Certified Kubernetes Security Specialist (CKS)

The CKS was created by the Linux Foundation and the Cloud Native Computing Foundation (CNCF) as a part of their ongoing effort to help develop the Kubernetes ecosystem. The exam is online, proctored, performance-based test that requires solving multiple tasks from a command line running Kubernetes.

Proven security & Kubernetes skills are a career door opener! Show off your skills with this globally recognized, vendor-neutral certification.

Obtaining the CKS validates your in-demand cloud security skills, accelerates your career advancement, delivers industry-wide recognition of your professional credentials, and opens up valuable networking opportunities within the cloud security community.

Cluster Setup - 15%

Use Network security policies to restrict cluster level access

Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)

Properly set up Ingress with TLS

Protect node metadata and endpoints

Verify platform binaries before deploying

Cluster Hardening - 15%

Use Role Based Access Controls to minimize exposure

Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones

Restrict access to Kubernetes API

Upgrade Kubernetes to avoid vulnerabilities

System Hardening - 10%

Minimize host OS footprint (reduce attack surface)

Using least-privilege identity and access management

Minimize external access to the network

Appropriately use kernel hardening tools such as AppArmor, seccomp

Minimize Microservice Vulnerabilities - 20%

Use appropriate pod security standards

Manage Kubernetes secrets

Understand and implement isolation techniques (multi-tenancy, sandboxed containers, etc.)

Implement Pod-to-Pod encryption (Cilium, Istio)

Supply Chain Security - 20%

Minimize base image footprint

Understand your supply chain (e.g. SBOM, CI/CD, artifact repositories)

Secure your supply chain (permitted registries, sign and validate artifacts, etc.)

Perform static analysis of user workloads and container images (e.g. Kubesec, KubeLinter)

Monitoring, Logging and Runtime Security - 20%

Perform behavioral analytics to detect malicious activities

Detect threats within physical infrastructure, apps, networks, data, users and workloads

Investigate and identify phases of attack and bad actors within the environment

Ensure immutability of containers at runtime

Use Kubernetes audit logs to monitor access

The exam is based on Kubernetes v1.35

The CKS exam environment will be aligned with the most recent K8s minor version within approximately 4 to 8 weeks of the K8s release date.

How to register & take exam: TBC (Link to FAQ pages of the website)

Candidate Handbook: https://docs.linuxfoundation.org/tc-docs/certification/lf-handbook2

Curriculum Overview: https://github.com/cncf/curriculum/blob/master/CKS_Curriculum%20v1.34.pdf

Exam Tips: https://docs.linuxfoundation.org/tc-docs/certification/important-instructions-cks

Frequently Asked Questions: https://docs.linuxfoundation.org/tc-docs/certification/faq-cka-ckad-cks

Linux Foundation Global Certification and Confidentiality Agreement: https://docs.linuxfoundation.org/tc-docs/certification/lf-cert-agreement

Verify Certification: https://training.linuxfoundation.org/certification/verify/