thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Linux Foundation · Cybersecurity · Expert

Certified Kubernetes Security Specialist (CKS) exam guide

Exam CKS (Kubernetes v1.35)

The Certified Kubernetes Security Specialist (CKS) validates hands-on skills securing Kubernetes clusters and workloads across build, deploy and runtime: cluster hardening, system hardening, microservice security, supply chain security and runtime monitoring. It requires CKA first.

QuestionsSee official page
Time limit120 minutes
Passing score67%
Exam fee$445 USD
Valid for2 years
DeliveryOnline proctored (remote, PSI)

Format: Performance-based: solve security tasks on live clusters from a command line. Fee note: Includes one free retake and simulator sessions; bundles $625 with THRIVE-ONE or $645 with LFS260 course.

Who it's for

CKA holders working as platform security, DevSecOps or Kubernetes engineers.

What the exam covers

Cluster Setup15%
Cluster Hardening15%
System Hardening10%
Minimize Microservice Vulnerabilities20%
Supply Chain Security20%
Monitoring, Logging and Runtime Security20%

Eligibility & prerequisites

Required: Must have passed the CKA exam before attempting CKS.

Recommended: Strong Kubernetes administration plus Linux security fundamentals.

Keeping it active

Valid 2 years. Recertify by passing the exam again before expiry.

Skills & careers

Skills it validates

  • NetworkPolicies and CIS benchmark hardening
  • RBAC minimization and API server hardening
  • AppArmor, seccomp and kernel hardening
  • Pod Security Standards and admission control
  • Image scanning, signing and SBOM supply chain controls
  • Runtime detection with Falco and audit logging
  • Secrets encryption and mTLS concepts

Job roles

Kubernetes Security EngineerDevSecOps EngineerPlatform Security EngineerCloud Security EngineerSite Reliability Engineer

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1: Cluster setup and hardening - NetworkPolicies, kube-bench, ingress TLS, RBAC, API server flags
  2. Week 2: System hardening - AppArmor, seccomp, reducing host attack surface
  3. Week 3: Microservice vulnerabilities - Pod Security Admission, securityContext, secrets encryption, runtime classes
  4. Week 4: Supply chain - Trivy scanning, image policy, static analysis of manifests
  5. Week 5: Runtime security - Falco rules, audit policies; simulator sessions

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Practice editing static pod manifests for the API server without breaking the control plane
  • Know Falco rule output format and how to locate offending containers
  • Learn AppArmor profile loading and pod annotations/fields
  • Check that CKA is passed before purchasing; CKS cannot be taken without it
  • Note the CKS environment Kubernetes version may lag CKA's

Key terms for this exam

All 38 terms Study with thinQcards™

Frequently asked questions

Do I need CKA for CKS?

Yes, you must have passed CKA first.

How much is CKS?

$445 USD including one free retake.

What is the passing score?

67%.

How long is CKS valid?

Two years.

Is CKS hard?

Yes - it is considered the hardest of the three Kubernetes exams due to breadth and time pressure.

Official page: training.linuxfoundation.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.