CNCF · Cloud Native Computing Foundation

Certified Kubernetes Security Specialist

CKS

The CKS is CNCF's hands-on, performance-based exam for engineers who secure Kubernetes clusters in production. There are no multiple-choice questions — you work inside live clusters from a Linux terminal and have two hours to harden nodes, write NetworkPolicies, configure admission controllers, and audit running workloads against real attacks. It's one of the few credentials that proves you can actually do the work, which is exactly why a misread task or a clock that runs out can cost you the attempt and the $445 sitting fee. This page breaks down what's tested, how it's delivered, and how to get it done right.

2 hours
Hands-on terminal
67% to pass
CKA required

Pay Only After You Pass

No upfront fee — you settle only after your verified passing result. We advertise guaranteed results — 100% pass guaranteed or money back.

Exam Spec Sheet

Provider CNCF / Linux Foundation
Format Performance-based · live clusters
Duration 2 hours
Tasks ~15–20 hands-on tasks
Passing score 67%
Fee $445 (one free retake)
Prerequisite Active CKA
Proctoring PSI (online, live proctor)
Validity 2 years
K8s version Recent minor (e.g. v1.34)
See CKS Help Options

EXAM FORMAT

How the CKS is built — at a glance

120

Minutes, no breaks

A single 2-hour block to complete every task. The clock does not stop, so triage and time management decide as much as technical skill.

15–20

Live, weighted tasks

Each task carries a point weight shown on screen. You jump between several real Kubernetes clusters from a browser-based terminal — no multiple choice anywhere.

67%

Fixed pass mark

Partial credit is awarded per task. Reach 67% of total points and you pass — there is no curve and no scaled rescore.

A terminal, not a quiz

You operate inside a remote Linux desktop with a real kubectl and multiple clusters. Tasks tell you which cluster context to switch to first, then ask you to apply real fixes — patch a kubelet, write a NetworkPolicy, enable an admission controller, or scan an image. The grader checks the resulting cluster state, so the work has to actually function, not just look correct.

Open documentation, closed clock

You may keep one extra browser tab open to the official Kubernetes documentation, plus a short allow-list of project sites (Falco, Trivy, AppArmor, etcd, and a few others). It's a helpful safety net for YAML syntax, but with only 120 minutes, candidates who lean on search instead of muscle memory tend to run out of time before they run out of tasks.

WHAT'S TESTED

Six security domains — bars show each domain's official share of the exam

1

Cluster Setup

15%

Network policies, CIS Benchmark checks with kube-bench, securing ingress with TLS, protecting node metadata and the GUI, and verifying platform binaries.

2

Cluster Hardening

15%

RBAC least privilege, restricting and rotating service-account tokens, locking down the API server, and keeping Kubernetes patched against known CVEs.

3

System Hardening

10%

Reducing the host attack surface, AppArmor and seccomp profiles, kernel hardening, and minimizing IAM and external access from the node.

4

Minimize Microservice Vulnerabilities

20%

Pod Security Standards and admission control, OPA/Gatekeeper policies, managing secrets, container sandboxing with gVisor/Kata, and mTLS between services.

5

Supply Chain Security

20%

Minimizing base-image footprint, scanning images with Trivy, image allow-lists and admission gating, signing and validating artifacts, and SBOM/static analysis of workloads.

6

Monitoring, Logging & Runtime Security

20%

Behavioral analytics and threat detection with Falco, immutable containers at runtime, and configuring Kubernetes audit logging to investigate events.

The three 20% domains — microservice vulnerabilities, supply chain, and runtime security — together make up 60% of the exam, so they are where most of your points (and most of your prep time) should go. The official curriculum tracks a recent Kubernetes minor version and is updated within roughly 4–8 weeks of each new release, so always confirm you're studying the current version.

DELIVERY & PROCTORING

Taken online and watched live — what to expect on test day

Online via PSI

The CKS runs entirely online through the PSI Secure Browser. You schedule a slot, launch the secure browser, pass identity and environment checks, then work inside a remote terminal that connects to the live exam clusters. There is no test-center option — everything happens from your own machine under a live proctor.

Practice before the real thing

Registration includes two attempts at the Killer.sh exam simulator. Each session mirrors the real interface and runs harder than the actual exam, which makes it the single best gauge of whether you're ready. Treat both sessions as full dress rehearsals under the clock, not as a question bank to memorize.

ID & identity check

A valid, unexpired government photo ID with a name matching your registration. The proctor captures your photo and verifies it before the exam unlocks.

