CKS — Final Checklist

11 minute read

Pre-Exam Day Checklist

Complete every item on this list the day before your CKS exam. Do not leave anything to exam day.

Environment Requirements

  • Government-issued photo ID — have it ready on your desk. The proctor will ask to see it.
  • Webcam — working and positioned to show your face and surroundings. Test it in your browser.
  • Microphone — working. The proctor communicates via chat, but may request audio verification.
  • Stable internet — wired connection strongly recommended. Wi-Fi is acceptable but risky. Test your bandwidth: you need at least 5 Mbps up/down.
  • PSI Secure Browser — download and install it from the link in your exam confirmation email. Test the browser before exam day.
  • Clean desk — remove all papers, books, phones, second monitors, and other electronics. The proctor will ask you to show your desk and surroundings via webcam.
  • Closed room — no other people in the room during the exam. Close the door. If someone walks in, the proctor may pause or void your exam.
  • Water bottle — allowed, but must be a clear bottle with no label. No food, coffee mugs, or other drinks.
  • No headphones/earbuds — not allowed during the exam.

Technical Preparation

  • Browser compatibility — verify the PSI browser works on your machine. Mac, Windows, and Linux are supported.
  • Close unnecessary applications — the PSI browser may conflict with VPNs, screen recorders, and other software.
  • Disable notifications — turn off all desktop notifications (macOS: Do Not Disturb; Windows: Focus Assist).
  • Ensure sufficient battery — plug in your laptop. Do not rely on battery during a 2-hour exam.
  • Test copy-paste — confirm that Ctrl+Shift+C / Ctrl+Shift+V work in the PSI browser’s terminal.

Tool Proficiency Self-Check

Rate your proficiency with each CKS tool on a 1–5 scale. Be honest — this helps you identify what to review.

Tool What You Must Be Able To Do Your Rating (1–5)
kubectl Create/edit any resource, switch contexts, check permissions, generate YAML ___
vim/vi Edit YAML files, paste without corruption, search/replace, undo ___
Falco Write/modify rules, restart service, verify rules are active, check logs ___
Trivy Scan images, filter by severity, interpret output, update images ___
kube-bench Run benchmarks, interpret FAIL output, fix specific findings ___
AppArmor Write profiles, load/verify profiles, annotate Pods ___
Seccomp Create profiles, place in correct directory, reference in Pod spec ___
OPA Gatekeeper Write ConstraintTemplates (basic Rego), create Constraints, test policies ___
etcdctl Query etcd, verify encryption, basic operations ___
openssl / sha512sum Verify binary integrity, check certificate details ___

Interpreting Your Scores

Score Meaning Action
5 Can use fluently without docs No review needed
4 Can use with occasional doc lookup Quick review — skim the relevant chapter
3 Understand concepts but need docs for syntax Review the chapter and redo the lab
2 Vague understanding, would struggle on exam Spend 1–2 hours practicing this topic
1 Cannot use at all Critical gap — study the chapter thoroughly, practice until you reach at least 3

If any tool is rated 2 or below, that is your highest-priority study topic.

Domain-by-Domain Confidence Rating

Rate your confidence in each CKS domain. This helps you decide how to spend your final study hours.

Domain Weight Key Topics Your Confidence (1–5)
1. Cluster Setup 10% NetworkPolicies, CIS benchmarks, kube-bench, Ingress TLS, metadata protection ___
2. Cluster Hardening 15% RBAC, ServiceAccount security, API server flags, cluster upgrades ___
3. System Hardening 15% AppArmor, Seccomp, SSH hardening, host footprint reduction, kernel hardening ___
4. Minimize Microservice Vulnerabilities 20% SecurityContexts, PSA/PSS, OPA Gatekeeper, RuntimeClass, Secrets, encryption at rest ___
5. Supply Chain Security 20% Trivy, image policies, ImagePolicyWebhook, Dockerfile security, binary verification ___
6. Monitoring, Logging & Runtime Security 20% Falco, audit policies, audit backends, immutable containers, behavioral analytics ___

