CKS (Certified Kubernetes Security Specialist)
CNCF
Complete guide to passing the CKS (Certified Kubernetes Security Specialist) exam on your first attempt.
$395
~30%
2 years
Global
CNCF
$140k-$190k
Are you ready for CKS (Certified Kubernetes Security Specialist)?
Loading quiz...
Complete Overview
The Certified Kubernetes Security Specialist (CKS) is a two-hour, entirely hands-on certification exam created by the Cloud Native Computing Foundation and administered by the Linux Foundation, priced at $445 for the exam-only registration. Candidates solve 15 to 20 performance-based tasks from a command line against live Kubernetes clusters, and there is no multiple choice anywhere in it.
CKS is the only Kubernetes certification with a hard prerequisite. You must have passed the Certified Kubernetes Administrator (CKA) exam before you can sit CKS, though the CKA does not have to still be active at the time you register. That gate exists because CKS assumes you can already drive kubectl fluently under time pressure and spends its two hours on security work instead.
The passing mark is 67 percent, one point higher than the 66 percent required for CKA and CKAD. Scoring is automatic, and a score report reaches you by email within 24 hours of finishing. The curriculum splits across six domains: Cluster Setup at 15 percent, Cluster Hardening at 15 percent, System Hardening at 10 percent, Minimize Microservice Vulnerabilities at 20 percent, Supply Chain Security at 20 percent, and Monitoring, Logging and Runtime Security at 20 percent. CNCF publishes the curriculum openly as a PDF in the cncf/curriculum GitHub repository.
Delivery is remote only. The exam runs on PSI's Bridge platform through the PSI Secure Browser, with a live proctor watching streaming audio, video, and your screen. Dual monitors are not supported, virtual machines are not allowed, and the testing room must be private with a closed door and a clutter-free desk. The exam environment currently runs Kubernetes v1.35, and the Linux Foundation aligns it with each new minor Kubernetes release within roughly four to eight weeks.
Documentation access is part of the exam design. Inside the exam VM you may browse kubernetes.io/docs, the Kubernetes blog, and the official docs for Falco, etcd, Bom, the NGINX Ingress Controller, Cilium, and Istio, along with whatever the task's Quick Reference box links to. Search within kubernetes.io is allowed, but opening external search results is not.
A registration includes 12 months to schedule and sit the exam, two exam attempts, and two attempts at the Killer.sh simulator, each granting 36 hours of access and 17 questions drawn from a different set. The certification is valid for two years. Under the CARE program, earning or recertifying CKS on or after June 18, 2026 automatically extends your CKA expiration date to match your new CKS expiration date. Exam tasks are available in English, Simplified Chinese, and Japanese, switchable mid-exam from the Language Control Dropdown List.
Why Get CKS (Certified Kubernetes Security Specialist) Certified?
CKS is performance-based end to end. Passing it proves you configured a NetworkPolicy or an AppArmor profile against a live cluster in under two hours, which no multiple-choice security certification demonstrates.
It is the security capstone of the Kubernetes certification track, and it is the only one gated behind another exam. That prerequisite alone narrows the pool of people who hold it.
Salary data for the credential sits in the $140k-$190k band, at the top of the Kubernetes certification ladder.
The $445 registration includes two exam attempts and two Killer.sh simulator attempts, so the effective cost of a second sitting is zero rather than another full fee.
CKS is one of the five certifications in the CNCF Kubestronaut program, alongside CKA, CKAD, KCNA, and KCSA.
Earning or recertifying CKS on or after June 18, 2026 pushes your CKA expiration out to match the new CKS date under the CARE program, so one exam maintains two credentials.
The curriculum names the tools security teams actually deploy: Falco for runtime detection, Cilium and Istio for pod-to-pod encryption, Kubesec and KubeLinter for static analysis, and AppArmor and seccomp for kernel hardening.
