CKS certification: cost, CKA prerequisite and hands-on exam format
The CKS certification (Certified Kubernetes Security Specialist) is the Linux Foundation and CNCF security credential for Kubernetes. You must have passed the CKA first. The exam costs $445, gives you 2 hours for 15–20 performance-based tasks, requires 67% to pass and is valid for 2 years.
- Certification
- Certified Kubernetes Security Specialist (CKS) — Linux Foundation and CNCFLinux Foundation CKS page, checked 8 October 2026
- Exam fee
- $445 exam only · $645 with the LFS260 courseLinux Foundation CKS page, checked 8 October 2026
- Prerequisite
- Must have taken and passed the CKA examLinux Foundation CKS page, checked 8 October 2026
- Format
- Online, proctored, performance-based — 15–20 tasks on the command lineLinux Foundation CKS page and CKS instructions, checked 8 October 2026
- Duration
- 2 hoursLinux Foundation CKS page, checked 8 October 2026
- Passing score
- 67% or aboveLinux Foundation FAQ, checked 8 October 2026
- Included
- 12-month exam eligibility, one retake, two simulator sessionsLinux Foundation CKS page, checked 8 October 2026
- Validity
- 2 years; a CKS earned or renewed on or after 18 June 2026 also extends your CKALinux Foundation FAQ, checked 8 October 2026
- Languages
- English, Simplified Chinese, JapaneseLinux Foundation FAQ, checked 8 October 2026
Know if you're ready for CKS — before you book.
Certsqill measures your CKS readiness across every official exam domain — one 0–100 score from coverage, accuracy and consistency that tells you whether to book, keep studying, or sit.
Why people switch to Certsqill
Everything you need to walk in ready
Know where you stand, understand every mistake, and study in your language — one payment, no subscription.
Your CKS Readiness Score, not a guess
One number from three signals — coverage, accuracy, and consistency — tells you whether to book the exam or keep studying.
Understand every CKS mistake
When you miss a question, it explains why — using your own answer history to catch the patterns you keep repeating. Included, no subscription.
Explanations in your language, questions stay exam-accurate
Get every explanation in your language while the questions stay in exam-accurate English. Technical terms stay in English — the way the exam writes them.
Everything you need to pass
Why you can trust these CKS questions
What is the CKS certification?
CKS stands for Certified Kubernetes Security Specialist. It is the security credential in the Kubernetes certification family run by the Linux Foundation with the Cloud Native Computing Foundation (CNCF): hardening clusters and nodes, reducing the attack surface of workloads, securing the software supply chain, and detecting threats at runtime.
It is the top rung of that family. CKA (administrator) and CKAD (application developer) can be taken in any order, but CKS cannot be attempted until you have passed the CKA. In practice, CKS assumes you already operate clusters fluently and asks you to secure them under time pressure.
Like CKA and CKAD, the CKS is a hands-on exam. You work in live environments over a terminal, and the grader checks the resulting state of the system.
Source: Linux Foundation — CKS certification page. Checked 8 October 2026.
How much does the CKS certification cost?
The Linux Foundation lists the CKS exam at $445 for the exam only. It also sells the exam with a THRIVE-ONE annual subscription for $625, and with its Kubernetes Security Essentials course (LFS260) for $645.
The registration includes 12 months to schedule and sit the exam, one retake and two simulator sessions.
Keep in mind that the real entry price includes the CKA, because a passed CKA is required before you can attempt the CKS. If you do not hold it yet, the path is two exam registrations, not one.
Source: Linux Foundation — CKS certification page. Checked 8 October 2026.
What is the CKS exam format?
The CKS is an online, proctored, performance-based test that requires solving multiple tasks from a command line. The Linux Foundation’s instructions state that it consists of 15–20 performance-based tasks, each to be completed on a designated host, and candidates have 2 hours.
The environment currently runs Kubernetes v1.35. The instructions note that hosts are reached over SSH, so moving between machines cleanly is part of the job.
