CKSSpecialty LevelLinux Foundation / CNCF

Certified Kubernetes Security Specialist (CKS)

The elite security certification for cloud-native architects. Validates expertise in securing container supply chains, hardening host operating systems, configuring Falco runtime threat detection, AppArmor, seccomp, and admission controllers.

Recommended Prerequisites: Must hold an active CKA certification before attempting CKS.

Exam Duration

2 Hours (120 Mins)

Passing Score

67%

Registration Cost

$395 USD

Exam Format

100% Performance-based hands-on security exam

Official Exam Registration Launch Hands-On Simulator Explore Related Tutorials

Complete Exam Blueprint & Tested Competencies

Total 100% Weight

1. Cluster Setup & Hardening

Weight: 20%

Key Exam Topics Tested:

Configure CIS benchmark compliance with kube-bench
Enforce secure Ingress with TLS ciphers and mutual authentication
Protect node metadata APIs and restrict network access to etcd

Practical Competencies & Skills Required:

✓Run kube-bench against control plane components and remediate insecure flags in apiserver manifests
✓Configure RBAC with least privilege and audit unused ServiceAccounts

2. System Hardening

Weight: 20%

Key Exam Topics Tested:

Configure AppArmor profiles and enforce them on pods
Apply Seccomp security profiles to restrict dangerous Linux system calls
Reduce host attack surface by removing root privileges and disabling unused services

Practical Competencies & Skills Required:

✓Load apparmor_parser -q /etc/apparmor.d/custom-profile and annotate pod specs
✓Restrict container capabilities with securityContext.capabilities.drop: ['ALL']

3. Minimize Microservice Vulnerabilities

Weight: 20%

Key Exam Topics Tested:

Scan container images with Trivy for known CVEs
Manage Kubernetes Secrets securely with encrypted etcd at rest (EncryptionConfiguration)
Enforce Pod Security Standards (Privileged, Baseline, Restricted) via namespace labels

Practical Competencies & Skills Required:

✓Configure encryption-provider-config.yaml with a secretbox AES-CBC provider
✓Label namespaces with pod-security.kubernetes.io/enforce=restricted

4. Supply Chain Security

Weight: 20%

Key Exam Topics Tested:

Configure ImagePolicyWebhook and ValidatingAdmissionPolicy
Verify container image signatures and provenance using Cosign
Leverage minimal multi-stage Docker builds (Distroless / Scratch)

Practical Competencies & Skills Required:

✓Block untrusted registry pulls via AdmissionController admission plugins
✓Identify and remove unpinned image tags and package managers from production images

5. Monitoring, Logging & Runtime Security

Weight: 20%

Key Exam Topics Tested:

Configure Falco rules to detect unauthorized shell spawns and root file access
Investigate Kubernetes audit logs to detect API tampering and credential theft
Detect container drift and process execution anomalies

Practical Competencies & Skills Required:

✓Write Falco custom rule syntax in /etc/falco/falco_rules.local.yaml
✓Analyze /var/log/kubernetes/audit/audit.log using jq and grep

Related DevOps & Cloud Credentials

CKAProfessional

Certified Kubernetes Administrator (CKA)

The industry benchmark for Kubernetes operators and DevOps cluster architects. Tests live terminal ability to install, configure, upgrade, troubleshoot, secure, and maintain multi-node production clusters.

2 Hours (120 Mins)View Blueprint

CKADProfessional

Certified Kubernetes Application Developer (CKAD)

Focuses on designing, building, configuring, and exposing cloud-native applications on Kubernetes. Perfect for developers, DevOps pipeline authors, and site reliability engineers.

2 Hours (120 Mins)View Blueprint

KCNAAssociate

Kubernetes and Cloud Native Associate (KCNA)

Entry-level certification covering the full CNCF cloud native landscape: GitOps, container runtimes, observability, microservices architecture, and SRE best practices.

90 MinutesView Blueprint

Certified Kubernetes Security Specialist (CKS)

Recommended Prerequisites: Must hold an active CKA certification before attempting CKS.