CKS — Kubernetes Security Specialist
This Is What the CKS Exam Looks Like
In one line
The CKS is a hands-on exam, and you must score 67% or more within 120 minutes to pass.
Why read this first
The most common failure in certification study comes not from not knowing the content but from going in not knowing the form of the exam. If you don't know what the passing score is, how tight the time is, or which domains have many questions, you can't set preparation priorities.
Official specifications
| Item | Value |
|---|---|
| Format | Hands-on |
| Time limit | 120 minutes |
| Passing score | 67% |
| Volume | 15–20 tasks |
| Exam fee | $445 (includes 1 retake) |
| Validity period | 2 years |
These values were taken from the candidate documentation at docs.linuxfoundation.org. The certification
introduction page doesn't state the passing score or the number of questions, so if you prepare by looking only there,
you walk into the exam room without knowing the passing score.
Domain weighting
| Domain | Weight | | |---|---:|| | Cluster Setup | 15% | | | Cluster Hardening | 15% | | | System Hardening | 10% | | | Minimize Microservice Vulnerabilities | 20% | | | Supply Chain Security | 20% | | | Monitoring, Logging and Runtime Security | 20% | |
Domains with greater weight have more questions. Use this ratio as the basis when you allocate study time. This practice exam also distributes questions in the same ratio.
This is where answers diverge
If you grade a practice exam, the questions you get wrong cluster into one form. You get them wrong not because you don't know the content but because you missed which of two similar concepts was being asked about. When a pair below comes to mind as you read a question, first sort it out using the criterion in the third column.
| This | That | What separates them |
|---|---|---|
| AppArmor | seccomp | If it filters system calls, seccomp |
| Metadata in an audit policy | Request | If it keeps the body too, Request |
| imagePolicyWebhook | Admission controllers in general | If it asks whether to allow an image, imagePolicyWebhook |
| gVisor | Plain runc | If it places a user-space kernel, gVisor |
| Automatic ServiceAccount token mounting | Projected token | If it has an expiry, projected |
This doesn't mean to memorize the table. If you mark which pair your wrong questions fell into, the place to study again becomes much narrower than a domain name.
What you may consult while solving
During the exam, you can open the documents below. You view them with Firefox inside the remote desktop.
kubernetes.io/docskubernetes.io/blogfalco.org/docskubernetes-sigs.github.io/bometcd.io/docskubernetes.github.io/ingress-nginxdocs.cilium.ioistio.io/latest/docs
There are three rules. Searching within the documentation sites is allowed, but you must not click external search results. You can also view the Korean translated versions, but the English is the most current, so it is recommended. And a Quick Reference link is given separately for each question, and that link is added to the allowlist.
Being able to view something is different from being able to find it. Rather than memorizing content, getting familiar with the structure of the documentation saves time.
What you actually experience at the exam
Many people know all the content and still lose time by getting flustered at the procedure.
The exam is taken with online proctoring on PSI's Bridge platform. The proctor's video verification procedure takes up to 30 minutes, and during this time the questions don't open and the time limit doesn't start. Even so, you should block out the schedule as 30 minutes of check-in plus the exam time.
Four things are checked at check-in. Agreeing to the non-disclosure agreement, a government-issued ID that exactly matches the name you registered, showing the room around with the webcam, and closing unapproved software. Because of that last item, turning off background programs such as Slack or cloud sync in advance saves time.
There are some conditions that are easy to get caught on when taking it in Korea. The ID must be signed, so a passport is the safest. You can use only one monitor, and dual monitors are not supported. There must be nothing on the desk or under it, taking notes on paper is prohibited, and reading the questions aloud is not allowed either. On a company network or VPN, access to AWS S3 is sometimes blocked and you get caught in the pre-check.
You can change a reservation only up to 24 hours before the start. And if you book and don't show up, you lose not only the exam fee but also your retake eligibility. Results come by email within 24 hours after the exam ends.
The exam fee includes 1 retake, and you must finish both the attempt and the retake within 12 months of the original purchase date. There is no official waiting period, so you can retake right after you receive the result. Rather than postponing because you aren't perfectly prepared, taking it once and seeing which domain is weak is often better.
The certification is valid for 2 years. On top of that comes the CARE program introduced in 2026. If you pass the CKA or CKAD, the KCNA is renewed automatically, and if you pass the CKS, the KCSA and CKA are renewed automatically. However, you must earn the lower certifications first for this chain to work. If you earn the CKA first and the KCNA later, that CKA won't renew the KCNA. If you are aiming for Golden Kubestronaut, this order determines the renewal burden for the next several years.
How to use this practice exam
The time limit is set the same as the real exam. The remaining time is visible at the top of the screen, and when time is up it is submitted automatically and unanswered questions are treated as wrong. This is because the real exam also grades only what you have solved by that point.
It matters to sit and work through it all in one go. If you solve it while looking things up midway, the score goes up, but that score doesn't predict the real exam. What you are checking is not whether you know but whether you clear the passing score within the time limit.
After reading the explanations for the questions you got wrong, study again the domain those questions belong to.