Exam Format & Structure
Duration
2 hours
Questions
15 to 20 performance-based tasks
Passing Score
67 percent
Question Types
- Performance-based tasks solved from a Linux command line against live Kubernetes clusters
- Each task is completed on a designated SSH host named in an infobox at the start of the task
- No multiple choice, no written answers
Delivery Method
Online proctored only, on the PSI Bridge platform using the PSI Secure Browser, with a live proctor monitoring streaming audio, video, and screen sharing
Exam Domains & Topics
Covers securing the cluster perimeter and the control plane components themselves. Tasks in this area typically ask you to restrict traffic between namespaces with NetworkPolicy objects, correct a control plane configuration against a CIS benchmark finding, terminate TLS at an Ingress, or block workload access to the cloud provider metadata endpoint.
Key Topics to Master:
- NetworkPolicy objects to restrict cluster level access
- CIS benchmark review of etcd, kubelet, kubedns, and kube-apiserver configuration
- kube-bench output interpretation and remediation
- Ingress objects configured with TLS termination
- Protecting node metadata and endpoints from pod access
- Verifying platform binaries before deploying them
- Default-deny egress and ingress policy design
- Kubelet authentication and authorization settings
Focuses on the Kubernetes API and the identities that reach it. Expect to write or repair Role and ClusterRole definitions to a least-privilege standard, disable automatic service account token mounting, remove excessive permissions from an existing binding, and reason about which API access paths remain open after a change.
Key Topics to Master:
- Role, ClusterRole, RoleBinding, and ClusterRoleBinding least-privilege design
- Disabling automountServiceAccountToken on pods and service accounts
- Restricting use of the default service account
- Restricting access to the Kubernetes API server
- Anonymous authentication and API server flags
- Upgrading Kubernetes to remove known vulnerabilities
- kubectl auth can-i for verifying effective permissions
- Service account token projection and expiry
The smallest domain by weight, covering the host beneath Kubernetes. Tasks here involve applying kernel-level restrictions to a workload and reducing what the node exposes. AppArmor profiles and seccomp profiles are the two mechanisms named explicitly in the CNCF curriculum, and both are applied through pod-level security context fields.
Key Topics to Master:
- Minimizing host OS footprint and attack surface
- AppArmor profile loading and application to a pod
- seccomp profiles including RuntimeDefault and custom JSON profiles
- Least-privilege identity and access management on the node
- Minimizing external network access to nodes
- Disabling unused services and open ports on hosts
- Linux capabilities dropped through securityContext
One of three domains tied at 20 percent, this covers what a running workload is permitted to do and how workloads are separated from one another. It spans Pod Security Standards enforcement, secret handling, sandboxed runtimes such as gVisor through RuntimeClass, and encrypting traffic between pods with a service mesh or CNI.
Key Topics to Master:
- Pod Security Standards: privileged, baseline, and restricted profiles
- Pod Security Admission labels applied at the namespace level
- Creating, mounting, and rotating Kubernetes Secrets
- Encryption of Secrets at rest with an EncryptionConfiguration
- Multi-tenancy isolation techniques
- Sandboxed containers via RuntimeClass, for example gVisor or Kata Containers
- Pod-to-pod encryption with Cilium or Istio mutual TLS
- securityContext fields: runAsNonRoot, readOnlyRootFilesystem, allowPrivilegeEscalation
Covers everything upstream of the running pod: what goes into an image, where images may come from, and how you prove an artifact is what it claims to be. Tasks include shrinking a Dockerfile, restricting registries through admission control, scanning images, and running static analysis over manifests.
Key Topics to Master:
- Minimizing base image footprint and multi-stage builds
- Software bills of materials and the Bom tool
- Securing CI/CD pipelines and artifact repositories
- Restricting image sources to permitted registries with admission control
- Signing and validating artifacts
- Image vulnerability scanning with Trivy
- Static analysis of manifests and images with Kubesec and KubeLinter
- ImagePolicyWebhook and validating admission configuration
The detection half of the curriculum. Tasks center on Falco rule authoring and interpretation, enabling and shaping Kubernetes audit logging through an audit policy file and API server flags, and enforcing container immutability at runtime so a compromised process cannot write to the filesystem or escalate.
