CKS — Exam Overview
Exam Snapshot
| Detail | Value |
|---|---|
| Duration | 2 hours |
| Passing Score | 67% |
| Questions | 15–20 performance-based tasks |
| Retake | 1 free retake included |
| Validity | 2 years from passing date |
| Cost | $395 USD |
| Prerequisite | Valid CKA certification |
| Format | Hands-on tasks on live Kubernetes clusters |
| Kubernetes Version | Check CNCF CKS page for current version |
| Proctored | Yes — live proctor via webcam and screen share |
The 67% passing score means you can afford to miss roughly one-third of the tasks. But don’t plan for failure — some questions carry higher weight, and partial credit varies. Aim for 80%+ in practice to give yourself a safety margin.
Exam Domains & Weights
The CKS exam covers six domains, each testing a specific area of Kubernetes security:
| Domain | Weight | Focus Area |
|---|---|---|
| Cluster Setup | 10% | Network security policies, CIS benchmarks, Ingress TLS, node metadata protection |
| Cluster Hardening | 15% | RBAC best practices, ServiceAccount restrictions, API server hardening, upgrade strategy |
| System Hardening | 15% | Host OS hardening, AppArmor, Seccomp, minimize external access, kernel hardening |
| Minimize Microservice Vulnerabilities | 20% | Pod Security Standards, OPA/Gatekeeper, Secrets management, runtime sandboxes (gVisor, Kata) |
| Supply Chain Security | 20% | Image vulnerability scanning (Trivy), allowlisted registries, image policies, static analysis |
| Monitoring, Logging & Runtime Security | 20% | Falco runtime detection, audit logging, immutable containers, behavioral analytics |
Visualizing Domain Weights
Cluster Setup ██████████ 10%
Cluster Hardening ███████████████ 15%
System Hardening ███████████████ 15%
Microservice Vulns ████████████████████ 20%
Supply Chain Security ████████████████████ 20%
Monitoring & Runtime ████████████████████ 20%
Strategy: The three 20% domains cover 60% of the exam. If you master Microservice Vulnerabilities, Supply Chain Security, and Runtime Security, you’ve already covered more than half. Add Cluster Hardening (15%) and you’re at 75% — above passing.
Domain Deep Dive
Domain 1: Cluster Setup (10%)
This domain tests your ability to secure cluster networking and validate cluster configuration against industry benchmarks.
Key topics:
- Use NetworkPolicies to restrict inter-pod communication
- Run kube-bench to check CIS Kubernetes Benchmark compliance
- Configure Ingress with TLS termination
- Protect node metadata and cloud provider endpoints
- Verify platform binaries against checksums
Related chapters: Cluster Setup & Hardening, CIS Benchmarks & kube-bench, Network Policies Advanced
Domain 2: Cluster Hardening (15%)
This domain focuses on locking down the Kubernetes control plane and limiting access to the API server.
Key topics:
- Implement least-privilege RBAC — restrict Roles and ClusterRoles to minimum necessary permissions
- Restrict ServiceAccount usage — disable automounting, use dedicated ServiceAccounts
- Secure the API server — disable anonymous auth, enable audit logging, restrict admission controllers
- Keep clusters up to date — understand the security implications of running outdated versions
Related chapters: Cluster Setup & Hardening, CIS Benchmarks & kube-bench
Domain 3: System Hardening (15%)
This domain tests OS-level and kernel-level security controls applied to Kubernetes nodes and containers.
Key topics:
- Minimize host OS attack surface — reduce installed packages, disable unnecessary services
- Apply AppArmor profiles to restrict container filesystem and network access
- Configure Seccomp profiles to restrict syscalls available to containers
- Use kernel hardening techniques (read-only filesystems, privilege dropping)
Related chapters: System Hardening, AppArmor & Seccomp
Domain 4: Minimize Microservice Vulnerabilities (20%)
The largest-weight domain category (tied). This covers securing Pods, applying policies, and managing Secrets.
Key topics:
- Implement Pod Security Standards (Privileged, Baseline, Restricted) via Pod Security Admission
- Use OPA Gatekeeper or Kyverno for custom policy enforcement
- Manage Secrets securely — encryption at rest, avoiding Secrets in environment variables
- Use runtime sandboxes (gVisor, Kata Containers) for high-risk workloads
- Apply SecurityContext settings — runAsNonRoot, readOnlyRootFilesystem, drop capabilities
Related chapters: Pod Security Standards, OPA Gatekeeper
Domain 5: Supply Chain Security (20%)
This domain focuses on securing the container image supply chain — from build to deploy.