Environment scan

A clear desk, a 360° webcam room scan, no second monitor, no phone or notes within reach, and no one else in the room for the full two hours.

During the exam

Stay on camera the whole time. Only the exam terminal and the single allowed documentation tab may be open; leaving frame, talking aloud, or extra tabs can flag the session.

WHO SHOULD TAKE THIS

CKS is built for engineers who already run Kubernetes

  • CKA-certified administrators adding a security specialization
  • Platform and DevOps engineers securing production clusters
  • Cloud-native security engineers and SREs
  • Engineers working toward the CNCF Kubestronaut program
  • Consultants who need a recognized container-security credential

PREREQUISITES & DIFFICULTY

CKA is mandatory — and the bar is high

  • An active, passing CKA is required before you can sit the CKS
  • Fluent kubectl, YAML, and Linux command-line under time pressure
  • Working knowledge of Falco, Trivy, OPA, AppArmor, and seccomp
  • Comfort debugging a live cluster you've never seen before

Difficulty: CKS is widely considered the hardest of the three core Kubernetes exams. Two hours is genuinely tight for 15–20 weighted, multi-step tasks, and many candidates know the concepts but lose points to slow execution, context-switching mistakes, or fixes that don't actually take effect in the cluster. That execution pressure — not the theory — is exactly what our help is designed to remove.

HOW EXAM ASSIST HELPS YOU PASS THE CKS

CKS is a fast, unforgiving, hands-on exam where execution under the clock decides everything. Exam Assist pairs you with a vetted Kubernetes security specialist and works on a pay-after-you-pass model — so the risk sits with us, not you. No upfront fee, guaranteed results: just an honest feasibility answer and a verified result before you settle.

1

Share your exam details

Tell us your CKA status, target test date, Kubernetes version, and where you stand on the six domains. Takes a couple of minutes over WhatsApp, Telegram, or Discord.

2

Get an honest feasibility answer

We review your timeline and readiness and tell you plainly whether it's realistic — before any money is discussed. If it isn't a fit, we say so.

3

The sitting is handled

Exam Assist handles the sitting end to end. You're matched with a CKS specialist who maps the work around the high-weight domains, the PSI environment, and the two-hour clock — discreetly and confidentially.

4

Settle after the verified result

You only pay once your passing result is confirmed on your official CNCF report. No verified result, nothing owed.

Ready to lock in your CKS pass?

Share your details and get a straight feasibility answer — pay only after a verified result.

Start with CKS Help

FREQUENTLY ASKED

Straight answers about the CKS exam

What score do I need to pass the CKS exam? +
You need 67% or higher to pass. The score is calculated from the hands-on tasks you complete, where partial credit is awarded per task. There is no scaled curve — 67% of the available points is the fixed cut line, so finishing high-weight tasks correctly matters more than touching every question.
Do I need to pass the CKA before taking the CKS? +
Yes. The CNCF requires an active, passing Certified Kubernetes Administrator (CKA) certification before you are allowed to sit the CKS. The CKS builds directly on CKA cluster-administration skills, so the prerequisite is enforced — you cannot register for the CKS without a valid CKA.
Is the CKS exam multiple choice? +
No. The CKS is a fully hands-on, performance-based exam. You work inside a live, multi-cluster Kubernetes environment from a Linux command line and complete real security tasks — hardening kubelets, writing NetworkPolicies, configuring admission controllers, scanning images, and auditing manifests. There are no multiple-choice questions.
Can I use the Kubernetes documentation during the exam? +
Yes. During the exam you may open one extra browser tab to kubernetes.io documentation (including the docs and blog, plus a short allow-list of security project sites such as Falco, Trivy, and AppArmor). Most candidates rely on this for YAML examples, but you only have 2 hours, so searching too much costs you tasks.
How long is the CKS certification valid? +
The CKS certification is valid for two years from the date it is awarded. Because the exam tracks a recent Kubernetes minor version, renewing keeps your security skills aligned with the current platform. Your CKA must also stay valid for the CKS to count toward the CNCF Kubestronaut program.
Do I pay Exam Assist before or after I see my CKS result? +
You settle only after your verified passing result is confirmed. There is no upfront fee — you share your exam details, receive an honest feasibility answer, and decide before any money changes hands. We advertise a guaranteed pass with money back if you do not pass; we offer a transparent, results-first arrangement.

KEEP EXPLORING

Book your help and compare sibling Kubernetes exams

YOUR CKS PASS, HANDLED

Get expert CKS help with no upfront fee — you settle only after your verified passing result. Honest feasibility answer first, results-first arrangement always.

OR CHAT WITH US