Key Topics to Master:
- Falco installation, rule syntax, and output fields
- Behavioral analytics to detect malicious process activity
- Kubernetes audit policy files and audit levels
- kube-apiserver audit flags including audit-log-path and audit-policy-file
- Investigating and identifying phases of an attack from logs
- Container immutability at runtime with readOnlyRootFilesystem
- Detecting threats across infrastructure, apps, networks, data, users, and workloads
- Sysdig and Falco event correlation for incident triage
Recommended Study Plan
- 1Confirm your CKA pass on the Linux Foundation verification page; it does not need to still be active, but it must exist before you can register
- 2Download the CKS curriculum PDF from the cncf/curriculum GitHub repository and map each bullet to confident or unfamiliar
- 3Build a three-node kubeadm cluster on Kubernetes v1.35 so your practice environment matches the exam version
- 4Set up kubectl aliases, bash autocompletion, and a vim configuration with two-space YAML indentation
- 5Run the PSI Online Proctoring System Check on the exact machine you will test on
- 1Write default-deny ingress and egress NetworkPolicies for a namespace, then selectively allow one pod-to-pod path
- 2Run kube-bench against your cluster and remediate three findings on the kube-apiserver and kubelet
- 3Create an Ingress with a TLS secret and verify the certificate is served
- 4Block pod access to the node metadata endpoint using a NetworkPolicy with an ipBlock and except clause
- 5Verify a Kubernetes release binary checksum and signature before installing it
- 1Build a Role and RoleBinding that permits only get and list on pods in one namespace, then prove the limit with kubectl auth can-i
- 2Find and remove an over-permissive ClusterRoleBinding to system:anonymous or system:unauthenticated
- 3Set automountServiceAccountToken to false on a service account and on individual pods, then confirm the token is gone from the pod filesystem
- 4Review kube-apiserver flags for anonymous-auth and authorization-mode settings
- 5Practice upgrading a cluster with kubeadm from one minor version to the next
- 1Write an AppArmor profile, load it with apparmor_parser, and apply it to a pod through the security context
- 2Apply the RuntimeDefault seccomp profile to a pod, then write and apply a custom seccomp JSON profile that blocks a specific syscall
- 3Drop all Linux capabilities on a container and add back only the one it needs
- 4Audit a node for open ports and running services, and disable those not required
- 5Practice restarting the kubelet and reading journalctl output after a failed configuration change
- 1Apply Pod Security Admission labels for enforce, audit, and warn at the restricted level on a namespace, then watch a privileged pod get rejected
- 2Create a Secret, mount it as a volume and as an environment variable, and note the differences in exposure
- 3Configure encryption at rest for Secrets with an EncryptionConfiguration file and confirm the etcd value is no longer plaintext
- 4Install a RuntimeClass backed by gVisor and schedule a pod to it
- 5Enable mutual TLS between two pods using Cilium or Istio and verify the traffic is encrypted
- 1Rewrite a bloated Dockerfile as a multi-stage build on a distroless base and compare image sizes
- 2Scan images with Trivy and fix the highest severity finding by changing the base image
- 3Run Kubesec and KubeLinter over your manifests and correct every reported issue
- 4Configure an ImagePolicyWebhook admission plugin and confirm the API server rejects an image from an unpermitted registry
- 5Generate a software bill of materials with Bom and read the output
- 1Install Falco on a node and read the default rule set until you can trace one alert back to its rule
- 2Write a custom Falco rule that alerts on a specific binary executing inside a container, then trigger it
- 3Write a Kubernetes audit policy with Metadata, Request, and RequestResponse levels for different resources
- 4Add audit-log-path, audit-log-maxage, and audit-policy-file flags to the kube-apiserver manifest and confirm the log fills
- 5Set readOnlyRootFilesystem on a deployment and fix the application by mounting an emptyDir where it needs to write
- 1Use your first Killer.sh attempt and treat all 17 questions as a timed two-hour exam
- 2Work through the full Killer.sh solutions after the attempt; the simulator is deliberately harder than the exam
- 3Log every task where you had to search the docs and how long the search took
- 4Rebuild the three tasks you scored worst on from scratch in your own cluster
- 5Read the CKS Resources Allowed page and bookmark the exact doc pages you will be permitted to open
- 1Practice reaching the NetworkPolicy, seccomp, AppArmor, and audit policy pages on kubernetes.io in under 20 seconds each
- 2Drill kubectl create and kubectl run with --dry-run=client -o yaml for every object type in the curriculum
- 3Rehearse ssh to a named host, sudo -i, edit a static pod manifest, and confirm the component restarted
- 4Set a personal rule for abandoning a task and returning to it, then practice enforcing it
- 5Run a self-built 16-task mock exam mixing all six domains
- 1Use your second Killer.sh attempt as a dress rehearsal at the same time of day you booked the real exam
- 2Confirm the first and last name on your exam checklist matches your government ID exactly
- 3Clear your testing room: nothing on the desk, nothing under it, no printouts on the walls, door closed
- 4Verify you have one active monitor connected, not two, and a webcam you can physically pan around the room
- 5Reread the Important Instructions: CKS page for the exam keyboard shortcuts, especially Ctrl+Alt+W and Ctrl+Shift+V
Ready to pass CKS (Certified Kubernetes Security Specialist)?