Study Priority Matrix

Your Confidence Domain Weight Study Priority
1–2 20% Critical — study immediately
1–2 15% High — study today
1–2 10% Medium — study if time permits
3 20% High — review and practice
3 15% Medium — quick review
3 10% Low — skim the chapter
4–5 Any Done — maintain with a quick review

Key Commands Quick Reference Card

Print this (or memorize it) — these are the commands you will use most during the CKS exam:

Setup (Run First)

Command Purpose
alias k=kubectl Shorten kubectl
alias kn='kubectl config set-context --current --namespace' Quick namespace switch
export do="--dry-run=client -o yaml" Generate YAML
export now="--force --grace-period=0" Force delete
source <(kubectl completion bash) Enable autocomplete
complete -o default -F __start_kubectl k Autocomplete for k alias

Context & Namespace

Command Purpose
k config use-context <ctx> Switch cluster context
k config current-context Verify current context
kn <namespace> Switch namespace
k config get-contexts List all contexts

Resource Creation

Command Purpose
k run nginx --image=nginx $do > pod.yaml Generate Pod YAML
k create deploy nginx --image=nginx $do > deploy.yaml Generate Deployment YAML
k create role <name> --verb=get,list --resource=pods -n <ns> Create Role
k create rolebinding <name> --role=<role> --user=<user> -n <ns> Create RoleBinding
k create clusterrole <name> --verb=get,list --resource=pods Create ClusterRole
k create clusterrolebinding <name> --clusterrole=<cr> --user=<user> Create ClusterRoleBinding
k create sa <name> -n <ns> Create ServiceAccount
k create secret generic <name> --from-literal=key=value -n <ns> Create Secret

Verification

Command Purpose
k auth can-i <verb> <resource> -n <ns> --as <user> Check RBAC
k get netpol -n <ns> List NetworkPolicies
k describe netpol <name> -n <ns> NetworkPolicy details
k get pod <name> -o yaml Full Pod spec
k exec <pod> -- <cmd> Run command in Pod
k run test --image=busybox --rm -it --restart=Never -- <cmd> Temp test Pod

Security Tools

Command Purpose
trivy image --severity CRITICAL <image> Scan container image
kube-bench run --targets=master Run CIS benchmark on master
aa-status List loaded AppArmor profiles
apparmor_parser -q <file> Load AppArmor profile
systemctl restart falco Restart Falco
journalctl -u falco --no-pager \| tail -20 Check Falco logs

Node-Level

Command Purpose
cat /etc/kubernetes/manifests/kube-apiserver.yaml View API server config
crictl ps List running containers
crictl logs <id> View container logs
ls /var/lib/kubelet/seccomp/ List Seccomp profiles
systemctl restart kubelet Restart kubelet

Last-Minute Revision Topics

If you have limited time before the exam, review these top 20 topics in priority order:

Must-Know (Questions Guaranteed)

  1. Default deny NetworkPolicy — ingress, egress, and both. Plus DNS allow.
  2. RBAC — Role vs ClusterRole, RoleBinding vs ClusterRoleBinding; kubectl create role and kubectl create rolebinding
  3. SecurityContext — runAsNonRoot, readOnlyRootFilesystem, allowPrivilegeEscalation: false, drop: [ALL]
  4. ServiceAccount token — automountServiceAccountToken: false
  5. PSA labels — kubectl label ns <ns> pod-security.kubernetes.io/enforce=restricted
  6. Seccomp RuntimeDefault — pod-level and container-level syntax
  7. Trivy — trivy image --severity CRITICAL <image>

Highly Likely (1–2 Questions)

  1. Audit policy — write policy YAML, all three parts for API server (flag + volumeMount + volume)
  2. AppArmor — write profile, load on node, annotate Pod
  3. Encryption at rest — EncryptionConfiguration, aescbc provider, re-encrypt existing secrets
  4. Falco rules — write/modify rules in /etc/falco/falco_rules.local.yaml
  5. kube-bench — run and fix FAIL items on API server
  6. Binary verification — sha512sum / sha256sum
  7. NetworkPolicy egress — CIDR blocks, blocking metadata endpoint 169.254.169.254/32

