CNCF certification practice
Practise Certified Kubernetes Security Specialist CKS practice test — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps. Courseiva helps you prepare with realistic practice questions, topic-based revision, explained answers and structured study routes.
New here? Start with this
Recommended: 10-question diagnostic
Covers all 8 domains · takes ~5 min · no account needed · shows your weak areas immediately
Key facts for the Certified Kubernetes Security Specialist CKS exam.
Exam cost
$395 USD / ~£315
Duration
2 hours
Question count
15–20 performance-based tasks
Passing score
67%
Validity
3 years
Delivered by
The Linux Foundation (PSI Online)
Online proctored
Yes — available
Retake policy
100% free — no account required
Everything on Courseiva for CKS is free — no subscription, no trial, no email wall.
Courseiva provides free Certified Kubernetes Security Specialist CKS (CKS) practice questions with original exam-style questions, detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics. Courseiva is an independent platform and is not affiliated with CNCF.
One free retake included; subsequent retakes require repurchase
Question formats
The Certified Kubernetes Security Specialist (CKS) is an advanced, performance-based certification from the CNCF and The Linux Foundation that validates deep expertise in securing Kubernetes environments. It covers cluster hardening, system hardening, minimising microservice vulnerabilities, supply chain security, monitoring and threat detection, and runtime security. A valid CKA certification is a mandatory prerequisite. Candidates must solve complex, security-focused tasks in a live Kubernetes cluster under time pressure, making the CKS the most demanding of all CNCF certifications.
Official prerequisite
Active CKA (Certified Kubernetes Administrator) certification required at time of exam registration
Recommended experience
At least 12 months of Kubernetes experience in production plus familiarity with Linux security tools (Falco, OPA/Gatekeeper, Trivy, AppArmor, seccomp)
Certified Kubernetes Administrators looking to specialise in security, or security engineers already working with Kubernetes at scale
Should you skip this exam?
Anyone who does not yet hold an active CKA — the CKS is gated on that prerequisite and assumes deep Kubernetes administration knowledge
Courseiva study tip
Build a personal lab with Falco, OPA Gatekeeper, Trivy, and AppArmor profiles running. The exam tasks are complex and multi-step — practice chaining security controls together, not just individual tools.
UK salary range
£75,000 – £110,000
US salary range
$130,000 – $185,000
Job roles that cite CKS
What certification to take next
The CKS costs $395 USD and includes one free retake. You must already hold a valid CKA to register — that is a hard prerequisite enforced at checkout.
You need at least 67% to pass the CKS. Results are typically released within 24 hours of completing the exam.
Yes — an active CKA is a mandatory, enforced prerequisite for the CKS. You cannot register without it. If your CKA has expired, you must renew it first.
The CKS covers cluster setup and hardening (~15%), cluster hardening (~15%), system hardening (~10%), minimising microservice vulnerabilities (~20%), supply chain security (~20%), and monitoring, logging, and runtime security (~20%). All tasks are performed in a live Kubernetes environment.
The CKS is significantly harder than the CKA. It requires both deep Kubernetes administration knowledge (assumed from the CKA) and additional expertise in Linux security primitives, image scanning, policy enforcement, and runtime threat detection. Most candidates who pass the CKA still need 120+ hours of dedicated study for the CKS.
The CKS is valid for 3 years. You must maintain a valid CKA to remain eligible for CKS renewal.
Key tools include Falco (runtime security), OPA/Gatekeeper (policy enforcement), Trivy (image vulnerability scanning), AppArmor and seccomp (OS-level sandboxing), NetworkPolicies, PodSecurity admission, and Kubernetes RBAC hardening. Expect hands-on tasks with all of these.
See how CKS stacks up against related certifications.
Practice modes
Choose a mode that matches your current study phase. Use topic practice early on and mock exams closer to your exam date.
All CKS Questions
Browse the full question bank organised by domain and difficulty.
Practice Test
Start a session with detailed answer explanations after each question.
Mock Exam
Simulate the real exam with a timed, full-length question set.
Quick 10
A 10-question warm-up — ideal for a short daily study session.
Flashcards
Reinforce key terms, commands, and protocol facts with flashcards.
Domain Practice
Focus exclusively on one exam domain to target your weakest area.
50-Question Set
Mid-length practice set covering all domains.
Full-length Simulation
Full exam simulation matching the real question count.
Exam guide
Start with a short practice session, review each missed answer, then return to the topics that caused mistakes.