Get 500+ practice questions, video walkthroughs, and a pass guarantee.
Best Study Resources
CKS Exam Curriculum PDF
Official curriculumThe authoritative CNCF document listing all six domains with their percentage weights and every competency bullet beneath them. The major and minor version numbers of the file match the Kubernetes version it targets.
Free, CC-BY 4.0 licensed
Killer.sh CKS simulator
Exam simulatorTwo attempts, each granting 36 hours of access and a different set of 17 questions with graded results and full solutions. Widely described by candidates as harder than the exam itself, which is the point. Simulator access is not included in the CKS-SINGLE registration.
Included with the $445 exam registration
Kubernetes Security Essentials (LFS260)
Self-paced courseThe Linux Foundation course built directly against the CKS curriculum, covering securing container-based applications and Kubernetes platforms at build, deploy, and runtime. Not required for the exam. The Linux Foundation's other bundle, at $625, pairs the exam with a THRIVE-ONE annual subscription instead of this course.
$645 bundled with the CKS exam registration
CKS Resources Allowed page
Official policy documentationThe definitive list of documentation domains you may open inside the exam VM: kubernetes.io/docs, the Kubernetes blog, Falco docs, Bom docs, etcd docs, NGINX Ingress Controller docs, Cilium docs, Istio docs, and Quick Reference links. Study only from these during practice so you build the right muscle memory.
Free
Important Instructions: CKS
Official exam instructionsCovers the exam environment mechanics: the base node you must not reboot, the SSH-to-designated-host workflow, the pre-installed kubectl alias and yq, the Ctrl+Alt+W substitute for Ctrl+W, and the Linux terminal copy and paste shortcuts.
Free
Kubernetes documentation security section
Reference documentationThe pages you will actually open during the exam. The Pod Security Standards, NetworkPolicy, seccomp tutorial, AppArmor tutorial, auditing, and encrypting Secrets at rest pages between them cover a large share of the task surface.
Free
Falco documentation
Reference documentationFalco is explicitly permitted during the exam and its rule syntax appears in the runtime security domain, worth 20 percent. Learn the rule file structure, the fields available in conditions, and how to read the default rule set.
Free
Trivy
Open source scannerThe image and manifest scanner most commonly used for the supply chain domain. Practice scanning an image, filtering by severity, and reading the output format so you can act on it quickly rather than parsing it for the first time under the clock.
Free
kube-bench
Open source CIS benchmark toolAutomates the CIS Kubernetes Benchmark checks named in the cluster setup domain. Run it against your practice cluster and remediate the failures by hand so you know which file and which flag each finding maps to.
Free
Linux Foundation Candidate Handbook
Official policy handbookCovers policies, procedures, and rules during the exam, plus the Take Exam section describing the PSI Secure Browser download and the candidate self check-in process. Read it before booking rather than on test day.
Free
Common Mistakes to Avoid
Forgetting that each task runs on a designated remote host and working on the base node instead.
An infobox at the start of every task names the host. SSH to it, do the work, and return to the base node before starting the next task. The base node has no kubectl, yq, curl, or man pages installed, so if those commands are missing you are on the wrong machine. Nested SSH is not supported.
Rebooting the base node when something appears stuck.
The Linux Foundation states explicitly that you must not reboot the host named base, and that doing so will not restart your exam environment. If a designated SSH host needs a restart, that is a different machine and a different decision. Losing the base node loses the session.
