CKS — Prerequisites & Study Plan
CKA Knowledge Self-Assessment
CKS assumes you have solid CKA-level knowledge. Before starting CKS preparation, honestly assess each area below.
| Rate yourself on each skill: ✅ Confident | ⚠️ Needs Review | ❌ Not Ready |
| # | CKA Skill | Self-Assessment |
|---|---|---|
| 1 | Create and bind RBAC Roles, ClusterRoles, RoleBindings | ✅ / ⚠️ / ❌ |
| 2 | Backup and restore etcd using etcdctl |
✅ / ⚠️ / ❌ |
| 3 | Upgrade a kubeadm cluster (control plane + workers) | ✅ / ⚠️ / ❌ |
| 4 | Create and troubleshoot Deployments, DaemonSets, StatefulSets | ✅ / ⚠️ / ❌ |
| 5 | Configure Services (ClusterIP, NodePort, LoadBalancer) | ✅ / ⚠️ / ❌ |
| 6 | Create and troubleshoot Ingress resources | ✅ / ⚠️ / ❌ |
| 7 | Manage PersistentVolumes and PersistentVolumeClaims | ✅ / ⚠️ / ❌ |
| 8 | Troubleshoot node failures (kubelet, certificates, DNS) | ✅ / ⚠️ / ❌ |
| 9 | Navigate and use the Kubernetes documentation efficiently | ✅ / ⚠️ / ❌ |
| 10 | Use kubectl fluently (imperative and declarative) |
✅ / ⚠️ / ❌ |
If you have 3 or more ❌ items: Go back to the CKA Tutorial and review those topics first. CKS will be significantly harder without a solid CKA foundation.
Security Concepts Self-Assessment
These are security-specific skills tested in CKS. You’ll learn them in this tutorial, but having prior exposure helps.
| # | Security Concept | Familiarity |
|---|---|---|
| 1 | Linux file permissions and ownership (chmod, chown) | ✅ / ⚠️ / ❌ |
| 2 | Linux Security Modules concept (AppArmor, SELinux) | ✅ / ⚠️ / ❌ |
| 3 | System calls (syscalls) — what they are and why they matter | ✅ / ⚠️ / ❌ |
| 4 | Container image layers and how vulnerabilities enter | ✅ / ⚠️ / ❌ |
| 5 | TLS certificates — what they are and how to verify them | ✅ / ⚠️ / ❌ |
| 6 | NetworkPolicies — default behavior (no policy = all traffic allowed) | ✅ / ⚠️ / ❌ |
| 7 | Kubernetes admission controllers — what they do | ✅ / ⚠️ / ❌ |
| 8 | Container runtime sandboxing concept (gVisor, Kata) | ✅ / ⚠️ / ❌ |
| 9 | Encryption at rest vs encryption in transit | ✅ / ⚠️ / ❌ |
| 10 | YAML editing with vi/vim (fast and confident) | ✅ / ⚠️ / ❌ |
Don’t worry if many items are ⚠️ or ❌. The CKS tutorial covers all of them. This checklist helps you estimate how much time to allocate.
Practice Environment Options
You need hands-on practice. Here are your best options:
| Environment | Setup Effort | Cost | Pros | Cons |
|---|---|---|---|---|
| kind (Kubernetes in Docker) | Low | Free | Fast startup, lightweight, runs on laptop | No real node isolation, limited AppArmor testing |
| minikube | Low | Free | Easy setup, addon ecosystem, single-node | Single-node only, limited multi-cluster practice |
| kubeadm on VMs | Medium | Free (if local VMs) | Most realistic, matches exam environment | More setup time, needs 2+ VMs |
| Vagrant + VirtualBox | Medium | Free | Reproducible multi-node clusters | Resource-heavy, slower provisioning |
| Cloud VMs (AWS/GCP/Azure) | Medium | Paid | Realistic, scalable, disposable | Cost adds up if left running |
| Killer Shell (killer.sh) | None | Included with exam | Exact exam interface, graded questions | Only 2 sessions, 36h each |
| KodeKloud Labs | None | Paid subscription | Browser-based labs, guided exercises | Monthly cost, structured curriculum |
Recommended Setup for CKS Practice
The best CKS practice environment is a kubeadm cluster on VMs (local or cloud) because:
- AppArmor and Seccomp require real Linux kernel features — kind and minikube may not fully support them
- Falco runs at the kernel level — best tested on real VM nodes
- kube-bench checks node configurations — needs actual nodes
- The exam uses kubeadm clusters — practicing on the same setup builds muscle memory
Minimum practice setup:
1 control plane node (2 CPU, 4 GB RAM)
2 worker nodes (2 CPU, 2 GB RAM each)
Ubuntu 22.04 LTS (matches exam environment)
5-Week Study Plan
This is the recommended plan for someone who recently passed CKA and has 1–2 hours daily to study.
