Module 00 · Lesson 01
Course Overview
What the CKS is, what it demands of you, and what this course covers.
- Describe what the CKS exam tests and how it differs from the CKA.
- State the prerequisite the certification itself imposes.
- Explain the three-stage lab structure this course is built around.
What the CKS actually is
The Certified Kubernetes Security Specialist is a two-hour, performance-based exam. There are no multiple-choice questions. You are given a terminal against real clusters and asked to do things: write a NetworkPolicy, fix an over-permissive Role, load an AppArmor profile, find out who deleted something from an audit log.
It assumes you already know Kubernetes. The CKA is a hard prerequisite, and not just an administrative one: you have to hold a valid CKA before you are allowed to sit this exam. Nothing in this course re-teaches pods, deployments or services.
Most of the individual controls are a few lines of YAML. The difficulty is that the exam gives you a cluster in an unknown state and a clock. Knowing what a NetworkPolicy is takes an afternoon. Being able to write a correct one in four minutes, on a cluster where someone has already left a broken one in place, is a different skill, and it is the one being measured.
Six domains, weighted
The curriculum splits into six domains. The percentages are not decoration: they are roughly how much of the exam each one is worth, and they should drive how you spend your time.
| Domain | Weight | Roughly |
|---|---|---|
| Cluster Setup | 10% | Network policy, CIS benchmarks, Ingress TLS, node metadata |
| Cluster Hardening | 15% | API access, RBAC, service accounts, upgrades, secrets |
| System Hardening | 15% | The Linux host: footprint, kernel, identity, seccomp, AppArmor |
| Minimize Microservice Vulnerabilities | 20% | Namespaces, policy, Pod Security Standards, runtime, mTLS |
| Supply Chain Security | 20% | Images, signing, manifest analysis, scanning |
| Monitoring, Logging & Runtime Security | 20% | Falco, threat detection, audit logs |
Three domains carry 20% each. Together, microservice vulnerabilities, supply chain and runtime security are 60% of the exam. Cluster Setup, which is where most people start reading, is 10%.
Weightings and topics change as Kubernetes releases. This course tracks the CNCF certification page, which is the authoritative source. Read it once before you book, and again before you sit.
How this course is built
One lesson per curriculum subdomain, in curriculum order, so nothing on the blueprint is missing and nothing extra is padding it out. Each domain closes with a production-notes lesson covering what changes when a cloud provider runs half your cluster, which is not examinable but is the reason any of this matters after the certificate.
Behind each lesson are three hands-on labs in a fresh cluster: one to learn the control, one to perform it under exam conditions, and one where it is already broken and lying to you.
You have three weeks and want to allocate study time by return on effort. Where do the biggest wins sit?
Those three are 60% of the exam between them. Cluster Setup is worth 10% and is where most study plans over-invest, purely because it appears first in the blueprint.
Why does this course assume you can already deploy and debug a workload?
The certification enforces this: you cannot sit the CKS without an active CKA. Time spent here re-covering deployments is time taken from the six domains you are actually assessed on.
The CKS is a two-hour practical exam over six weighted domains, sat on top of a CKA you already hold. Sixty percent of it is microservice vulnerabilities, supply chain and runtime security. Next: what the exam environment is like and how it is scored.