CKS (Certified Kubernetes Security Specialist): exam format, domains and the Golden path

What is the CKS exam?

CKS is the Certified Kubernetes Security Specialist exam from the Linux Foundation and CNCF. It is a proctored, online, performance-based exam: you secure live Kubernetes clusters from a command line, and the result is graded on the state you leave behind. It covers security across the life of a workload, from cluster setup and hardening, through system hardening and minimising microservice vulnerabilities, to supply chain security and finally monitoring, logging and runtime security. Its entry requirement is shown in the facts table below, and it is the hands-on counterpart of the multiple-choice KCSA. Officially it is the Certified Kubernetes Security Specialist certification, a performance-based exam in the Kubestronaut core tier of the 16-certification Golden Kubestronaut program. The sections below cover its official domains, the verified format and cost, and its place in the path.

Preparation means applying controls, not describing them: network policies, RBAC, Pod security, AppArmor and seccomp profiles, image scanning and admission, audit logging and runtime detection tools. Documentation is available, but there is little time to learn a tool during the exam.

CKS exam domains and weights

CKS has six domains. Minimize Microservice Vulnerabilities, Supply Chain Security, and Monitoring, Logging and Runtime Security each carry 20%, so the application and runtime side carries most of the weight. Cluster Setup and Cluster Hardening follow at 15% each, and System Hardening at 10%. The even spread means broad preparation beats deep specialisation in one area. Cluster setup and hardening cover network policies, CIS benchmarks, RBAC and API access, while the larger domains cover Pod security, image and registry controls, and detecting and responding to suspicious behaviour at runtime. The official list has 6 domains: the largest is Minimize Microservice Vulnerabilities at 20% and the smallest is System Hardening at 10%, so a sensible plan splits study time roughly in proportion to these weights.

Because CKS builds on a working CKA skill set, check your cluster fundamentals before starting the security material. Then take one domain at a time and apply each control to a practice cluster until you can do it without searching.

CKS exam format and cost

The CKS exam facts below were read from the official Linux Foundation pages on 2026-10-23, and every row of the table links to the page it came from. Format: Online, proctored, performance-based (command line). Questions: 15-20 performance-based tasks. Duration: 120 minutes. Passing score: 67%. Price: 445 US dollars. Certification validity: 2 years. Prerequisites: Must have taken and passed the Certified Kubernetes Administrator (CKA) exam. Retake policy: One retake per exam purchase if a passing score is not achieved. Curriculum version: Based on Kubernetes v1.35. Prices and policies change, so confirm them on the official CKS page before you book. If the Linux Foundation changes a value, this page is updated and shows the date it was last verified.

A performance-based exam is graded on whether the cluster or system ends up in the requested state, not on how you got there. With 120 minutes for the whole task set, speed with the command line and the official documentation matters as much as knowledge: do the quick tasks first and come back to the slow ones.

Treat the table as the single source for numbers on this page. If a row says the Linux Foundation does not publish a value, we print that instead of guessing, and the official CKS page remains the final word on registration and policy.

How GoldenKube practice works for CKS

CKS is a performance-based exam, graded on real tasks in a terminal environment, and GoldenKube does not offer practice for it yet; terminal labs are planned. This page therefore covers the exam itself, with its official domains, weights and facts, and shows where CKS sits in the Golden Kubestronaut program, but it does not link to a practice session. For the other certifications in the program that do have a bank, GoldenKube works as a practice loop: one question at a time, instant feedback with an explanation, adaptive ordering toward weak domains, spaced repetition for missed questions, and a mock exam mode. The first 10 answers need no sign-up, and after that a free account saves progress with no credit card. Until CKS is covered, prepare from the official curriculum and the project documentation.

• Read the official CKS curriculum and exam page for the authoritative domain list.
• Use the weights above to decide how much time each domain deserves.
• Practice on a real cluster or system in a terminal, since the exam is performance-based.

Where CKS sits in the Golden Kubestronaut path

CKS is one of the 5 core Kubestronaut certifications, and Golden Kubestronaut requires all 16 certifications in the program, so CKS is a required step. Its own prerequisites, per the Linux Foundation: Must have taken and passed the Certified Kubernetes Administrator (CKA) exam. The program page lists all 16 certifications side by side and marks which ones GoldenKube can practice today. KCSA supplies the security vocabulary that CKS asks you to apply on a live cluster, so the two make a natural pair. Several Golden exams, such as KCA for Kyverno and CCA for Cilium, return to the same controls in specific tools.

GoldenKube does not offer practice for CKS yet, but its KCSA bank covers the knowledge side of the same topics. The program page lists all sixteen certifications and which of them can be practiced today.

Frequently asked questions