CKS — Exam Environment & Rules
Exam Interface Components
The CKS exam runs in a browser-based environment provided by PSI (the proctoring platform). You will see:
| Component | Description |
|---|---|
| Terminal | Linux terminal connected to exam clusters — this is where you do all your work |
| Question Panel | Left sidebar listing all questions with navigation |
| Notepad | Built-in text notepad for scratch work (persists across questions) |
| Timer | Countdown clock showing remaining time |
| Flag Button | Mark questions to revisit later |
| Top Bar | Contains question count, progress, and end exam button |
The terminal is your entire workspace. You can open multiple terminal tabs, navigate freely between them, and switch between different cluster contexts as questions require.
Pre-Installed Security Tools
Unlike CKA, the CKS exam environment comes with security-specific tools pre-installed. You must know how to use them without installation guidance:
| Tool | Purpose | Where Installed |
|---|---|---|
| kubectl | Kubernetes CLI — your primary tool | All nodes |
| crictl | Container runtime interface CLI (debugging) | Worker nodes |
| etcdctl | etcd management (backup, restore, encryption) | Control plane nodes |
| Trivy | Container image vulnerability scanner | Exam node |
| Falco | Runtime threat detection (syscall monitoring) | Installed or installable per task |
| kube-bench | CIS Kubernetes Benchmark scanner | Exam node |
| AppArmor tools | apparmor_parser, aa-status, aa-enforce |
Nodes with AppArmor |
| Seccomp | Kernel feature — profiles stored in /var/lib/kubelet/seccomp/ |
All nodes |
| kubesec | Kubernetes manifest static analysis | May be pre-installed |
Critical: Don’t waste exam time trying to install tools. They’re already available. Know the commands before you walk in.
Key Tool Locations
# Verify tool availability
which kubectl
which trivy
which crictl
which etcdctl
# Falco configuration
/etc/falco/falco.yaml # Main configuration
/etc/falco/falco_rules.yaml # Default rules
/etc/falco/falco_rules.local.yaml # Custom rules (you edit this)
# AppArmor profiles
/etc/apparmor.d/ # Profile directory
# Seccomp profiles
/var/lib/kubelet/seccomp/ # Default seccomp profile directory
# kube-bench
kube-bench run --targets=master
kube-bench run --targets=node
Allowed Documentation Sites
During the CKS exam, you may access only these documentation resources:
| Site | What You Can Access |
|---|---|
| kubernetes.io/docs | Official K8s docs, API reference, task guides |
| kubernetes.io/blog | Kubernetes blog posts |
| github.com/kubernetes | Kubernetes GitHub repositories (YAML examples, source) |
| falco.org/docs | Falco documentation — rules syntax, configuration |
| apparmor.net/docs | AppArmor documentation — profile syntax |
| aquasecurity.github.io/trivy | Trivy documentation — CLI usage, scanning |
Bookmark these before exam day. Having specific pages bookmarked (e.g., NetworkPolicy spec, Falco rule format, AppArmor profile syntax) saves minutes per question.
Allowed vs NOT Allowed
Allowed
| Item | Details |
|---|---|
| Official documentation (sites above) | Open in browser tabs during the exam |
| Browser bookmarks | Pre-saved bookmarks to allowed sites |
| Built-in notepad | In-exam notepad for scratch work |
| One external monitor | Must be visible to proctor |
| Water in a clear container | No labels, transparent vessel |
NOT Allowed
| Item | Details |
|---|---|
| Personal notes / cheat sheets | Physical or digital notes are prohibited |
| Second devices | No phones, tablets, or second computers |
| Communication | No messaging, chat, or audio with others |
| AI tools | No ChatGPT, Copilot, or similar assistants |
| Unapproved websites | Only the listed documentation sites |
| Headphones / earbuds | Not permitted (proctor must hear you) |
| Other people in the room | Room must be empty except for you |
| Books / printed material | No physical reference materials |
| Browser extensions | Disable or remove all non-essential extensions |
| Virtual machines / VPNs | Not allowed during the exam |
If caught using unauthorized resources, your exam is immediately terminated and your certification may be revoked.
Proctor Details
A live proctor monitors your exam via:
- Webcam — You, your face, and your workspace must be visible at all times
- Screen share — The proctor sees your entire screen
- ID verification — Government-issued photo ID required (passport, driver’s license)
- Room scan — You must show the proctor a 360° view of your room before starting
- Communication — Proctor communicates via chat (not voice)
Proctor Interaction
| Scenario | What Happens |
|---|---|
| Technical issue with exam environment | Chat the proctor — they can help or escalate |
| Need a bathroom break | Inform the proctor — timer does NOT pause |
| Proctor suspects cheating | They may pause or terminate the exam |
| Proctor asks to see your desk | Comply immediately — show the workspace |
| Audio detected | Proctor may warn you — do not read questions aloud |
Copy-Paste Shortcuts
The exam terminal uses Linux-style shortcuts:
| Shortcut | Action |
|---|---|
Ctrl+Shift+C |
Copy in terminal |
Ctrl+Shift+V |
Paste in terminal |
Ctrl+C |
Copy in browser (notepad, docs) |
Ctrl+V |
Paste in browser (notepad, docs) |
Ctrl+Insert |
Alternative copy |
Shift+Insert |
Alternative paste |
| Right-click | Context menu with copy/paste options |
Practice these shortcuts. Many candidates lose time fumbling with copy-paste between the browser, documentation, and terminal. In CKS especially, you’ll copy YAML snippets, Falco rules, and AppArmor profiles frequently.