Week 1: Foundation & Cluster Hardening
| Day | Topic | Time |
|---|---|---|
| Day 1 | CKS Introduction (this chapter) — all sub-topics | 1.5h |
| Day 2 | Cluster Setup: API server hardening, anonymous auth, audit | 2h |
| Day 3 | Cluster Hardening: RBAC best practices, least privilege | 2h |
| Day 4 | ServiceAccount hardening: disable automount, restrict tokens | 1.5h |
| Day 5 | CIS Benchmarks & kube-bench: run, interpret, remediate | 2h |
| Day 6 | Practice: Harden a cluster from scratch | 2h |
| Day 7 | Review Week 1, fill gaps | 1h |
Domains covered: Cluster Setup (10%), Cluster Hardening (15%)
Week 2: System Hardening
| Day | Topic | Time |
|---|---|---|
| Day 1 | OS-level hardening: minimize packages, disable services | 1.5h |
| Day 2 | AppArmor: write profiles, load with apparmor_parser, apply to Pods |
2h |
| Day 3 | AppArmor continued: practice exam-style tasks | 1.5h |
| Day 4 | Seccomp: understand profiles, apply RuntimeDefault, create custom profiles | 2h |
| Day 5 | Seccomp continued: Localhost profiles, syscall filtering | 1.5h |
| Day 6 | Combined practice: AppArmor + Seccomp on same Pod | 2h |
| Day 7 | Review Week 2, fill gaps | 1h |
Domains covered: System Hardening (15%)
Week 3: Microservice Vulnerabilities & Policies
| Day | Topic | Time |
|---|---|---|
| Day 1 | Pod Security Standards: Privileged, Baseline, Restricted levels | 2h |
| Day 2 | Pod Security Admission: enforce, audit, warn modes per namespace | 2h |
| Day 3 | SecurityContext deep dive: runAsNonRoot, readOnlyRootFilesystem, capabilities | 1.5h |
| Day 4 | OPA Gatekeeper: install, ConstraintTemplates, Constraints | 2h |
| Day 5 | Gatekeeper policies: require labels, block privileged Pods, restrict registries | 2h |
| Day 6 | Secrets management: encryption at rest, avoid env vars | 1.5h |
| Day 7 | Review Week 3, practice all policy types | 1h |
Domains covered: Minimize Microservice Vulnerabilities (20%)
Week 4: Supply Chain & Runtime Security
| Day | Topic | Time |
|---|---|---|
| Day 1 | Trivy: scan images, filter by severity, interpret results | 2h |
| Day 2 | Image policies: allowlist registries, ImagePolicyWebhook | 2h |
| Day 3 | Static analysis: kubesec, minimize base images, Dockerfile best practices | 1.5h |
| Day 4 | Falco: install, configure, understand default rules | 2h |
| Day 5 | Falco: write custom rules, modify existing rules, test detection | 2h |
| Day 6 | Audit logging: configure audit policy, audit levels, log analysis | 2h |
| Day 7 | Review Week 4, combined practice | 1h |
Domains covered: Supply Chain Security (20%), Monitoring & Runtime Security (20%)
Week 5: NetworkPolicies, Review & Mock Exam
| Day | Topic | Time |
|---|---|---|
| Day 1 | NetworkPolicies advanced: default deny, ingress/egress, namespace selectors | 2h |
| Day 2 | NetworkPolicies practice: multi-tier application isolation | 1.5h |
| Day 3 | Full review: go through all domains, identify weak spots | 2h |
| Day 4 | Killer.sh Session 1 — full practice exam | 3h |
| Day 5 | Review Killer.sh results, study weak areas | 2h |
| Day 6 | Killer.sh Session 2 — final practice exam | 3h |
| Day 7 | Light review, prepare exam environment, rest | 1h |
3-Week Intensive Plan
For someone with strong CKA skills and 2–3 hours daily.
| Week | Focus | Domains |
|---|---|---|
| Week 1 | Cluster Hardening + System Hardening (API server, RBAC, CIS, AppArmor, Seccomp) | Setup (10%) + Hardening (15%) + System (15%) |
| Week 2 | Microservice Vulnerabilities + Supply Chain (PSS, Gatekeeper, Trivy, image policies) | Microservice (20%) + Supply Chain (20%) |
| Week 3 | Runtime Security + NetworkPolicies + Mock Exams (Falco, audit logging, Killer.sh) | Monitoring (20%) + Setup (10%) + Full Review |
Daily Structure (3-Week Plan)
30 min — Read/study the topic
60 min — Hands-on practice on your lab cluster
30 min — Practice questions from this tutorial
1-Week Crash Plan
Only for CKA holders with existing security background (e.g., already familiar with AppArmor, Seccomp, or container security concepts).