Practicing on a Kubernetes version that does not match the exam environment.
The CKS environment currently runs Kubernetes v1.35, and the Linux Foundation aligns it with each new minor release within roughly four to eight weeks. Pod Security Admission, seccomp defaults, and AppArmor field locations have all moved between versions. Build your practice cluster on the version named in the current Important Instructions page.
Relying on search engines during practice, then finding them blocked in the exam.
You may search within kubernetes.io/docs but must not open external search results, and only a fixed list of documentation sites is permitted: kubernetes.io, the Kubernetes blog, Falco, Bom, etcd, NGINX Ingress Controller, Cilium, and Istio. Practice retrieving every YAML snippet you need from those sites alone.
Treating the Killer.sh score as a prediction of the real result.
The simulator is deliberately harder and longer than the exam, with 17 questions per session across two attempts. Use it to find gaps and to build speed, not to forecast a percentage. Working through the full published solutions after each attempt is worth more than the score itself.
Spending 15 minutes perfecting a single NetworkPolicy while four tasks go untouched.
The exam has 15 to 20 tasks in 120 minutes and the pass mark is 67 percent, so partial coverage across many tasks beats perfection on a few. Every task carries its own weight. Set a hard per-task ceiling, note the task number, and return only if time remains.
Writing an AppArmor or seccomp profile but never loading it on the node.
A profile referenced in a pod's security context that does not exist on the node leaves the pod stuck. Load AppArmor profiles with apparmor_parser on the correct node, place seccomp JSON files under the kubelet seccomp profile root, and verify the pod reaches Running before you move on.
Editing a static pod manifest for kube-apiserver and not checking that the component came back.
Audit logging, admission plugin, and anonymous-auth tasks all require editing the kube-apiserver manifest in /etc/kubernetes/manifests. A YAML error takes the API server down and every subsequent kubectl command fails. After each edit, wait and confirm the API responds before continuing, and read the container logs under /var/log if it does not.
Registering for CKS before passing CKA.
CKA is a hard prerequisite: you must have taken and passed it before attempting CKS. It does not need to be current or active at that point, but it must exist. Budget for both exams and for the CKA study time if you do not already hold it.
Exam Day Tips
- 1
Bring a valid, unexpired, physical government-issued ID showing your name, photo, and signature. The first and last name must exactly match the verified name on your exam checklist, and photocopies or digital IDs are refused. Biometric government IDs without a signature are accepted.
- 2
Clear the room before check-in: nothing on the desk surface, nothing under it, no paper or printouts on the walls, and no bright light or window behind you. Wall art is acceptable. If the room has a door, it must be closed.
- 3
Connect exactly one active monitor. Dual monitors are not supported and the proctor will not release the exam until the second one is disconnected. The Linux Foundation recommends a 15 inch or larger screen at 1080p.
- 4
You cannot take the exam inside a virtual machine, even if the compatibility check passes. Use a personal machine where you have rights to install applications and end system processes, and plug a laptop into power before you start.
- 5
Ctrl+W closes a Chrome tab, so the exam remaps the shortcut: use Ctrl+Alt+W instead. Inside the Linux terminal, copy is Ctrl+Shift+C and paste is Ctrl+Shift+V; elsewhere on the remote desktop it is plain Ctrl+C and Ctrl+V.
- 6
The INSERT key is disabled for security reasons. In vim, press i to enter insert mode and Esc to leave it. An on-screen Virtual Keyboard icon on the desktop covers special characters that international layouts do not produce.
- 7
Ctrl+F activates Find in Page inside the exam's Firefox browser, which is the fastest way to reach a YAML block on a long kubernetes.io page. Resize the Firefox window first so the find bar is visible.
- 8
kubectl is pre-installed on every SSH host with a k alias and bash autocompletion, along with yq, curl, wget, and man pages. Use sudo -i for elevated privileges on any node.
- 9
There is no on-screen result. Scoring is automatic and the score report arrives by email within 24 hours of finishing, barring technical exceptions.
Career Paths & Salary Ranges
Kubernetes security engineer
Owns cluster security posture: admission control policy, RBAC review, NetworkPolicy design, and runtime detection rules. The CKS curriculum is effectively this role's job description broken into six weighted parts.