The list of allowed references is longer than for CKA and CKAD, because the exam touches tools beyond core Kubernetes: the Kubernetes documentation and blog, plus the documentation for Falco, bom, etcd, the NGINX Ingress Controller, Cilium and Istio. Search inside those sites is allowed; opening external search results is not.
Source: Linux Foundation — Important Instructions: CKS. Checked 8 October 2026.
CKS passing score
The Linux Foundation states that a score of 67% or above must be earned to pass the CKS — one point higher than the 66% required for CKA and CKAD.
The score reflects task outcomes, not chosen answers, so partially completed security configurations can be worth little or nothing. With 15–20 tasks in 2 hours there are on average six to eight minutes per task, and several tasks involve tools outside core Kubernetes.
For preparation, that means being fluent in each listed tool’s basic workflow — not just knowing what Falco or an admission policy does, but having configured it under a clock.
Source: Linux Foundation — FAQ: CKA, CKAD & CKS. Checked 8 October 2026.
What is on the CKS exam?
The Linux Foundation publishes six domains. Three of them carry 20% each and together make up 60% of the exam: microservice vulnerabilities, supply chain security, and monitoring, logging and runtime security.
The exam is currently based on Kubernetes v1.35 and, per the Linux Foundation, follows new minor releases within roughly 4 to 8 weeks. Security features change faster than most of the API, so re-read the curriculum on the CKS page shortly before you book rather than relying on an older study plan.
- Minimize Microservice Vulnerabilities — 20%
- Supply Chain Security — 20%
- Monitoring, Logging and Runtime Security — 20%
- Cluster Setup — 15%
- Cluster Hardening — 15%
- System Hardening — 10%
Source: Linux Foundation — CKS certification page. Checked 8 October 2026.
CKS prerequisites
The CKS has one hard prerequisite: candidates must have taken and passed the Certified Kubernetes Administrator (CKA) exam before attempting the CKS.
The Linux Foundation’s pages state the requirement as “taken and passed”. They do not spell out on the pages checked whether the CKA must still be within its validity period when you sit the CKS, so if your CKA is close to expiry, confirm with the Linux Foundation before booking.
Source: Linux Foundation — CKS certification page. Checked 8 October 2026.
How long is the CKS certification valid?
CKS certifications are valid for 2 years. You renew by retaking and passing the exam before it expires, and the renewed certification is current for a further 2 years from the date you pass.
Since 18 June 2026 there is an added benefit: the Linux Foundation states that earning or recertifying the CKS on or after that date automatically extends your CKA, with the CKA expiration date updated to align with the new CKS expiration date. For anyone holding both, one exam now keeps both current.
Source: Linux Foundation — FAQ: CKA, CKAD & CKS. Checked 8 October 2026.
CKS study materials and training
The Linux Foundation’s own course for this exam is Kubernetes Security Essentials (LFS260), sold separately or bundled with the exam for $645.
The registration includes two simulator sessions with 36 hours of access each and a different set of 17 questions per session, with graded results.
Beyond that, the allowed-resources list doubles as a study plan: every tool on it — Falco, bom, etcd, the NGINX Ingress Controller, Cilium and Istio — has documentation you are permitted to open during the exam, which signals where tasks can come from.
Source: Linux Foundation — Resources Allowed. Checked 8 October 2026.
CKS vs CKA
CKS and CKA cost the same ($445), run the same 2 hours and use the same hands-on, 15–20-task format. The differences are the passing score (67% for CKS, 66% for CKA), the prerequisite (CKS requires a passed CKA, CKA requires nothing) and the content.
CKA weights troubleshooting at 30% and cluster architecture at 25%. CKS spends 60% of its weight on microservice vulnerabilities, supply chain security and runtime security, and adds cluster setup, cluster hardening and system hardening. CKS is therefore a follow-on, not an alternative.