Copy-Paste Workflow
When copying from Kubernetes documentation:
- Navigate to the documentation page (e.g., NetworkPolicy spec)
- Select the YAML example in the browser
Ctrl+Cto copy from the browser- Switch to the terminal
- Open a file:
vi networkpolicy.yaml - Enter insert mode:
i Ctrl+Shift+Vto paste into the terminal- Modify the YAML as needed
- Save:
Esc,:wq
Pre-Exam Checklist
Complete this checklist before your exam time:
Environment Setup
- Stable internet connection — Use wired if possible, test bandwidth
- Google Chrome or Chromium — Required browser (latest version)
- Webcam working — Test it in PSI portal before exam day
- Microphone working — Proctor needs to detect audio
- Single monitor — Disconnect extra monitors or use only one
- Clean desk — Remove all papers, books, devices
- Close all applications — Only the exam browser should be running
- Disable notifications — System notifications, messaging apps, etc.
- Browser extensions disabled — Remove or disable all extensions
ID & Room
- Government-issued photo ID — Ready to show on webcam
- Empty room — No other people allowed
- Quiet environment — Minimize background noise
- 360° room scan prep — Know how to show all walls, desk surface, under desk
Knowledge Readiness
- Bookmarks prepared — Key pages from kubernetes.io, falco.org, Trivy docs
- Tool commands memorized — Falco, Trivy, kube-bench, AppArmor CLI
- YAML patterns familiar — NetworkPolicy, SecurityContext, PodSecurity, audit policy
- Killer.sh completed — At least one full practice session
Killer.sh Practice Environment
Your CKS exam registration includes two Killer Shell (killer.sh) sessions. Each session:
- Provides a 36-hour access window from activation
- Contains more questions than the real exam (and harder ones)
- Uses the same browser-based terminal as the actual exam
- Includes detailed solutions after the session expires
How to Use Killer.sh Effectively
| Session | When to Use | Goal |
|---|---|---|
| Session 1 | 2–3 weeks before exam | Identify weak areas, practice time management |
| Session 2 | 2–3 days before exam | Final confidence check, polish speed |
Do not activate both sessions at once. Space them out. Use Session 1 as a diagnostic and Session 2 as a dress rehearsal.
Killer.sh vs Real Exam
| Aspect | Killer.sh | Real CKS Exam |
|---|---|---|
| Difficulty | Harder than the real exam | Moderate |
| Number of questions | More questions | 15–20 |
| Time pressure | Very tight | Manageable (if prepared) |
| Scoring | Detailed per-question breakdown | Pass/fail with total score |
| Solutions | Provided after session | Not provided |
If you score 60%+ on Killer.sh, you’re likely ready for the real exam. Killer.sh is deliberately harder to build confidence.
Multiple Clusters
The CKS exam, like CKA, uses multiple Kubernetes clusters. Each question specifies which cluster to use:
# Each question starts with a context switch instruction
kubectl config use-context <context-name>
# Always switch context FIRST before doing anything
# Forgetting this is the #1 source of lost points
Before answering any question, always run the context switch command provided. Working on the wrong cluster means zero points for that question, even if your solution is technically correct.
Practice Questions
Q1: Name three security-specific tools pre-installed in the CKS exam environment that are NOT available in the CKA exam.
Show Answer
- Trivy — Container image vulnerability scanner
- Falco — Runtime threat detection via syscall monitoring
- kube-bench — CIS Kubernetes Benchmark scanner
Other CKS-specific tools: AppArmor utilities (apparmor_parser, aa-status), and potentially kubesec for static analysis.
Q2: Which documentation sites are allowed during the CKS exam?
Show Answer
- kubernetes.io/docs and kubernetes.io/blog
- github.com/kubernetes
- falco.org/docs
- apparmor.net/docs
- aquasecurity.github.io/trivy
No other websites are permitted. Personal notes, AI tools, and unapproved sites are strictly forbidden.
Q3: What is the first command you should run when starting any CKS exam question?
Show Answer
kubectl config use-context <context-name>
Every question specifies which cluster to work on. Always switch context first. Working on the wrong cluster means zero points for that question, regardless of whether your solution is correct.
Q4: How many Killer.sh sessions are included with your CKS registration, and how should you space them?
Show Answer
Two sessions are included. Recommended spacing:
- Session 1: 2–3 weeks before the exam — identify weak areas and practice time management
- Session 2: 2–3 days before the exam — final confidence check and speed polish
Each session gives 36 hours of access from activation. Do not activate both at once.
Q5: What copy-paste shortcut do you use in the exam terminal?
Show Answer
- Copy in terminal:
Ctrl+Shift+C - Paste in terminal:
Ctrl+Shift+V - Copy in browser/notepad:
Ctrl+C - Paste in browser/notepad:
Ctrl+V
Note: The terminal uses Ctrl+Shift variants because Ctrl+C sends SIGINT in the terminal. Practice these shortcuts before exam day.
Next: Get familiar with the security tools you’ll use with Security Tools Overview →
