CKS — Exam Format & Strategy
Exam Format
The Certified Kubernetes Security Specialist (CKS) exam is a performance-based exam conducted in a proctored, browser-based terminal environment. There are no multiple-choice questions — every task requires you to execute commands, create resources, or modify configurations in a live Kubernetes cluster.
Key Facts
| Detail | Value |
|---|---|
| Number of questions | 15–20 performance-based tasks |
| Duration | 2 hours (120 minutes) |
| Passing score | 67% |
| Environment | PSI Secure Browser with embedded terminal |
| Clusters | Multiple clusters — you switch between them per question |
| Allowed resources | kubernetes.io/docs, kubernetes.io/blog, github.com/kubernetes, and tool-specific docs (Falco, Trivy, AppArmor) |
| Retakes | 1 free retake included with exam purchase |
What the Environment Looks Like
You get a single terminal pane and a browser tab for documentation. You can:
- Switch between clusters using
kubectl config use-context <context-name>(each question tells you which context to use) - Open one documentation tab at a time from the allowed sites
- Copy and paste within the terminal and from the documentation
- Use the built-in text editor (vi/vim or nano)
You cannot:
- Open multiple browser tabs for documentation
- Access any external resource not on the allowed list
- Use your own notes, bookmarks, or local files
- Run a second terminal session (you get one terminal)
CKS Domain Weights
The exam questions are drawn from six domains, each with a specific weight:
| Domain | Weight | Typical Questions |
|---|---|---|
| 1. Cluster Setup | 10% | NetworkPolicies, CIS benchmarks, Ingress TLS, node metadata protection |
| 2. Cluster Hardening | 15% | RBAC, ServiceAccount security, Kubernetes version upgrades, API server restrictions |
| 3. System Hardening | 15% | AppArmor, Seccomp, host footprint minimization, SSH hardening |
| 4. Minimize Microservice Vulnerabilities | 20% | PSA/PSS, OPA Gatekeeper, Secrets management, runtime sandboxing, encryption at rest |
| 5. Supply Chain Security | 20% | Image scanning (Trivy), image policies, static analysis, Dockerfile security |
| 6. Monitoring, Logging & Runtime Security | 20% | Falco, audit policies, audit log analysis, immutable containers, behavioral analytics |
Score Breakdown Example
With 16 questions and a 67% passing threshold:
| Domain | Weight | Approx. Questions | Points Needed |
|---|---|---|---|
| Cluster Setup | 10% | 1–2 | ~7 pts |
| Cluster Hardening | 15% | 2–3 | ~10 pts |
| System Hardening | 15% | 2–3 | ~10 pts |
| Microservice Vulnerabilities | 20% | 3–4 | ~13 pts |
| Supply Chain Security | 20% | 3–4 | ~13 pts |
| Monitoring/Runtime Security | 20% | 3–4 | ~13 pts |
| Total | 100% | 15–20 | 67 pts |
You need roughly 67 out of 100 points. This means you can afford to miss about 33 points — but don’t count on that buffer. Aim for 80+ and let the margin protect you.
The 3-Pass Strategy
The single most effective strategy for the CKS exam is the 3-pass approach. This prevents you from getting stuck on hard questions early and wasting time you need for easier wins.
Pass 1: Quick Wins (15–20 minutes)
Scan every question and solve only the ones you can finish in under 3 minutes. These typically include:
| Task Type | Why It’s Fast | Est. Time |
|---|---|---|
| NetworkPolicy (default deny) | Memorized YAML, straight copy-paste | 2–3 min |
| RBAC Role/RoleBinding | kubectl create role + kubectl create rolebinding |
2–3 min |
| SecurityContext on a Pod | Add 3–4 lines to a Pod spec | 1–2 min |
| Binary verification (sha512sum) | One command + compare hash | 1–2 min |
| Disable SA token auto-mount | automountServiceAccountToken: false |
1–2 min |
| Namespace labeling (PSA) | kubectl label ns <ns> pod-security.kubernetes.io/enforce=restricted |
1 min |
Goal: collect 25–35% of points in the first 20 minutes.
