Certified Kubernetes Security Specialist (CKS)
Demonstrate mastery in container and cluster security, control plane hardening, CIS benchmarks, runtime threat detection with Falco, vulnerability scanning with Trivy, AppArmor, Seccomp, and admission controllers.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
The CKS is the premier advanced security certification from the CNCF validating expertise in securing containerized workloads, hardening Kubernetes clusters, and mitigating runtime threats.
Candidates must hold an active, non-expired Certified Kubernetes Administrator (CKA) certification before attempting the CKS exam.
The CKS is a 2-hour, performance-based, hands-on terminal exam involving complex security hardening, auditing, and threat detection tasks across multiple live Kubernetes clusters.
Domains include: (1) Cluster Setup (15%), (2) Cluster Hardening (15%), (3) System Hardening (15%), (4) Minimize Microservice Vulnerabilities (20%), (5) Supply Chain Security (20%), and (6) Monitoring, Logging and Runtime Security (15%).
Audit policies define rules (levels: None, Metadata, Request, RequestResponse) specifying what events are recorded. Log backends stream JSON audit logs to disk or remote webhook endpoints for security monitoring.
Admission controllers intercept API requests prior to persistence. ImagePolicyWebhook inspects container image signatures. ValidatingAdmissionWebhook verifies resource manifests against security policies.
Falco uses Linux eBPF probes or kernel modules to monitor system calls (syscalls) in real time, triggering alerts when unexpected activities (e.g. spawned shell, modified /etc/shadow) occur inside containers.
AppArmor restricts program capabilities and file access paths via Linux Security Module (LSM) profiles. Seccomp (Secure Computing Mode) restricts the specific Linux system calls a process is allowed to execute.
Trivy scans container image layers against OS and language package vulnerability databases, reporting CVEs and severities (e.g., trivy image --severity HIGH,CRITICAL <image>).
Standard containers share the host Linux kernel. gVisor (runsc) provides a user-space kernel sandbox intercepting syscalls, while Kata Containers runs each pod inside a dedicated lightweight microVM.
Set --anonymous-auth=false, configure --authorization-mode=Webhook, enforce client CA verification via --client-ca-file, and disable the read-only port (--read-only-port=0).
A passing scaled score of 67% is required. Exam registration includes one free retake within 12 months.