CKS practice examsIn development
Certified Kubernetes Security Specialist
Securing a Kubernetes cluster under time pressure: default-deny networking and CIS benchmarks, RBAC and Pod Security Admission, host and kernel hardening with seccomp and AppArmor, hardened pod specifications and secret handling, minimal signed images admitted only when verified, and runtime detection with Falco and audit logging.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Cluster setup | 10% |
| Cluster hardening | 15% |
| System hardening | 15% |
| Minimise microservice vulnerabilities | 20% |
| Supply chain security | 20% |
| Monitoring, logging and runtime security | 20% |
Two sample questions
1. Which practice verifies that a container image has not been tampered with and comes from a trusted source?
- Image scanning against the known CVE database
- A software bill of materials for the image
- Image signing, with verification of the signature — correct
- Pinning the image by its digest rather than by a tag
Why: Image signing and signature verification confirm an image is untampered and from a trusted source.
2. Why remove unused packages and services from a node?
- Each is attack surface not needed — correct
- It speeds up the kubelet
- It is required for network policies
- It encrypts the node's disk
Why: A minimal host has fewer components to patch and fewer ways in. Minimisation is the first system-hardening step.
The real CKS exam
| Length | 2 hours |
|---|---|
| Questions | Performance-based tasks on live clusters; typically 15 to 20 |
| Pass mark | 67% |
| Price | $445 USD, including one free retake |
| Recommended before you sit it | A current CKA certification is required before the CKS may be taken. |
| Valid for | 2 years |
Exam facts as published by CNCF / Linux Foundation; always check the vendor’s page before you book.
Study CKS with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.