Pass 2: Medium Tasks (60–70 minutes)
Now tackle questions that require more steps but are still within your comfort zone:
| Task Type | Why It’s Medium | Est. Time |
|---|---|---|
| Falco rule creation/modification | Edit YAML rules file, verify with Falco CLI | 5–8 min |
| Audit policy configuration | Write policy YAML + mount in API server | 5–8 min |
| Encryption at rest setup | Create EncryptionConfiguration + modify API server | 5–8 min |
| AppArmor profile + Pod annotation | Load profile on node + annotate Pod | 5–7 min |
| Seccomp profile + Pod spec | Create profile file + set in securityContext | 4–6 min |
| Trivy scan + fix image | Run trivy command + update Deployment image | 3–5 min |
| kube-bench fix | Run kube-bench + fix reported FAIL items | 5–8 min |
Goal: collect another 30–40% of points.
Pass 3: Hard Tasks (Remaining Time)
Use whatever time remains for the hardest questions:
| Task Type | Why It’s Hard | Est. Time |
|---|---|---|
| ImagePolicyWebhook setup | Multi-file config, admission controller, API server flags | 10–15 min |
| Complex OPA Gatekeeper | ConstraintTemplate Rego + Constraint + testing | 8–12 min |
| Multi-step security hardening | Combine multiple controls on one workload | 8–12 min |
| Audit log analysis + response | Read log, identify issue, create fix — multi-step | 8–10 min |
Goal: collect final 10–15% of points.
Time Allocation by Domain
Use this as a rough guide. Adjust based on your personal strengths and weaknesses:
| Domain | Weight | Suggested Time | Priority |
|---|---|---|---|
| Cluster Setup (10%) | 10% | 10–12 min | Medium |
| Cluster Hardening (15%) | 15% | 15–18 min | High |
| System Hardening (15%) | 15% | 15–18 min | High |
| Microservice Vulnerabilities (20%) | 20% | 20–25 min | Highest |
| Supply Chain Security (20%) | 20% | 20–25 min | Highest |
| Monitoring/Runtime Security (20%) | 20% | 20–25 min | Highest |
| Buffer / Review | — | 10–15 min | — |
| Total | 100% | 120 min | — |
The 20% domains are where 60% of your score comes from. Prioritize them.
When to Skip and Come Back
The biggest time trap on the CKS exam is spending too long on a single question. Here are clear rules:
The 8-Minute Rule
If you have spent 8 minutes on a single question and are not close to finishing:
- Stop immediately
- Write a quick note (comment in terminal or mental note) about where you left off
- Flag the question in the exam interface
- Move to the next question
- Return to the flagged question during Pass 3
Signs You Should Skip
- You cannot find the relevant documentation page within 2 minutes
- The question requires a tool/concept you are not confident with
- You have typed and deleted the same YAML block twice
- You are unsure which cluster/node to work on
Signs You Should Stay
- You are 80% done and just debugging a small error
- The question is worth a lot of points (you can sometimes infer this from complexity)
- You have found the documentation and just need to adapt the example
Point Estimation Strategy
Not all questions are worth the same number of points. While the exact point values are not disclosed, you can estimate:
| Question Complexity | Estimated Points | Time Investment | ROI |
|---|---|---|---|
| Simple (1–2 steps) | 4–5 pts | 2–3 min | Excellent |
| Medium (3–5 steps) | 6–8 pts | 5–8 min | Good |
| Complex (6+ steps) | 8–12 pts | 10–15 min | Variable |
Strategy: Solve all simple and medium questions first. A question worth 5 points that takes 2 minutes is far more valuable than a question worth 10 points that takes 15 minutes.
Focus on the 20% Domains
The three 20% domains (Microservice Vulnerabilities, Supply Chain, Monitoring) collectively account for 60% of your total score. If you can answer questions from these three domains confidently, you are likely to pass even if you struggle elsewhere.