Possible (Study if Time Permits)

  1. OPA Gatekeeper — ConstraintTemplate + Constraint for image registries
  2. ImagePolicyWebhook — admission controller configuration
  3. Seccomp Localhost profile — write JSON profile, place in /var/lib/kubelet/seccomp/
  4. SSH hardening — PermitRootLogin no, PasswordAuthentication no
  5. Immutable containers — readOnlyRootFilesystem + emptyDir for temp storage
  6. Namespace isolation NetworkPolicy — cross-namespace deny with specific allow

What Topics Do CKS Questions Come From?

Based on publicly available information from candidates who have taken the exam, here is the typical distribution:

Question Type Frequency Difficulty
NetworkPolicy (various) Almost every exam Easy–Medium
RBAC (Role/Binding) Almost every exam Easy
SecurityContext / PSA Almost every exam Easy
Trivy image scanning Most exams Easy
Audit policy configuration Most exams Medium
AppArmor profile + Pod Most exams Medium
Seccomp profile Most exams Easy–Medium
Falco rules Most exams Medium
Encryption at rest Many exams Medium
kube-bench fixes Many exams Medium
ServiceAccount hardening Many exams Easy
OPA Gatekeeper Some exams Medium–Hard
Binary verification Some exams Easy
SSH hardening Some exams Easy
ImagePolicyWebhook Some exams Hard
Dockerfile analysis Some exams Easy–Medium

Key insight: NetworkPolicy, RBAC, and SecurityContext appear on almost every exam. If you can nail these three, you have a strong foundation of guaranteed points.

Post-Exam: What To Do After Passing

Immediately After the Exam

  • Results arrive within 24 hours via email
  • If you pass, your certification badge is available through the CNCF training portal
  • If you do not pass, you have one free retake — schedule it after reviewing your weak areas

After Passing

  1. Download your certificate from the CNCF training portal
  2. Claim your Credly badge — you will receive an email from Credly
  3. Add to LinkedIn:
    • Add the CKS certification to your LinkedIn profile under “Licenses & Certifications”
    • Share your Credly badge as a LinkedIn post
    • Update your headline: “CKA + CKS Certified”
  4. Update your resume — add CKS to your certifications section
  5. Celebrate — the CKS is one of the hardest Kubernetes certifications. You earned it.

What’s Next?

Certification Focus Recommended If…
KCSA (Kubernetes and Cloud Native Security Associate) Broader cloud-native security You want a broader security perspective beyond just Kubernetes
CKAD (Certified Kubernetes Application Developer) Application development on K8s You want to strengthen your developer-side Kubernetes skills
CKA renewal Keep CKA active Your CKA is approaching its 2-year expiry
Cloud certifications (AWS SAA, AZ-104, GCP ACE) Cloud platform proficiency You want to complement K8s skills with cloud platform expertise

Congratulations

If you have made it through this entire CKS tutorial series — every chapter, every lab, every practice question — you are more prepared than the vast majority of CKS candidates.

Here is what you have accomplished:

  • Mastered zero-trust networking with advanced NetworkPolicies
  • Hardened clusters using CIS benchmarks and kube-bench
  • Locked down RBAC with least-privilege principles
  • Secured pods with AppArmor, Seccomp, and SecurityContexts
  • Enforced Pod Security Standards across namespaces
  • Implemented OPA Gatekeeper policies for admission control
  • Scanned images with Trivy and secured the supply chain
  • Configured encryption at rest for Secrets
  • Written Falco rules for runtime threat detection
  • Built audit logging pipelines for compliance
  • Created fully immutable, hardened containers

This is not just exam knowledge — this is production-grade Kubernetes security expertise. Whether you are preparing for the CKS exam or securing real clusters, these skills are directly applicable.

Trust your preparation. Stay calm. Execute the 3-pass strategy. You’ve got this.