$140k-$190k
Cloud native platform engineer
Builds and runs the internal Kubernetes platform other teams deploy on, including the guardrails. The supply chain and microservice vulnerability domains, 40 percent of the curriculum between them, cover the paved-road controls this role ships.
$140k-$190k
DevSecOps engineer
Puts security controls into the pipeline: image scanning with Trivy, manifest static analysis with Kubesec and KubeLinter, registry restrictions, and artifact signing. Supply Chain Security alone is 20 percent of the exam.
$140k-$190k
Container security specialist
Works below the orchestrator on the runtime and kernel layer: seccomp and AppArmor profiles, sandboxed runtimes through RuntimeClass, and container immutability enforcement. Combines the system hardening and runtime security domains.
$140k-$190k
Site reliability engineer with a security remit
Runs production Kubernetes and answers for both availability and incident response. Falco rules and Kubernetes audit logging, both in the 20 percent monitoring domain, are the detection layer this role is paged from.
$140k-$190k
Cloud security architect
Sets multi-cluster and multi-tenant security standards rather than implementing them cluster by cluster. The isolation techniques, pod-to-pod encryption, and API restriction competencies map onto the architectural decisions this role documents.
$140k-$190k
Prerequisites & Requirements
- You must have taken and passed the Certified Kubernetes Administrator (CKA) exam before attempting CKS. This is enforced at registration.
- The CKA certification does not have to be current or active at the time you enroll for CKS; it only has to have been earned at some point.
- You must supply your own computer with a webcam you can physically pan around the room, a working microphone, and one active monitor. Dual monitors are not supported.
- You need a reliable internet connection with HTTPS access to AWS S3 endpoints, because the PSI Secure Browser requires it. Wired connections are recommended over wireless.
- You must have administrator rights on the testing machine to install the PSI Secure Browser and to end system processes and services. Virtual machines are not permitted.
- You need a private testing space. Coffee shops, stores, and open offices are not allowed.
- Candidates aged 16 to 18 may test online provided a parent or guardian submits the Parental Release for Testing of Minors form at least two weeks before the exam date, the minor presents a valid student ID, and the guardian presents a valid ID and gives verbal consent at check-in.
- Persons subject to US sanctions prohibitions may not participate in Linux Foundation Education programs.
Frequently Asked Questions
What happens if I fail the CKS exam?
A standard CKS registration includes one free retake, so a failed first attempt costs nothing extra. The Linux Foundation states that when eligible it offers a retake to those who do not pass the first time, regardless of the reason, including candidates who attribute a failure to the testing environment. Your registration also gives you 12 months from purchase to schedule and sit the exam.
How much does CKS cost, and what does the price include?
The exam-only registration is $445 and includes two exam attempts, two Killer.sh simulator attempts, and 12 months to schedule. Two bundles exist: $625 pairs the exam with a THRIVE-ONE annual subscription, and $645 pairs it with the Kubernetes Security Essentials (LFS260) course. There is no separate retake fee to budget for, because the second attempt is already inside the registration.
What score do I need to pass?
67 percent. That is one percentage point higher than the 66 percent required for both CKA and CKAD. Exams are scored automatically, and because tasks carry different weights, attempting more tasks partially generally beats completing fewer perfectly.
How long do results take?
A score report is emailed within 24 hours of the time you complete the exam, barring exceptions or technical difficulties. There is no score displayed at the end of the session. Because scoring is automated rather than human-graded, the turnaround is far shorter than for most security certifications.
Do I really need CKA first?
Yes. Candidates must have taken and passed the CKA exam before attempting CKS, and the requirement is checked at registration. The one flexibility is that your CKA does not have to be current or active, so a lapsed CKA still qualifies you. If you do not hold CKA, budget for that exam and its preparation before booking CKS.
What ID do I need for the online proctored session?
One valid, unexpired, original physical government-issued ID with your name, photo, and signature. Acceptable forms include an international travel passport, a government-issued driver's license or permit, a national or state identity card, an alien registration card, and Japanese Basic Resident Register or My Number cards. Government-issued biometric IDs without a signature are accepted. Photocopies and electronic IDs are refused, and the first and last name must exactly match your exam checklist.
