LINUX FOUNDATIONCertified Kubernetes Security Specialist (CKS)
The Certified Kubernetes Security Specialist (CKS) certification validates advanced, hands-on skills in securing Kubernetes clusters and cloud-native workloads. Designed for experienced Kubernetes practitioners, it covers cluster hardening, supply chain security, and runtime threat detection. Earning CKS proves you can implement and maintain robust security controls in production environments, making you a valuable asset for security-focused DevOps and SRE roles.
566 practice questions · Updated 2026-07-30
6Domains
26Objectives
179Concepts
566Questions
CKS Curriculum
Every domain, objective, and concept the CKS exam measures.
- CIS Benchmark Overview
- Reviewing etcd Security
- Reviewing kubelet Security
- Reviewing kube-apiserver Security
- Reviewing kube-dns/CoreDNS Security
- Verifying Platform Binaries
- Upgrading Kubernetes
- NetworkPolicy fundamentals
- Default deny and allow rules
- NetworkPolicy namespace isolation
- Ingress TLS termination
- Ingress TLS secrets management
- Ingress annotations and TLS options
- Node metadata protection
- Kubernetes API endpoint protection
- Pod-to-pod encryption with Cilium
- Pod-to-pod encryption with Istio
- mTLS policy enforcement
- RBAC Role and RoleBinding
- RBAC ClusterRole and ClusterRoleBinding
- RBAC Principle of Least Privilege
- Service Account Defaults
- Service Account Permissions
- Service Account Token Management
- API Server Authentication Methods
- API Server Authorization Modes
- API Server Network Restrictions
- Kubeconfig and Context Security
- Pod Security Standards
- Pod Security Admission
- Pod Security Contexts
- Secrets Management
- Secret Encryption at Rest
- Secret Security Best Practices
- Namespace-Based Isolation
- Network Policies for Isolation
- Sandboxed Containers
- RuntimeClass for Isolation
- Multi-Tenancy Strategies
- Base image selection
- Image size reduction techniques
- Scanning for vulnerabilities
- Using minimal runtime dependencies
- Avoiding unnecessary layers
- Leveraging distroless images
- Pinning base image versions
- Regularly updating base images
- SBOM basics
- SBOM generation and formats
- SBOM verification and use
- CI/CD pipeline security
- Artifact repository security
- Supply chain attack vectors
- Trust and provenance
- Permitted Registries
- Image Signing and Verification
- Image Vulnerability Scanning
- Supply Chain Security Policies
- Static analysis fundamentals
- Kubesec usage
- KubeLinter usage
- Analyzing container images
- Integrating static analysis into CI/CD
- Interpreting and remediating findings
- Understand host OS footprint
- Identify unnecessary components
- Apply minimal base images
- Harden host OS configuration
- Use immutable infrastructure
- Monitor and audit host changes
- RBAC Role and RoleBinding
- ClusterRole and ClusterRoleBinding
- ServiceAccount creation and configuration
- Binding ServiceAccounts to Roles
- Least-privilege permission assignment
- Default ServiceAccount restriction
- RBAC verification and testing
- Network Policies
- Default Deny Ingress
- Default Deny Egress
- Allow Specific Ingress Rules
- Allow Specific Egress Rules
- Namespace Isolation
- Pod-to-Pod Communication Control
- External Traffic Restriction
- NetworkPolicy Testing and Validation
- AppArmor fundamentals
- AppArmor profiles
- Applying AppArmor in Kubernetes
- seccomp fundamentals
- seccomp profiles
- Applying seccomp in Kubernetes
- Troubleshooting kernel hardening
- Behavioral Analytics Fundamentals
- Kubernetes Audit Logs
- Audit Log Analysis
- Runtime Security Monitoring
- Threat Detection Techniques
- Incident Response and Remediation
- Threat detection fundamentals
- Physical infrastructure threat detection
- Application threat detection
- Network threat detection
- Data threat detection
- User threat detection
- Workload threat detection
- Attack phases in Kubernetes
- Kubernetes threat actors
- Attack surface mapping
- Indicators of compromise (IoCs)
- Forensic investigation techniques
- Immutable container filesystems
- Read-only root filesystem enforcement
- Ephemeral storage for writable layers
- Runtime security policies for immutability
- Verifying container immutability
- Audit logging fundamentals
- Audit policy configuration
- Audit log backend setup
- Audit log analysis
- Monitoring access patterns
- Understand host OS footprint
- Identify unnecessary services and packages
- Disable and remove unnecessary services
- Apply security updates and patches
- Harden kernel parameters
- Use minimal base images
- Restrict host access
- Principle of Least Privilege
- Kubernetes RBAC Authorization
- Service Account Management
- Role and ClusterRole Definitions
- RoleBinding and ClusterRoleBinding
- Least-Privilege Namespace Design
- Auditing and Monitoring Access
- Avoiding Privilege Escalation
- NetworkPolicy
- Default Deny
- Namespace Isolation
- External Traffic Control
- Ingress and Egress Rules
- Policy Testing
- AppArmor profiles
- Loading AppArmor profiles
- Applying AppArmor in Kubernetes
- seccomp profiles
- Applying seccomp in Kubernetes
- Default seccomp profiles
- Troubleshooting kernel hardening
- Falco rule syntax
- Falco event sources
- Detecting malicious container activity
- Kubernetes audit log analysis
- Behavioral analytics with Falco
- Falco configuration and deployment
- Responding to detected threats
- Threat Detection Fundamentals
- Physical Infrastructure Monitoring
- Application Threat Detection
- Network Threat Detection
- Data Threat Detection
- User and Identity Threat Detection
- Workload Threat Detection
- Phases of Attack
- Bad Actor Identification
- Attack Indicators
- Investigation Techniques
- Environment Context
- Container Immutability Principle
- Read-Only Root Filesystem
- EmptyDir for Writable Areas
- Security Contexts for Immutability
- Verifying Runtime Immutability
- Audit logging architecture
- Audit policy configuration
- Audit log backends
- Enabling audit logging
- Interpreting audit events
- Monitoring access with audit logs
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for CKS, so none is invented.