CKAD study guide · 2026

The 5 CKAD domains, explained

5 domains and 24 official competencies. Application Environment, Configuration and Security carries the most weight at 25%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 4 See all domains
Questions
15–20 performance-based tasks
Time
2 hours
Passing score
66%
Outline
CNCF CKAD Curriculum (PDF v1.37, matching the Linux Foundation exam page); exam environment Kubernetes v1.37 as of October 2026

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 20%
  2. 2 20%
  3. 3 15%
  4. 4 25%
  5. 5 20%
  1. 1 Application Design and Build
  2. 2 Application Deployment
  3. 3 Application Observability and Maintenance
  4. 4 Application Environment, Configuration and Security
  5. 5 Services and Networking

All 5 domains

24 official competencies 58–78 hrs suggested study

  1. Domain 01 20%

    Application Design and Build

    Application Design and Build is 20% of the CKAD. It covers turning source into a container image, choosing the workload object that fits how the code runs, combining containers in one Pod, and giving those containers the storage they need.

    Inside this domain

    • Define, build and modify container images
    • Choose and use the right workload resource (Deployment, DaemonSet, CronJob, etc.)
    • Understand multi-container Pod design patterns (e.g. sidecar, init and others)
    • Utilize persistent and ephemeral volumes

    Watch for Sidecar declared as a normal container

    Competencies
    4
    Questions est.
    3–4
    Study time est.
    12–16 hrs
  2. Domain 02 20%

    Application Deployment

    Application Deployment carries 20% of the CKAD score. It tests how you release new versions: rolling updates and rollbacks on Deployments, blue/green and canary releases built from labels and Services, installing charts with Helm, and customizing manifests with Kustomize.

    Inside this domain

    • Use Kubernetes primitives to implement common deployment strategies (e.g. blue/green or canary)
    • Understand Deployments and how to perform rolling updates
    • Use the Helm package manager to deploy existing packages
    • Kustomize

    Watch for Selector that excludes the canary

    Competencies
    4
    Questions est.
    3–4
    Study time est.
    12–16 hrs
  3. Domain 03 15%

    Application Observability and Maintenance

    Worth 15% of the CKAD, this domain tests whether you can keep an application healthy: replacing deprecated API versions, adding probes, watching resource use and events, reading container logs and finding why a Pod will not start.

    Inside this domain

    • Understand API deprecations
    • Implement probes and health checks
    • Use built-in CLI tools to monitor Kubernetes applications
    • Utilize container logs
    • and 1 more competencies

    Watch for Probe type swapped

    Competencies
    5
    Questions est.
    2–3
    Study time est.
    8–12 hrs
  4. Domain 04 25%

    Application Environment, Configuration and Security

    The heaviest CKAD domain at 25%, Application Environment, Configuration and Security covers how Pods receive settings and credentials, how much CPU and memory they may use, which identity they run as, what the API allows, and how custom resources extend the cluster.

    Inside this domain

    • Discover and use resources that extend Kubernetes (CRD, Operators)
    • Understand authentication, authorization and admission control
    • Understand requests, limits, quotas
    • Define resource requirements
    • and 4 more competencies

    Watch for Quota error hidden from view

    Competencies
    8
    Questions est.
    4–5
    Study time est.
    16–20 hrs
  5. Domain 05 20%

    Services and Networking

    Services and Networking makes up 20% of the CKAD. It tests how applications are reached and protected: writing basic NetworkPolicies, exposing Pods through Services, fixing Services that return nothing, and routing HTTP traffic with Ingress rules.

    Inside this domain

    • Demonstrate basic understanding of NetworkPolicies
    • Provide and troubleshoot access to applications via services
    • Use Ingress rules to expose applications

    Watch for Fixing the wrong layer

    Competencies
    3
    Questions est.
    3–4
    Study time est.
    10–14 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 58–78 hrs of study.

  1. 4 Application Environment, Configuration and Security 25% · 16–20 hrs
  2. 1 Application Design and Build 20% · 12–16 hrs
  3. 2 Application Deployment 20% · 12–16 hrs
  4. 5 Services and Networking 20% · 10–14 hrs
  5. 3 Application Observability and Maintenance 15% · 8–12 hrs

Try one

Practice questionDomain 4: Application Environment, Configuration and Security

Task: Container web in Deployment portal must run as user 1000, must not gain extra privileges, and may only bind to low ports. Which securityContext on the web container meets this?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Sidecar declared as a normal container

    Clue Wording such as 'must start before the application' or a Job with a helper.

  • Domain 2

    Selector that excludes the canary

    Clue Any task asking for traffic to reach both versions.

  • Domain 3

    Probe type swapped

    Clue Phrases such as 'should not receive traffic until'.

  • Domain 4

    Quota error hidden from view

    Clue A Deployment showing 0 of N ready and no Pods listed.

  • Domain 5

    Fixing the wrong layer

    Clue kubectl get endpoints showing none.

Other DevOps & Containers certifications

Study guides for exams that overlap with CKAD.

Practise what you read

CKAD domains: common questions

How many domains are in the CKAD exam?

CKAD has 5 domains with 24 official competencies between them: Application Design and Build, Application Deployment, Application Observability and Maintenance, Application Environment, Configuration and Security and Services and Networking.

Which CKAD domain carries the most weight?

Application Environment, Configuration and Security is the heaviest at 25%, followed by Application Design and Build (20%). The lightest is Application Observability and Maintenance (15%). Weights come from CNCF / The Linux Foundation's official outline.

What is the CKAD exam format?

Questions: 15–20 performance-based tasks. Time allowed: 2 hours. Passing score: 66%.

How long should I study for CKAD?

Our planning estimate is 58–78 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Application Environment, Configuration and Security, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows CNCF CKAD Curriculum (PDF v1.37, matching the Linux Foundation exam page); exam environment Kubernetes v1.37 as of October 2026, published by CNCF / The Linux Foundation. It was last reviewed in October 2026.

Domain names, weights and competencies come from CNCF / The Linux Foundation's official outline (CNCF CKAD Curriculum (PDF v1.37, matching the Linux Foundation exam page); exam environment Kubernetes v1.37 as of October 2026). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.