Certified Kubernetes Security Specialist CKS questions test whether you can apply the concept in context, not just recognise a definition.
How the topic appears in realistic exam-style scenarios.
Which detail in the question changes the correct answer.
How to eliminate plausible but wrong options.
How to connect the question back to the wider exam objective.
Related practice questions
Use these internal links to move from the exam guide into focused topic practice pages.
Practise CKS questions linked to Monitoring Logging and Runtime Security.
Practise CKS questions linked to Cluster Setup and Hardening.
Practise CKS questions linked to System Hardening.
Practise CKS questions linked to Minimize Microservice Vulnerabilities.
Practise CKS questions linked to Supply Chain Security.
Practise CKS questions linked to Monitoring, Logging and Runtime Security.
Practise CKS questions linked to Cluster Setup.
Practise CKS questions linked to Cluster Hardening.
Practise CKS questions linked to CKS fundamentals.
Practise CKS questions linked to CKS scenario.
Practise CKS questions linked to CKS troubleshooting.
Practice directory
Every practice set is a unique selection of questions — numbered tests, domain-focused sessions, and topic-specific quizzes.
Showing 30 of 64 tests. See all 64 CKS practice tests →
Timed mode
Official blueprint
Target weak areas by practising questions from a single domain. Each domain page shows all questions, difficulty breakdown, and a focused practice session.
Practise CKS questions in this domain →
Practise CKS questions in this domain →
Practise CKS questions in this domain →
Practise CKS questions in this domain →
Practise CKS questions in this domain →
Practise CKS questions in this domain →
Practise CKS questions in this domain →
Practise CKS questions in this domain →
Term reference
These terms appear frequently in CKS questions. Understanding them precisely reduces guessing and improves scores.
Falco Runtime Security
Falco Runtime Security is an open-source tool that continuously monitors system and container behavior to detect unexpected or malicious activities.
Admission Controllers
Admission controllers are plugins that intercept and process requests to the Kubernetes API server after authentication and authorization, but before the request is persisted, allowing policies to be enforced on objects being created, modified, or deleted.
AppArmor Profiles
AppArmor Profiles are security policies that restrict the system resources and actions a program can access, acting like a permission badge for software.
OPA Gatekeeper
OPA Gatekeeper is a Kubernetes admission controller that enforces custom security and compliance policies on resources before they are created or updated in a cluster.
TLS Certificate Management
TLS Certificate Management is the process of creating, deploying, renewing, and revoking digital certificates that encrypt communication between computers over a network.
Service Account Hardening
Service Account Hardening is the set of security practices to restrict and protect Kubernetes service accounts from unauthorized access or misuse.
Image Signing and Verification
Image signing and verification is the process of digitally signing a container image to prove its origin and integrity, and then checking that signature before using the image to ensure it was not tampered with.
Seccomp Profiles
Seccomp profiles are security filters that restrict which system calls a containerized application can make to the Linux kernel, reducing the attack surface.
Free study guide
The Courseiva CKS study guide covers exam format, the official domain blueprint with weights, a structured study plan, and domain-specific tips for each section. Use it alongside practice questions to build both conceptual depth and exam confidence.
Sample questions
Select your answer before revealing the explanation. These questions are original exam-style — not copied from any exam or dump site.
Drag a concept onto its matching description — or click a concept then click the description.
Encrypts communication between etcd clients and the etcd server
Encrypts communication between etcd cluster members
Requires clients to present a valid certificate to access etcd
Encrypts etcd data stored on disk (requires manual configuration)
Limits which users or clients can perform operations on etcd keys
Drag a concept onto its matching description — or click a concept then click the description.
Admission controller that enforces security constraints on pods
Defines how groups of pods can communicate with each other and other network endpoints
Role-based access control for authorization within the cluster
Linux security facility to restrict system calls from a container
Mandatory access control system that confines programs to a limited set of resources
Drag a concept onto its matching description — or click a concept then click the description.
Checks whether Kubernetes is deployed securely according to CIS benchmarks
Penetration testing tool for Kubernetes clusters
Policy engine for enforcing custom policies on Kubernetes resources
Runtime security monitoring tool that detects abnormal behavior
Vulnerability scanner for container images, filesystems, and Git repos
Drag a concept onto its matching description — or click a concept then click the description.
Used by kubelet to serve the kubelet API (e.g., exec, logs)
Used by kubelet to authenticate to the API server
Used by the API server to serve HTTPS endpoints
Used to sign service account tokens so they can be verified
Used by an administrator to authenticate to the cluster with full privileges
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.