KCSA vs CKS: which certification should you take first?

KCSA and CKS side by side

Values are read from official Linux Foundation pages; each has a source link and the check date. Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation.

How KCSA and CKS differ

KCSA (Kubernetes and Cloud Native Security Associate) is a multiple-choice exam in the Kubestronaut core group of the Golden Kubestronaut program, and CKS (Certified Kubernetes Security Specialist) is a performance-based, hands-on exam in the Kubestronaut core group. They are tested in different ways, which changes how you prepare as much as what you study. KCSA: Multiple-choice exam on the baseline security knowledge for Kubernetes and cloud native environments: cluster components, threat model, platform security and compliance. CKS: Performance-based exam on securing container-based applications and Kubernetes platforms across build, deployment and runtime. The table above sets format, questions, duration, passing score, price, validity, prerequisites and the number of domains side by side, each value read from the official Linux Foundation pages and dated.

A multiple-choice exam rewards knowing the concepts and recognising the correct statement among plausible ones. A hands-on exam rewards doing the task in a live terminal within the time limit. Few people prepare for both in the same way.

What KCSA and CKS cover

KCSA is organised into 6 domains and CKS into 6. The heaviest KCSA domain is Kubernetes Cluster Component Security (22%), while the heaviest CKS domain is Minimize Microservice Vulnerabilities (20%). Domain weights come straight from each official certification page and show where the Linux Foundation expects most of your preparation time to go. If your own work sits mainly in one heavy domain of an exam, that exam will feel closer to your daily job; if the heavy domains are unfamiliar, plan more study time for that exam. The lists below give every domain with its weight, checked against the official pages on the date shown at the top of this page.

• KCSA: Overview of Cloud Native Security, 14% of the exam
• KCSA: Kubernetes Cluster Component Security, 22% of the exam
• KCSA: Kubernetes Security Fundamentals, 22% of the exam
• KCSA: Kubernetes Threat Model, 16% of the exam
• KCSA: Platform Security, 16% of the exam
• KCSA: Compliance and Security Frameworks, 10% of the exam
• CKS: Cluster Setup, 15% of the exam
• CKS: Cluster Hardening, 15% of the exam
• CKS: System Hardening, 10% of the exam
• CKS: Minimize Microservice Vulnerabilities, 20% of the exam
• CKS: Supply Chain Security, 20% of the exam
• CKS: Monitoring, Logging and Runtime Security, 20% of the exam

Who should take KCSA

KCSA suits people who need a security foundation for Kubernetes without terminal tasks. It covers the overview of cloud native security, cluster component security, Kubernetes security fundamentals, the threat model, platform security, and compliance and security frameworks. It fits security analysts, auditors, developers and platform engineers who need to speak about risk accurately. KCSA is a multiple-choice exam with 6 domains, led by Kubernetes Cluster Component Security (22%), and it sits in the Kubestronaut core group of the program. The table above gives its questions, duration, passing score, price and validity with their sources. Choosing is easier when you compare the domain list with the work you actually did in the last month, and the official certification page remains the place to confirm the current curriculum before you book.

• You work in security or compliance around Kubernetes.
• You want the threat model and frameworks, not command-line tasks.
• You want a first security certification before the hands-on one.
• Your role is to review designs, not harden nodes.

Who should take CKS

CKS suits people who configure and defend clusters themselves. It is performance-based and covers cluster setup and hardening, system hardening, minimising microservice vulnerabilities, supply chain security, and monitoring, logging and runtime security. Since it lists a passed CKA as its prerequisite, it is a later step for administrators who want proof of practical security skill. CKS is a performance-based, hands-on exam with 6 domains, led by Minimize Microservice Vulnerabilities (20%), and it sits in the Kubestronaut core group of the program. The table above gives its questions, duration, passing score, price and validity with their sources. Choosing is easier when you compare the domain list with the work you actually did in the last month, and the official certification page remains the place to confirm the current curriculum before you book.

• You harden clusters, nodes and workloads yourself.
• You have passed CKA, which CKS lists as its prerequisite.
• You work on supply chain and runtime security.
• You want a hands-on credential rather than a conceptual one.

Can you take both, and in which order?

You can take both, and both are in the program. KCSA has no listed prerequisite and can be taken any time. CKS requires a passed CKA, so the realistic route to CKS is KCNA or KCSA for concepts, then CKA, then CKS. KCSA first is a good preparation step because CKS tasks are easier when you already understand why each control exists, but the Linux Foundation does not require it. Prerequisites as published by the Linux Foundation: KCSA: None. CKS: Must have taken and passed the Certified Kubernetes Administrator (CKA) exam. Each is listed as its own certification in the program, so passing one never counts toward the other. Whichever you choose first, book the exam only when you can answer questions across every domain, not just the heaviest one.

Treat KCSA as the why and CKS as the how. Studying the KCSA threat model gives you reasons for the controls you will later apply by hand in CKS tasks.

How GoldenKube helps with KCSA and CKS

GoldenKube is a free practice app for the multiple-choice certifications in the Golden Kubestronaut program. KCSA has a live GoldenKube question bank: every question comes with an explanation, you get instant feedback, and questions you miss come back for review until you have mastered them. CKS is a hands-on exam. GoldenKube offers practice only for multiple-choice exams, so there is no CKS practice here; terminal labs are planned but not available. You get 10 free guest answers, then a free account; no credit card is needed. Practice does not replace the official curriculum, and passing practice questions does not guarantee a pass on the real exam.

KCSA has a live question bank here. CKS has none, since GoldenKube covers only multiple-choice exams; for CKS, use the official curriculum and a real cluster once CKA is behind you.

Verdict: KCSA or CKS first?

Take KCSA first for the security concepts; it has no prerequisite and is multiple-choice. Take CKS later, after CKA, when you want to prove practical hardening skill. KCSA is useful preparation for CKS but does not replace CKA as its prerequisite.

Next steps

• KCSA

  Practice questions available

  Practice KCSAKCSA certification page

• CKS

  Not offered (hands-on exam; labs planned)

  CKS certification page

GoldenKube offers practice only for multiple-choice exams. The hands-on certification pages are informational.

Frequently asked questions

Sources

• KCSA certification page (Linux Foundation), checked 23 Oct 2026
• CKS certification page (Linux Foundation), checked 23 Oct 2026