Certified Kubernetes Security Specialist: exam-style tasks on a real kubeadm cluster on your own Mac, built and graded by the GoldenKube CLI. Each card shows the domain, the cluster topology it needs, the recommended time and its points; the scenario page has the full task text. Scenarios run on Kubernetes 1.35, the version the CKS exam is based on (one minor version behind CKA and CKAD).
CKS is for "an accomplished Kubernetes practitioner (as evidenced by holding the CKA credential)": the Linux Foundation requires that you "must have taken and passed the Certified Kubernetes Administrator (CKA) exam prior to attempting the CKS exam", and the exam is based on Kubernetes v1.35, not the v1.37 of CKA and CKAD. The GoldenKube CKS scenarios therefore assume CKA skills and go to the places a security task touches: API server flags and static Pod manifests, the kubelet configuration on a worker, etcd encryption, AppArmor on the node, and audit logs.
They follow the six official domains: default-deny NetworkPolicies, blocking the metadata endpoint and kubelet CIS hardening (cluster setup); least-privilege RBAC, ServiceAccount tokens and API server authorization (cluster hardening); AppArmor and a node with a rogue service (system hardening); Pod Security Admission, Secrets encrypted at rest and as read-only volumes, and removing host namespaces (microservice vulnerabilities); permitted registries with a ValidatingAdmissionPolicy, static analysis, image digests and binary verification (supply chain); and audit policies, immutable containers and finding a crypto-miner (monitoring, logging and runtime security). Some of them need a second node, which the CLI provisions for that scenario.
| Questions | 15-20 performance-based tasks source |
|---|---|
| Duration (minutes) | 120 source |
| Passing score | 67% source |
| Price (USD) | 445 source |
| Validity (years) | 2 source |
| Delivery | Online, proctored, performance-based (command line) source |
| Prerequisites | Must have taken and passed the Certified Kubernetes Administrator (CKA) exam source |
| Retake policy | One retake per exam purchase if a passing score is not achieved source |
| Curriculum version | Based on Kubernetes v1.35 source |
Published scenarios per official CKS domain, next to the domain's exam weight (checked 2026-10-28 on the official page). 20 published scenarios today.
| Domain | Exam weight | Published scenarios |
|---|---|---|
| Cluster Setup | 15% | 3 |
| Cluster Hardening | 15% | 3 |
| System Hardening | 10% | 2 |
| Minimize Microservice Vulnerabilities | 20% | 4 |
| Supply Chain Security | 20% | 4 |
| Monitoring, Logging and Runtime Security | 20% | 4 |
goldenkube exam cks draws a curriculum-weighted set: 15 tasks in 120 minutes, pass at 67%. Solutions and hints are hidden in exam mode.
4 of 20 scenarios match · Clear filters
The API server authorizes every request and lets kubelets edit any node; restore Node,RBAC authorization and the NodeRestriction admission plugin.
Single node · ~9 min · 8 points
goldenkube start cks-hrd-003
Write an EncryptionConfiguration, wire it into the API server static pod and rewrite an existing Secret so etcd holds it encrypted.
Single node · ~10 min · 8 points
goldenkube start cks-mic-002
Write an audit policy with per-resource levels and wire it into the API server static pod with log rotation.
Single node · ~10 min · 9 points
goldenkube start cks-run-001
Allow only images from one registry in labelled namespaces using a CEL ValidatingAdmissionPolicy and its binding.
Single node · ~9 min · 9 points
goldenkube start cks-sup-001
goldenkube doctor.goldenkube login (free account).goldenkube submit; the result appears on your dashboard.Grading happens on your machine and is practice feedback, not an official score. Tasks are public; hints, reference solutions and grader internals are not.
Not yet. The CKS scenarios are published and readable here, but the first signed build of the CLI is not on the Homebrew tap, so the catalog is a preview. Running a scenario needs that release and a free account.
Because the official CKS page states that the exam is based on Kubernetes v1.35, while CKA and CKAD are based on v1.37. GoldenKube sets up CKS scenarios on Kubernetes 1.35 clusters so that flags and defaults match the exam version.
Not to use the labs. The CKA requirement applies to booking the CKS exam: the Linux Foundation requires a passed CKA first. The CKS tasks assume CKA-level cluster skills, so the CKA catalog is the natural place to start.