Source: Linux Foundation — FAQ: CKA, CKAD & CKS. Checked 8 October 2026.
CKS practice questions
Certsqill’s CKS practice questions explain each option and follow the Linux Foundation’s published domain weightings.
For a performance-based exam, knowledge questions are a complement to hands-on practice, never a substitute. What they can do is test that you understand the security concepts behind a task — what a NetworkPolicy actually blocks, what an SBOM contains, what a runtime rule detects — so that your lab hours go into execution speed.
CKS questions people ask
How much does the CKS exam cost?
$445 for the exam only, including one retake and two simulator sessions. With the LFS260 course it is $645. Source: Linux Foundation, checked 8 October 2026.
Do I need the CKA before the CKS?
Yes. Candidates must have taken and passed the CKA exam before attempting the CKS. Source: Linux Foundation, checked 8 October 2026.
Is the CKS exam hands-on?
Yes. It is an online, proctored, performance-based test of 15–20 command-line tasks. Source: Linux Foundation, checked 8 October 2026.
How long is the CKS exam?
2 hours. Source: Linux Foundation, checked 8 October 2026.
What is the CKS passing score?
67% or above. Source: Linux Foundation FAQ, checked 8 October 2026.
How long is the CKS valid?
2 years. Renew by retaking and passing the exam. Source: Linux Foundation FAQ, checked 8 October 2026.
Does passing the CKS renew my CKA?
If you earn or recertify the CKS on or after 18 June 2026, your CKA is automatically extended to the new CKS expiration date. Source: Linux Foundation FAQ, checked 8 October 2026.
Which tool documentation can I use in the CKS exam?
Kubernetes docs and blog, plus Falco, bom, etcd, NGINX Ingress Controller, Cilium and Istio documentation. Source: Linux Foundation, checked 8 October 2026.
Planning your CKS training
Good CKS training starts from the published curriculum — the CKS syllabus of six weighted domains — and from the fact that you already hold a CKA. You do not need to relearn cluster basics; you need to apply security controls quickly in a cluster you can already operate.
The Linux Foundation’s own course for this exam is LFS260, available alone or bundled with the exam. Whatever you use, plan most of your time for hands-on labs: the exam allows documentation for tools such as Falco, Cilium and Istio, but finding the right page is only useful if you already know what you are looking for. The two included simulator sessions are the best checkpoint of your progress.
Source: Linux Foundation — CKS certification page. Checked 8 October 2026.
Why CKS dumps do not work
CKS dumps — tasks recalled from the live exam — are covered by the Linux Foundation’s certification agreement, which names “braindump material” explicitly and prohibits seeking or obtaining unauthorized access to exam materials. The stated consequences include revocation of any certifications you hold and a bar from other Linux Foundation exams. For a CKS candidate that would put the CKA at risk too.
Practically, a recalled task is of little help in a performance-based exam: what earns points is configuring the cluster correctly within the time.
Source: Linux Foundation — Global Certification and Confidentiality Agreement. Checked 9 October 2026.
What your CKS certificate shows — and is it worth it?
A CKS certificate shows that you passed a hands-on security exam on live clusters, after having already passed the CKA. Since 18 June 2026, earning or renewing the CKS cert also extends your CKA to the same expiry date, which reduces the cost of keeping both current.
Whether it is worth it depends on how much of your work touches cluster security. For platform, DevSecOps and security engineers working with Kubernetes, the preparation maps closely onto daily tasks. The Linux Foundation does not publish salary or pass-rate figures for the CKS, so we do not quote any.
Source: Linux Foundation — CKS certification page. Checked 8 October 2026.
More CKS questions
Does the CKS cert replace the CKA?
No. CKA remains the prerequisite. A CKS earned or renewed on or after 18 June 2026 extends your CKA expiry date to match the new CKS expiry. Source: Linux Foundation FAQ, checked 8 October 2026.
Is official CKS training required?
No. Only a passed CKA is required. The LFS260 course is optional.