What documentation am I allowed to use during the exam?
Inside the exam VM's browser you may open kubernetes.io/docs, the Kubernetes blog, Falco documentation, Bom documentation, etcd documentation, NGINX Ingress Controller documentation, Cilium documentation, Istio documentation, and any link provided in a task's Quick Reference box. Searching within kubernetes.io/docs is allowed, but you must not open external search results. Translated versions of the docs are permitted, though the English pages are the most current.
Are there breaks during the two hours?
The Linux Foundation does not schedule breaks for the CKS exam, and you must remain within the camera frame throughout. You are also not allowed to have any other applications or browser windows running besides the exam. Plan the full two hours as one continuous block.
What Kubernetes version does the exam run?
The CKS exam environment currently runs Kubernetes v1.35, and the Linux Foundation aligns it with the most recent Kubernetes minor version within roughly four to eight weeks of that release. Check the Important Instructions: CKS page shortly before you book and build your practice cluster on the version it names.
How does recertification work?
CKS is valid for two years from the date it is awarded. To renew, you retake and pass the exam before the current certification expires, which extends it a further two years from the date you pass. There is no continuing education credit path. Under the CARE program, earning or recertifying CKS on or after June 18, 2026 automatically updates your CKA expiration date to match your new CKS expiration date.
What is the Killer.sh simulator and how many attempts do I get?
Killer.sh is the exam simulator included with a CKS registration. You get two attempts, each granting 36 hours of access from the moment you activate it, and each session presents a different set of 17 questions with graded results and published solutions. The link appears in the Preparing for the Exam section of your exam preparation checklist in My Portal. Simulator access is not included in the CKS-SINGLE registration.
Can I request accommodations?
The Linux Foundation directs accommodation and support requests through trainingsupport.linuxfoundation.org, where you log in with your LF Account and select a request category. Font size can be adjusted in-exam using the plus and minus zoom controls on the PSI Secure Browser toolbar, mouse, keyboard, and accessibility settings can be customized from desktop icons, and an on-screen Virtual Keyboard is available for special characters.
How does CKS compare to CKA?
Both run two hours and both are performance-based, but CKA is the operations exam and CKS is the security exam layered on top of it. CKA requires 66 percent to pass and CKS requires 67 percent. CKA has no prerequisite; CKS requires a CKA pass. Both are now valid for two years, although CKA and CKAD certifications earned before April 1, 2024 remain valid for three.
How does CKS compare to KCSA?
The Kubernetes and Cloud Native Security Associate (KCSA) is a multiple-choice associate-level exam with no prerequisite, aimed at understanding security concepts. CKS is a performance-based professional exam requiring a CKA pass, where you configure real controls on live clusters under a two-hour clock. Both count toward the CNCF Kubestronaut program, but they test different things: recognition versus execution.
Can I use a work laptop for the exam?
The Linux Foundation strongly advises against it. Corporate security software and work applications frequently disrupt the PSI Secure Browser, and corporate firewalls can block the installation outright. You need rights to install applications and end system processes, and HTTPS connectivity to AWS S3 endpoints must not be blocked. Use a personal machine wherever possible.
What tools are already installed in the exam environment?
Every designated SSH host comes with kubectl including a k alias and bash autocompletion, yq for YAML processing, curl and wget for testing services, and man pages. The base node has none of these, because all tasks must be completed on the designated hosts. You can assume elevated privileges on any node with sudo -i.
What language is the exam offered in?
CKS exam tasks are available in English, Simplified Chinese, and Japanese. The exam defaults to the preferred language detected in your browser, falling back to English if that language is unavailable, and you can switch between available languages mid-exam using the Language Control Dropdown List in the exam console's Content Panel.
How long should I expect preparation to take?
The Linux Foundation's own suggested curriculum path estimates 3 to 6 months from the free Introduction to Kubernetes course through CKA and on to CKS, depending on experience level. For someone who already holds CKA and works with Kubernetes daily, a focused 8 to 10 week plan built around hands-on repetition of the six curriculum domains is a realistic target.
Pass CKS (Certified Kubernetes Security Specialist), Guaranteed
94% pass rate on first attempt
One-time • Lifetime access