CKS study guide · 2026

The 6 CKS domains, explained

6 domains and 26 official competencies. Minimize Microservice Vulnerabilities carries the most weight at 20%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 4 See all domains
Questions
15–20 performance-based tasks
Time
2 hours
Passing score
67%
Outline
CNCF CKS Curriculum (PDF v1.34, unchanged on the Linux Foundation exam page); exam environment Kubernetes v1.35 as of October 2026

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 15%
  2. 2 15%
  3. 3 10%
  4. 4 20%
  5. 5 20%
  6. 6 20%
  1. 1 Cluster Setup
  2. 2 Cluster Hardening
  3. 3 System Hardening
  4. 4 Minimize Microservice Vulnerabilities
  5. 5 Supply Chain Security
  6. 6 Monitoring, Logging and Runtime Security

All 6 domains

26 official competencies 76–102 hrs suggested study

  1. Domain 01 15%

    Cluster Setup

    Worth 15% of the CKS score, this domain covers the security baseline you lay down before workloads arrive: default-deny NetworkPolicies, CIS benchmark remediation, TLS on Ingress, blocking node metadata and kubelet endpoints, and checking platform binaries against published checksums.

    Inside this domain

    • Use Network security policies to restrict cluster level access
    • Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)
    • Properly set up Ingress with TLS
    • Protect node metadata and endpoints
    • and 1 more competencies

    Watch for Policy that allows too much

    Competencies
    5
    Questions est.
    2–3
    Study time est.
    12–16 hrs
  2. Domain 02 15%

    Cluster Hardening

    Cluster Hardening, 15% of the CKS, is about who and what can talk to the Kubernetes API: trimming RBAC grants, limiting service account tokens, closing anonymous or overly broad API access, and upgrading clusters to pick up security fixes.

    Inside this domain

    • Use Role Based Access Controls to minimize exposure
    • Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones
    • Restrict access to Kubernetes API
    • Upgrade Kubernetes to avoid vulnerabilities

    Watch for Over-removal

    Competencies
    4
    Questions est.
    2–3
    Study time est.
    10–14 hrs
  3. Domain 03 10%

    System Hardening

    The smallest CKS domain at 10%, System Hardening moves below Kubernetes to the node: removing unneeded packages and services, tightening user and cloud identities, closing exposed ports, and confining containers with AppArmor and seccomp.

    Inside this domain

    • Minimize host OS footprint (reduce attack surface)
    • Using least-privilege identity and access management
    • Minimize external access to the network
    • Appropriately use kernel hardening tools such as AppArmor, seccomp

    Watch for Profile name mismatch

    Competencies
    4
    Questions est.
    ~2
    Study time est.
    8–12 hrs
  4. Domain 04 20%

    Minimize Microservice Vulnerabilities

    Tied for the largest CKS weight at 20%, this domain protects workloads themselves: enforcing Pod Security Standards, encrypting and handling Secrets correctly, isolating tenants and untrusted code with sandboxed runtimes, and encrypting traffic between Pods.

    Inside this domain

    • Use appropriate pod security standards
    • Manage Kubernetes secrets
    • Understand and implement isolation techniques (multi-tenancy, sandboxed containers, etc.)
    • Implement Pod-to-Pod encryption (Cilium, Istio)

    Watch for Invisible rejection

    Competencies
    4
    Questions est.
    3–4
    Study time est.
    16–20 hrs
  5. Domain 05 20%

    Supply Chain Security

    One of three 20% CKS domains, Supply Chain Security covers what you deploy before it runs: building small images, generating and reading SBOMs, restricting registries and verifying signatures at admission, and scanning manifests and images for weaknesses.

    Inside this domain

    • Minimize base image footprint
    • Understand your supply chain (e.g. SBOM, CI/CD, artifact repositories)
    • Secure your supply chain (permitted registries, sign and validate artifacts, etc.)
    • Perform static analysis of user workloads and container images (e.g. Kubesec, KubeLinter)

    Watch for Fail-open admission

    Competencies
    4
    Questions est.
    3–4
    Study time est.
    14–18 hrs
  6. Domain 06 20%

    Monitoring, Logging and Runtime Security

    The third 20% CKS domain covers what happens after deployment: detecting suspicious behaviour with Falco, tracing an attack to the responsible Pod, keeping containers immutable while they run, and configuring audit logs that record API access.

    Inside this domain

    • Perform behavioral analytics to detect malicious activities
    • Detect threats within physical infrastructure, apps, networks, data, users and workloads
    • Investigate and identify phases of attack and bad actors within the environment
    • Ensure immutability of containers at runtime
    • and 1 more competencies

    Watch for Recreated attacker Pod

    Competencies
    5
    Questions est.
    3–4
    Study time est.
    16–22 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 76–102 hrs of study.

  1. 4 Minimize Microservice Vulnerabilities 20% · 16–20 hrs
  2. 5 Supply Chain Security 20% · 14–18 hrs
  3. 6 Monitoring, Logging and Runtime Security 20% · 16–22 hrs
  4. 1 Cluster Setup 15% · 12–16 hrs
  5. 2 Cluster Hardening 15% · 10–14 hrs
  6. 3 System Hardening 10% · 8–12 hrs

Try one

Practice questionDomain 4: Minimize Microservice Vulnerabilities

Task: namespace team-a is labelled pod-security.kubernetes.io/enforce=restricted. Deployment api applied without errors but has 0 ready replicas. Its containers set runAsNonRoot true and drop ALL capabilities. Which addition most likely lets the Pods be admitted?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Policy that allows too much

    Clue Wording such as 'only Pods labelled X in namespace Y'.

  • Domain 2

    Over-removal

    Clue Phrases such as 'must still be able to'.

  • Domain 3

    Profile name mismatch

    Clue aa-status output listing a name different from the file.

  • Domain 4

    Invisible rejection

    Clue READY 0/3 after a namespace has an enforce label.

  • Domain 5

    Fail-open admission

    Clue A task stating Pods must be denied when the backend is unavailable.

  • Domain 6

    Recreated attacker Pod

    Clue A Pod name with a ReplicaSet hash suffix.

Other DevOps & Containers certifications

Study guides for exams that overlap with CKS.

Practise what you read

CKS domains: common questions

How many domains are in the CKS exam?

CKS has 6 domains with 26 official competencies between them: Cluster Setup, Cluster Hardening, System Hardening, Minimize Microservice Vulnerabilities, Supply Chain Security and Monitoring, Logging and Runtime Security.

Which CKS domain carries the most weight?

Minimize Microservice Vulnerabilities is the heaviest at 20%, followed by Supply Chain Security (20%). The lightest is System Hardening (10%). Weights come from CNCF / The Linux Foundation's official outline.

What is the CKS exam format?

Questions: 15–20 performance-based tasks. Time allowed: 2 hours. Passing score: 67%.

How long should I study for CKS?

Our planning estimate is 76–102 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Minimize Microservice Vulnerabilities, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows CNCF CKS Curriculum (PDF v1.34, unchanged on the Linux Foundation exam page); exam environment Kubernetes v1.35 as of October 2026, published by CNCF / The Linux Foundation. It was last reviewed in October 2026.

Domain names, weights and competencies come from CNCF / The Linux Foundation's official outline (CNCF CKS Curriculum (PDF v1.34, unchanged on the Linux Foundation exam page); exam environment Kubernetes v1.35 as of October 2026). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.