CKS Cheat Sheet

#	Domain	Weight	Questions	Practice
1.0	Cluster Setup	15%	15	Practice →
2.0	Cluster Hardening	15%	21	Practice →
Total	30%	784

Domain

Weight

Questions

Practice

1.0

Cluster Setup

15%

Practice →

2.0

Cluster Hardening

15%

Practice →

Total

30%

784

Domain Quick Reference

1.0Cluster Setup

Apply NetworkPolicies, configure API server admission plugins, secure Ingress with TLS, and run kube-bench. The critical thing: verify your NetworkPolicy actually blocks traffic using kubectl exec between pods.

15%

Key concepts

✓Creating NetworkPolicy objects to restrict pod ingress and egress by namespace, label, and port
✓Enabling and configuring admission controllers such as NodeRestriction and PodSecurity admission on the API server
✓Hardening Ingress with TLS, and restricting access using NetworkPolicy or Ingress annotations
✓Running CIS benchmark tooling like kube-bench and remediating control plane and kubelet findings

Watch out for

⚠Writing a NetworkPolicy that selects pods but forgets a matching egress or ingress rule, leaving traffic default-allowed in the other direction
⚠Editing API server flags in a static pod manifest but not restarting the kubelet or verifying the change took effect
⚠Assuming a default-deny NetworkPolicy blocks all traffic cluster-wide, when it only affects pods selected in that namespace

2.0Cluster Hardening

Use kubectl auth can-i, RBAC RoleBindings, and kubelet --anonymous-auth=false to lock down API and node access. Get RBAC least privilege right, then upgrade control plane components with kubeadm upgrade.

15%

Key concepts

✓Minimising RBAC permissions by removing wildcards, cluster-admin bindings and unnecessary default ServiceAccount rights
✓Securing the kubelet API with authentication, authorization and read-only port disabled via kubelet config
✓Restricting API server access using anonymous-auth, authorization modes and network exposure controls
✓Performing safe cluster upgrades with kubeadm upgrade plan, apply and node drain/uncordon sequencing

Watch out for

⚠Leaving the kubelet read-only port 10255 open, or not disabling anonymous authentication on kubelet endpoints
⚠Granting cluster-admin or wildcard verbs in Role/ClusterRole instead of least-privilege rules scoped to resources
⚠Upgrading worker nodes before the control plane, or skipping kubeadm upgrade plan and etcd backups

Exam Day Reminders

→Read every question stem fully — look for qualifiers like 'MOST likely,' 'BEST,' or 'EXCEPT.'

→Flag uncertain questions and come back — don't waste time on one question.

→Eliminate obviously wrong options first, then choose between remaining ones.

→Trust your first instinct unless you have a specific reason to change.

→For CKS, scenarios typically have one clearly best answer — look for the option that matches the specific constraints in the question.

#	Domain	Weight	Questions	Practice
1.0	Cluster Setup	15%	15	Practice →
2.0	Cluster Hardening	15%	21	Practice →
Total	30%	784

Domain

Weight

Questions

Practice

1.0

Cluster Setup

15%

Practice →

2.0

Cluster Hardening

15%

Practice →

Total

30%

784

Domain Quick Reference

1.0Cluster Setup

15%

Key concepts

✓Creating NetworkPolicy objects to restrict pod ingress and egress by namespace, label, and port
✓Enabling and configuring admission controllers such as NodeRestriction and PodSecurity admission on the API server
✓Hardening Ingress with TLS, and restricting access using NetworkPolicy or Ingress annotations
✓Running CIS benchmark tooling like kube-bench and remediating control plane and kubelet findings

Watch out for

⚠Writing a NetworkPolicy that selects pods but forgets a matching egress or ingress rule, leaving traffic default-allowed in the other direction
⚠Editing API server flags in a static pod manifest but not restarting the kubelet or verifying the change took effect
⚠Assuming a default-deny NetworkPolicy blocks all traffic cluster-wide, when it only affects pods selected in that namespace

2.0Cluster Hardening

15%

Key concepts

✓Minimising RBAC permissions by removing wildcards, cluster-admin bindings and unnecessary default ServiceAccount rights
✓Securing the kubelet API with authentication, authorization and read-only port disabled via kubelet config
✓Restricting API server access using anonymous-auth, authorization modes and network exposure controls
✓Performing safe cluster upgrades with kubeadm upgrade plan, apply and node drain/uncordon sequencing

Watch out for

⚠Leaving the kubelet read-only port 10255 open, or not disabling anonymous authentication on kubelet endpoints
⚠Granting cluster-admin or wildcard verbs in Role/ClusterRole instead of least-privilege rules scoped to resources
⚠Upgrading worker nodes before the control plane, or skipping kubeadm upgrade plan and etcd backups

Exam Day Reminders

→Read every question stem fully — look for qualifiers like 'MOST likely,' 'BEST,' or 'EXCEPT.'

→Flag uncertain questions and come back — don't waste time on one question.

→Eliminate obviously wrong options first, then choose between remaining ones.

→Trust your first instinct unless you have a specific reason to change.

→For CKS, scenarios typically have one clearly best answer — look for the option that matches the specific constraints in the question.

CKS Exam Blueprint — At a Glance

Domain Quick Reference

1.0Cluster Setup

2.0Cluster Hardening

Exam Day Reminders

More CKS resources

CKS Cheat Sheet

CKS Exam Blueprint — At a Glance

Domain Quick Reference

1.0Cluster Setup

2.0Cluster Hardening

Exam Day Reminders

More CKS resources