Practice Questions

Question 1: You are taking the CKS exam tomorrow. You have 2 hours to study. List the 5 highest-priority topics you should review, and explain why.
  1. Default deny NetworkPolicy + DNS allow — appears on almost every exam, easy 5-minute question if you have the YAML memorized
  2. RBAC: kubectl create role and kubectl create rolebinding — guaranteed question, fast to execute imperatively
  3. SecurityContext: runAsNonRoot, readOnlyRootFilesystem, drop ALL caps — appears on almost every exam, just a few YAML lines
  4. Trivy: trivy image --severity CRITICAL — straightforward scan-and-fix question
  5. Audit policy: 3-part setup (flag + volumeMount + volume) — medium-difficulty but high-point question; the setup is always the same

These 5 topics likely cover 30–40% of the exam and can all be practiced in under 2 hours.

Question 2: List all the items you need to verify about your physical environment before starting the CKS exam.
  1. Government-issued photo ID on the desk
  2. Clean desk — no papers, books, phones, extra devices
  3. Webcam working and positioned to show face + surroundings
  4. Microphone working
  5. Room is empty — no other people present
  6. Door closed — no one can walk in
  7. All monitors off except the exam computer (or disconnect extra monitors)
  8. Phone removed from the room or placed far away
  9. Water in a clear bottle (no label), if needed
  10. No headphones or earbuds
  11. Computer plugged in — not running on battery
  12. Desktop notifications disabled
  13. VPN disconnected
  14. Unnecessary applications closed
  15. PSI Secure Browser installed and tested
Question 3: During the exam, you realize you are 90 minutes in with 6 questions remaining (of 16 total). You have completed 10 questions. Is this a problem, and what should you do?

Assessment: You have 30 minutes for 6 questions. That is 5 minutes per question.

This could be tight depending on the difficulty of the remaining questions:

  • If most remaining questions are medium/hard: you are behind. Use the 3-pass strategy for these remaining 6 — do the easiest ones first.
  • If most are easy: you are fine.

Action plan:

  1. Spend 30 seconds scanning all 6 remaining questions
  2. Identify any easy ones (1–3 min) and do them immediately
  3. For medium questions, aim for the highest-value ones
  4. For hard questions, write partial answers (even just creating the resource with some correct fields earns partial credit)
  5. Do NOT spend more than 5 minutes on any single remaining question

The key mistake to avoid: panicking and rushing through questions carelessly. Calm, systematic execution of the 3-pass strategy yields better results than frantic typing.

Question 4: Write a one-line kubectl command to verify that ServiceAccount `app-sa` in namespace `dev` can list pods but cannot delete deployments.

Two separate commands (no single-line way to test both):

# Should return "yes"
kubectl auth can-i list pods -n dev --as=system:serviceaccount:dev:app-sa

# Should return "no"
kubectl auth can-i delete deployments -n dev --as=system:serviceaccount:dev:app-sa

Or combined with &&:

kubectl auth can-i list pods -n dev --as=system:serviceaccount:dev:app-sa && \
kubectl auth can-i delete deployments -n dev --as=system:serviceaccount:dev:app-sa

Note the ServiceAccount format: system:serviceaccount:<namespace>:<name>.

Question 5: After passing CKS, what three actions should you take within the first week to maximize the career value of your certification?

  1. Claim your Credly badge — check your email for the Credly invitation, accept it, and make the badge public. This creates a verifiable digital credential.

  2. Update LinkedIn immediately:
    • Add CKS under “Licenses & Certifications” (Issuing organization: The Linux Foundation)
    • Share a post with your Credly badge announcing the achievement
    • Update your headline to include “CKS Certified” — recruiters search for this
  3. Update your resume/CV:
    • Add CKS to your certifications section
    • Update relevant job descriptions to mention Kubernetes security skills
    • If job-searching, apply to roles that list CKS as preferred/required — you now meet that requirement

Bonus: Write a blog post or LinkedIn article about your CKS preparation journey. This demonstrates communication skills, reinforces your expertise, and helps others preparing for the exam.

Updated:

You may also enjoy