| Day | Focus | Hours |
|---|---|---|
| Day 1 | CKS overview + Cluster & System Hardening | 4h |
| Day 2 | AppArmor + Seccomp + Pod Security Standards | 4h |
| Day 3 | Trivy + Image Policies + Gatekeeper | 4h |
| Day 4 | Falco + Audit Logging + NetworkPolicies | 4h |
| Day 5 | Killer.sh Session 1 + Review | 5h |
| Day 6 | Study weak areas + Killer.sh Session 2 | 5h |
| Day 7 | Light review + Exam | 2h + Exam |
This plan is risky. Only attempt it if you’re confident in your CKA skills and have prior security experience. Most people need at least 3 weeks.
Learning Resources
Official Resources
| Resource | Type | Cost |
|---|---|---|
| Kubernetes Documentation | Reference docs | Free |
| Falco Documentation | Falco rules & config | Free |
| Trivy Documentation | Image scanning guide | Free |
| CIS Kubernetes Benchmark | Security benchmark PDF | Free (registration) |
| Killer Shell | Practice exam (2 sessions included) | Included with exam |
Courses & Labs
| Resource | Type | Cost |
|---|---|---|
| KodeKloud CKS Course | Video + Labs | Paid subscription |
| Udemy CKS Courses (Mumshad / Kim) | Video | Paid (often on sale) |
| A Cloud Guru CKS | Video + Labs | Paid subscription |
| CKS Study Guide (Benjamin Muschko) | Book | Paid |
Community Resources
| Resource | Type |
|---|---|
| r/kubernetes (Reddit) | Community discussions & exam experiences |
| CNCF Slack #cks-exam-prep | Real-time help and tips |
| Kubernetes security mailing list | Security advisories and CVEs |
GitHub Repositories
| Repository | Purpose |
|---|---|
aquasecurity/kube-bench |
CIS benchmark tool source and documentation |
falcosecurity/falco |
Falco source, default rules, examples |
open-policy-agent/gatekeeper |
Gatekeeper installation and policy examples |
kyverno/kyverno |
Kyverno policy engine and example policies |
Practice Questions
Q1: What CKA skill is most critical for CKS success, and why?
Show Answer
RBAC (Role-Based Access Control). In CKA, you learn to create Roles and Bindings. In CKS, you must:
- Audit existing RBAC for overly permissive rules
- Implement least-privilege access
- Restrict wildcard permissions
- Harden ServiceAccount access
RBAC appears across multiple CKS domains (Cluster Hardening, Microservice Vulnerabilities). Weak RBAC skills will hurt you in at least 35% of the exam.
Q2: Why is a kubeadm cluster on VMs recommended over kind or minikube for CKS practice?
Show Answer
CKS requires tools that need real Linux kernel features:
- AppArmor — Requires the AppArmor LSM loaded in the kernel; kind containers may not support it
- Falco — Monitors syscalls at the kernel level; works best on real VMs
- kube-bench — Checks node-level configurations that don’t exist in containerized environments
- Seccomp — Needs proper kernel support for syscall filtering
Additionally, the CKS exam uses kubeadm clusters — practicing on the same setup builds familiarity.
Q3: In the 5-week study plan, which week covers the highest-weight exam domains?
Show Answer
Week 4 covers the highest-weight domains:
- Supply Chain Security (20%) — Trivy, image policies, static analysis
- Monitoring, Logging & Runtime Security (20%) — Falco, audit logging
Combined with Week 3 (Minimize Microservice Vulnerabilities — 20%), Weeks 3–4 cover 60% of the exam weight.
Q4: How should you use your two Killer.sh sessions?
Show Answer
- Session 1: Use 2–3 weeks before your exam date as a diagnostic. Identify weak areas and domains where you lost points.
- Session 2: Use 2–3 days before the exam as a dress rehearsal. Focus on speed, time management, and confidence.
Each session gives 36 hours of access. Don’t activate both at once — space them to maximize learning from Session 1.
Q5: You have 1 week to prepare for CKS. What is the minimum daily time commitment, and what should you prioritize?
Show Answer
Minimum 4–5 hours daily for 7 days.
Priority order (by exam weight):
- Microservice Vulnerabilities (20%) — Pod Security Standards, SecurityContext, Gatekeeper
- Supply Chain Security (20%) — Trivy image scanning, image policies
- Runtime Security (20%) — Falco rules, audit logging
- Cluster Hardening (15%) — RBAC best practices, ServiceAccount hardening
- System Hardening (15%) — AppArmor, Seccomp profiles
- Cluster Setup (10%) — NetworkPolicies, CIS benchmarks
This plan is only viable for CKA holders with prior security experience.
Next: Master exam-day tactics with Exam Tips & Strategies →