Exam Day Timeline
Here is what your 120 minutes should look like:
| Time | Activity | Notes |
|---|---|---|
| 0:00–0:02 | Setup | Set aliases, vim config, verify environment |
| 0:02–0:05 | Scan all questions | Read every question title, mentally categorize (easy/medium/hard) |
| 0:05–0:20 | Pass 1 | Solve all quick wins (target: 5–8 questions) |
| 0:20–1:30 | Pass 2 | Solve medium questions (target: 5–7 questions) |
| 1:30–1:50 | Pass 3 | Attempt hard questions and return to flagged ones |
| 1:50–2:00 | Review | Verify completed answers, check correct context/namespace |
Key Mindset Principles
-
Points over perfection — A partially correct answer is better than no answer. If you can complete 80% of a question, submit it and move on.
-
Context switching is deadly — Always verify you are on the correct cluster and namespace before executing any command. One wrong context = zero points for that question.
-
The docs are your friend — You do not need to memorize every YAML field. Know where to find things quickly. Practice navigating the docs.
-
Test everything — After creating a resource, verify it works.
kubectl get,kubectl describe,kubectl exec— always verify. -
Stay calm — If you hit a question you have never seen before, breathe. Break it into steps. Use the docs. Partial credit exists.
Practice Questions
Question 1: You have 16 questions in the CKS exam. You solve 10 of them correctly, scoring 6 points each. You partially solve 3 more, scoring 3 points each. What is your total score, and do you pass?
Total score: (10 × 6) + (3 × 3) = 60 + 9 = 69 points.
The passing threshold is 67%. Since 69 > 67, you pass.
This illustrates why partial credit matters — those three partially completed questions made the difference between pass and fail.
Question 2: During the CKS exam, you encounter a question about ImagePolicyWebhook that you are not confident about. It is question 3 of 16. What should you do?
Skip it immediately and move to question 4. ImagePolicyWebhook is typically a complex, multi-step task that can take 10–15 minutes. In the 3-pass strategy, this belongs in Pass 3.
Mark/flag the question and come back to it after completing all easy and medium questions.
Do not spend more than 30 seconds reading and categorizing it in Pass 1.
Question 3: You are 45 minutes into the exam and have completed 8 questions. You estimate you have scored about 45 points. Are you on track?
Yes, you are ahead of schedule.
At the 45-minute mark (37.5% of time elapsed), you have approximately 45% of the required 67 points. With 75 minutes remaining and 8 more questions to tackle, you are in a strong position.
Continue with the 3-pass strategy. Do not rush — accuracy matters more than speed at this point.
Question 4: What should you do in the first 2 minutes of the CKS exam before reading any questions?
Set up your terminal environment:
alias k=kubectl
alias kn='kubectl config set-context --current --namespace'
export do="--dry-run=client -o yaml"
export now="--force --grace-period=0"
source <(kubectl completion bash)
complete -o default -F __start_kubectl k
Create or verify your ~/.vimrc:
set tabstop=2
set shiftwidth=2
set expandtab
set number
This 2-minute investment saves 10+ minutes over the course of the exam through faster typing, auto-completion, and correct YAML indentation.
Question 5: Which three CKS domains should you prioritize studying if you only have 3 days before the exam? Why?
Prioritize the three 20% domains:
- Minimize Microservice Vulnerabilities (20%) — PSA, OPA Gatekeeper, Secrets, encryption at rest
- Supply Chain Security (20%) — Trivy, image policies, Dockerfile analysis
- Monitoring, Logging & Runtime Security (20%) — Falco, audit policies, immutable containers
Together they account for 60% of the exam. Even if you score zero on the other three domains (10% + 15% + 15% = 40%), mastering these three gives you a theoretical maximum of 60 points — close to the 67% threshold.
In practice, you will pick up some points from the other domains too (RBAC and NetworkPolicies are easy wins), so focusing on the 20% domains gives you the highest probability of passing.
