImagePolicyWebhook |
| Secrets | Create and mount Secrets | Encrypt at rest (EncryptionConfiguration), avoid env vars, external secret stores |
| Troubleshooting | Cluster failures, node issues, logs | Falco runtime alerts, audit log analysis, compromised workload detection |
Notice the pattern: CKA teaches you how to use each feature. CKS teaches you how to secure each feature.
CKS vs CKAD: Different Paths to Security
| Aspect | CKAD | CKS |
|---|---|---|
| Perspective | Developer: build and deploy apps | Security: protect the platform and workloads |
| Pod Security | Knows SecurityContext exists | Masters SecurityContext, PSS/PSA, AppArmor, Seccomp |
| NetworkPolicies | Basic awareness | Deep mastery — default deny, egress control, namespace isolation |
| Image Management | Build and push images | Scan images, enforce policies, allowlist registries |
| Admission Control | Uses existing controllers | Configures OPA/Gatekeeper, writes policies, enforces custom rules |
| RBAC | Minimal coverage | Core skill — audit, restrict, least-privilege design |
| Runtime Monitoring | Not covered | Falco rules, audit logging, behavioral analysis |
CKAD and CKS have minimal overlap. CKAD focuses on application lifecycle; CKS focuses on securing the platform those applications run on.
Why CKS Builds on CKA
CKS is explicitly designed as the security extension of CKA. Here’s why:
1. Administrative Knowledge is a Prerequisite to Security
You cannot secure what you don’t understand. Before locking down the API server, you need to know how the API server works. Before creating NetworkPolicies, you need to understand Services and pod-to-pod networking. CKA provides this foundation.
2. CKS Tasks Assume CKA Competence
During the CKS exam, you won’t be guided through basic tasks. You might be told:
“Create a NetworkPolicy that allows ingress only from Pods with label
role=frontendin namespacewebon port 8080.”
This assumes you already know:
- What a NetworkPolicy is (CKA knowledge)
- How to write YAML manifests (CKA skill)
- Pod label selectors (CKA knowledge)
- Namespace isolation concepts (CKA knowledge)
CKS tests the security layer on top — the specific policy configuration, not the basic concepts.
3. Tool Familiarity is Expected
CKS introduces new security tools (Falco, Trivy, kube-bench, AppArmor). But it expects you’re already fast with:
kubectl— create, apply, delete, get, describe, logs, execvim/vi— edit YAML efficiently- Linux CLI — navigate filesystems, check processes, inspect logs
etcdctl— used in CKA, extended in CKS for encryptioncrictl— container runtime debugging
The Progression Model
CKA Knowledge: CKS Extension:
───────────────── ─────────────────
Create RBAC Roles → Audit for overpermission
Deploy Pods → Enforce SecurityContext & PSA
Backup etcd → Encrypt Secrets at rest
Configure networking → Default-deny NetworkPolicies
Troubleshoot clusters → Detect runtime threats (Falco)
Manage ServiceAccounts → Restrict & harden SAs
Use kubeadm for upgrades → Stay current for CVE patches
Recommended Certification Path
For Operations / Infrastructure Professionals
CKA → CKS
If your role is cluster operations, SRE, or platform engineering, go straight from CKA to CKS. You’ll directly build on administrative skills with security expertise.
For Developers Moving to DevSecOps
CKAD → CKA → CKS
Start with CKAD to validate your application development skills. Then progress through CKA for administration, and CKS for security. This is the full Kubernetes certification journey.
For Security Professionals New to Kubernetes
CKA → CKS (skip CKAD)
If you come from a security background but are new to Kubernetes, focus on CKA first. You need operational familiarity before you can secure the platform. CKAD is optional for security-focused roles.
Timeline Recommendations
| Path | Recommended Timeline |
|---|---|
| CKA → CKS | 2–4 months after CKA (while knowledge is fresh) |
| CKAD → CKA → CKS | 6–9 months total (2–3 months per cert) |
| CKA only → CKS (returning after gap) | Budget extra time to refresh CKA skills |
Best practice: Take CKS within 3 months of passing CKA while your cluster administration skills are sharp. The longer you wait, the more you’ll need to review.
Common Misconceptions
| Misconception | Reality |
|---|---|
| “CKS is just CKA with extra questions” | CKS introduces entirely different tools (Falco, Trivy, AppArmor) and security-first thinking |
| “I can skip RBAC review for CKS” | RBAC in CKS is deeper — least-privilege auditing, restricting wildcards, hardening bindings |
| “CKS is easier because I already passed CKA” | CKS has a higher pass rate requirement (67%) and more complex multi-step tasks |
| “CKAD is enough preparation for CKS” | CKAD does not satisfy the prerequisite and covers almost none of the CKS domains |
| “Security tools are optional in the exam” | Falco, Trivy, kube-bench, AppArmor are core exam tools — you must know them |
Practice Questions
Q1: What is the key prerequisite difference between CKA and CKS?
Show Answer
CKA has no prerequisite — anyone can register. CKS requires a valid CKA certification. This makes CKS the only CNCF Kubernetes certification with a formal prerequisite. CKAD cannot substitute for CKA.
Q2: How does RBAC coverage differ between CKA and CKS?
Show Answer
- CKA: Create Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings. Assign permissions to users and ServiceAccounts.
- CKS: Audit existing RBAC for overpermission, implement least-privilege principles, restrict wildcard permissions, ensure ServiceAccounts don’t have unnecessary access.
CKS expects you to harden RBAC, not just create it.
Q3: Name two security topics unique to CKS that are NOT covered in CKA.
Show Answer
- Runtime threat detection with Falco — Writing and modifying Falco rules to detect anomalous container behavior
- Container image vulnerability scanning with Trivy — Scanning images for CVEs and enforcing image policies
Other CKS-unique topics include: AppArmor/Seccomp profiles, OPA Gatekeeper policies, Pod Security Standards enforcement, and audit policy configuration.
Q4: What is the recommended certification path for a DevSecOps engineer?
Show Answer
CKAD → CKA → CKS
Start with CKAD to validate application development skills, then CKA for cluster administration, and finally CKS for security specialization. For pure security roles without a development focus, CKA → CKS is sufficient.
Q5: Why should you take CKS within 3 months of passing CKA?
Show Answer
CKS builds directly on CKA knowledge. Your cluster administration skills — kubeadm, RBAC creation, etcd management, networking — are freshest immediately after CKA. The longer you wait:
- CKA skills atrophy
- You’ll need weeks to refresh basic administration
- Your CKA validity clock is ticking (2-year limit)
Taking CKS while CKA knowledge is warm reduces total study time significantly.
Next: Understand the exam environment and rules with Exam Environment →
