CCA vs CKS: which certification should you take first?

CCA and CKS side by side

Values are read from official Linux Foundation pages; each has a source link and the check date. Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation.

How CCA and CKS differ

CCA (Cilium Certified Associate) is a multiple-choice exam in the Golden requirement group of the Golden Kubestronaut program, and CKS (Certified Kubernetes Security Specialist) is a performance-based, hands-on exam in the Kubestronaut core group. They are tested in different ways, which changes how you prepare as much as what you study. CCA: Multiple-choice exam on Cilium architecture, network policy, service mesh, Hubble observability, Cluster Mesh, eBPF and BGP. CKS: Performance-based exam on securing container-based applications and Kubernetes platforms across build, deployment and runtime. The table above sets format, questions, duration, passing score, price, validity, prerequisites and the number of domains side by side, each value read from the official Linux Foundation pages and dated.

A multiple-choice exam rewards knowing the concepts and recognising the correct statement among plausible ones. A hands-on exam rewards doing the task in a live terminal within the time limit. Few people prepare for both in the same way.

What CCA and CKS cover

CCA is organised into 8 domains and CKS into 6. The heaviest CCA domain is Architecture (20%), while the heaviest CKS domain is Minimize Microservice Vulnerabilities (20%). Domain weights come straight from each official certification page and show where the Linux Foundation expects most of your preparation time to go. If your own work sits mainly in one heavy domain of an exam, that exam will feel closer to your daily job; if the heavy domains are unfamiliar, plan more study time for that exam. The lists below give every domain with its weight, checked against the official pages on the date shown at the top of this page.

• CCA: Architecture, 20% of the exam
• CCA: Network Policy, 18% of the exam
• CCA: Service Mesh, 16% of the exam
• CCA: Network Observability, 10% of the exam
• CCA: Installation and Configuration, 10% of the exam
• CCA: Cluster Mesh, 10% of the exam
• CCA: eBPF, 10% of the exam
• CCA: BGP and External Networking, 6% of the exam
• CKS: Cluster Setup, 15% of the exam
• CKS: Cluster Hardening, 15% of the exam
• CKS: System Hardening, 10% of the exam
• CKS: Minimize Microservice Vulnerabilities, 20% of the exam
• CKS: Supply Chain Security, 20% of the exam
• CKS: Monitoring, Logging and Runtime Security, 20% of the exam

Who should take CCA

CCA suits people who run or evaluate Cilium as their networking layer. It covers Cilium architecture, network policy, service mesh, Hubble observability, Cluster Mesh, eBPF and BGP. It is multiple-choice, so it tests understanding rather than terminal speed, and fits network and platform engineers who want to prove they understand how Cilium works. CCA is a multiple-choice exam with 8 domains, led by Architecture (20%), and it sits in the Golden requirement group of the program. The table above gives its questions, duration, passing score, price and validity with their sources. Choosing is easier when you compare the domain list with the work you actually did in the last month, and the official certification page remains the place to confirm the current curriculum before you book.

• Cilium is your CNI or a candidate for it.
• You work on network policy, observability or multi-cluster connectivity.
• You are curious about eBPF-based networking.
• You prefer multiple-choice over live tasks.

Who should take CKS

CKS suits people who secure Kubernetes platforms in practice. It is performance-based and covers cluster setup, cluster hardening, system hardening, minimising microservice vulnerabilities, supply chain security, and monitoring, logging and runtime security. It lists a passed CKA as its prerequisite, so it is a later step for people who already administer clusters. CKS is a performance-based, hands-on exam with 6 domains, led by Minimize Microservice Vulnerabilities (20%), and it sits in the Kubestronaut core group of the program. The table above gives its questions, duration, passing score, price and validity with their sources. Choosing is easier when you compare the domain list with the work you actually did in the last month, and the official certification page remains the place to confirm the current curriculum before you book.

• You are responsible for hardening and securing clusters.
• You have already passed CKA, which CKS lists as its prerequisite.
• You want to demonstrate security skills under live conditions.
• You work on supply chain or runtime security.

Can you take both, and in which order?

You can take both. CCA has no listed hard prerequisite, only a recommendation of Kubernetes and basic networking knowledge. CKS requires having passed CKA first, so CKS is possible only after that exam. CCA is therefore the easier one to schedule at any point, and many people fit it in while they work toward CKA and CKS. Both are needed for Golden Kubestronaut. Prerequisites as published by the Linux Foundation: CCA: None (page recommends Kubernetes and basic networking knowledge). CKS: Must have taken and passed the Certified Kubernetes Administrator (CKA) exam. Each is listed as its own certification in the program, so passing one never counts toward the other. Whichever you choose first, book the exam only when you can answer questions across every domain, not just the heaviest one.

Network policy appears in both exams, so studying CCA first can reinforce CKS networking topics later. The two have different formats though, and CCA does not substitute for hands-on security practice.

How GoldenKube helps with CCA and CKS

GoldenKube is a free practice app for the multiple-choice certifications in the Golden Kubestronaut program. CCA has a live GoldenKube question bank: every question comes with an explanation, you get instant feedback, and questions you miss come back for review until you have mastered them. CKS is a hands-on exam. GoldenKube offers practice only for multiple-choice exams, so there is no CKS practice here; terminal labs are planned but not available. You get 10 free guest answers, then a free account; no credit card is needed. Practice does not replace the official curriculum, and passing practice questions does not guarantee a pass on the real exam.

CCA has a live question bank, so Cilium preparation can be practised here. CKS cannot be practised on GoldenKube; the KCSA bank covers the security concepts that sit underneath it.

Verdict: CCA or CKS first?

Take CCA whenever Cilium is part of your stack; it has no hard prerequisite and a multiple-choice format. Take CKS only after CKA, when you are ready for a hands-on security exam. They are not alternatives: Golden Kubestronaut requires both, so the order is set mostly by what CKS needs.

Next steps

• CCA

  Practice questions available

  Practice CCACCA certification page

• CKS

  Not offered (hands-on exam; labs planned)

  CKS certification page

GoldenKube offers practice only for multiple-choice exams. The hands-on certification pages are informational.

Frequently asked questions

Sources

• CCA certification page (Linux Foundation), checked 23 Oct 2026
• CKS certification page (Linux Foundation), checked 23 Oct 2026