Key topics:
- Scan images for known vulnerabilities using Trivy or similar tools
- Allowlist registries — restrict which container registries Pods can pull from
- Use ImagePolicyWebhook or admission controllers to enforce image policies
- Perform static analysis of Kubernetes manifests (kubesec, kube-score)
- Sign and verify images (Cosign, Notary)
- Minimize base image attack surface — use distroless or scratch images
Related chapters: Image Security & Scanning
Domain 6: Monitoring, Logging & Runtime Security (20%)
This domain tests your ability to detect, alert on, and respond to runtime threats.
Key topics:
- Configure Falco — write and modify rules to detect anomalous behavior (file access, shell in container, unexpected network connections)
- Enable Kubernetes audit logging — configure audit policies, understand audit levels (None, Metadata, Request, RequestResponse)
- Ensure container immutability — read-only filesystems, no runtime modifications
- Analyze behavioral patterns to detect compromised workloads
Related chapters: Runtime Security & Falco, Audit Logging
Tutorial-to-Domain Mapping
This table maps each tutorial chapter to its corresponding CKS exam domain:
| Tutorial Chapter | Exam Domain | Weight |
|---|---|---|
| Ch 1: Introduction | — (preparation) | — |
| Ch 2: Cluster Setup & Hardening | Cluster Setup + Cluster Hardening | 10% + 15% |
| Ch 3: CIS Benchmarks & kube-bench | Cluster Setup | 10% |
| Ch 4: System Hardening | System Hardening | 15% |
| Ch 5: AppArmor & Seccomp | System Hardening | 15% |
| Ch 6: Pod Security Standards | Minimize Microservice Vulnerabilities | 20% |
| Ch 7: OPA Gatekeeper | Minimize Microservice Vulnerabilities | 20% |
| Ch 8: Runtime Security & Falco | Monitoring, Logging & Runtime Security | 20% |
| Ch 9: Image Security & Scanning | Supply Chain Security | 20% |
| Ch 10: Audit Logging | Monitoring, Logging & Runtime Security | 20% |
| Ch 11: Network Policies Advanced | Cluster Setup | 10% |
| Ch 12: Exam Tips & Mock Exam | All Domains | — |
Use this table to prioritize. If you’re short on time, focus on chapters that map to the 20% domains first.
How Scoring Works
Each task earns a specific number of points. Key details:
- Partial credit exists — If a question asks you to do three things and you complete two, you earn points for those two
- Order doesn’t matter — Complete questions in any order
- No penalty for wrong answers — An incorrect attempt is better than skipping
- Weighted scoring — Questions in higher-weight domains tend to carry more points
- Automated grading — Your solutions are checked programmatically against expected state
Always attempt every question. Even partial solutions can push you past 67%. An empty answer guarantees zero points.
Comparison with CKA Exam
| Attribute | CKA | CKS |
|---|---|---|
| Duration | 2 hours | 2 hours |
| Passing Score | 66% | 67% |
| Questions | 17 performance-based | 15–20 performance-based |
| Prerequisite | None | Valid CKA |
| Focus | Administration | Security |
| Tools | kubectl, etcdctl, crictl | kubectl + Trivy, Falco, kube-bench, AppArmor, Seccomp |
| Domains | 5 domains | 6 domains |
| Killer Shell Sessions | 2 included | 2 included |
Practice Questions
Q1: What is the CKS passing score, and how many tasks should you expect?
Show Answer
The passing score is 67%. You should expect 15–20 performance-based tasks to complete in 2 hours. Each task directly tests security skills on live clusters.
Q2: Which three CKS domains carry the highest weight, and what is their combined percentage?
Show Answer
The three highest-weight domains are:
- Minimize Microservice Vulnerabilities — 20%
- Supply Chain Security — 20%
- Monitoring, Logging & Runtime Security — 20%
Combined: 60% of the total exam score.
Q3: Which CKS domain covers Falco and audit logging?
Show Answer
Monitoring, Logging & Runtime Security (20%). This domain covers:
- Falco rule configuration and runtime threat detection
- Kubernetes audit policy configuration (audit levels: None, Metadata, Request, RequestResponse)
- Container immutability enforcement
- Behavioral analysis of workloads
Q4: Does the CKS exam give partial credit for incomplete answers?
Show Answer
Yes. If a task has multiple parts and you complete some but not all, you earn points for the completed parts. This is why you should always attempt every question — even a partial answer is better than skipping.
Q5: Map these topics to their CKS domains: (a) AppArmor, (b) Trivy image scanning, (c) NetworkPolicies.
Show Answer
- (a) AppArmor → System Hardening (15%)
- (b) Trivy image scanning → Supply Chain Security (20%)
- (c) NetworkPolicies → Cluster Setup (10%)
Understanding which tools and topics map to which domain helps you prioritize your study time based on exam weights.
Next: See how CKS compares with CKA and CKAD in CKS vs CKA vs CKAD →
