Certified Kubernetes Security Specialist

CKS assumes you already operate CKA-level kubectl fluency. The exam will not give you time to look up basic resource syntax - the time pressure is on the security tooling layer (Falco, kube-bench, Trivy, audit policies, AppArmor). If you're rusty on kubectl, fix that before booking CKS.

Day-zero shell setup matters even more than CKA. alias k=kubectl, export do='--dry-run=client -o yaml', export now='--force --grace-period=0', source <(kubectl completion bash). Practice with these aliases until they're muscle memory.

The exam allows a fixed list of documentation sites: kubernetes.io/docs, kubernetes.io/blog, falco.org/docs, the sigs.k8s.io/bom CLI reference, etcd.io/docs, the NGINX Ingress Controller user guide, docs.cilium.io, and istio.io/docs. Bookmark these in the exam browser. Search via the kubernetes.io search bar is allowed but you may not click out to external search results - Google is effectively blocked.

NetworkPolicy questions almost always require a default-deny baseline plus a narrow allow. The trap is forgetting to allow DNS egress (UDP 53 to kube-dns) - workloads will appear broken even when your policy 'looks right'. Always include DNS in your egress whitelist.

Pod Security Admission has fully replaced PodSecurityPolicy as of 1.25+. Practice setting all three label modes (enforce, audit, warn) on namespaces, and know which restricted-mode rules cause common pods to fail (runAsNonRoot, allowPrivilegeEscalation=false, capabilities drop ALL).

kube-bench output is verbose. Practice grepping for [FAIL] and reading the remediation block - the exam will hand you a kube-bench report and ask you to fix specific findings (typically kubelet args in /var/lib/kubelet/config.yaml or kube-apiserver flags in /etc/kubernetes/manifests/kube-apiserver.yaml).

Audit-policy tasks are common. Memorize the Policy/v1 schema cold: rules with level (None/Metadata/Request/RequestResponse), resources block, namespaces, verbs. After editing the static pod manifest, kube-apiserver will restart automatically - watch crictl ps for the new container and tail audit log to verify.

Image-scanning tasks usually want you to find HIGH/CRITICAL CVEs in a deployed pod's image. trivy image --severity HIGH,CRITICAL <image>, then either patch the deployment to a known-good tag or delete the pod entirely. Read the question carefully - 'remove' is different from 'remediate'.

Killer.sh CKS simulator is bundled free (two attempts). It is markedly harder than the real exam - if you can hit ~65% on it untimed, the real exam is achievable. Use both attempts: first one to learn the gaps, second after a week of remediation.

Time budget: ~15-20 tasks in 120 minutes is ~6-8 minutes per task, but security tasks have wide variance. AppArmor/seccomp/Falco tasks routinely take 10+ minutes. Triage on first pass: do the small RBAC/NetworkPolicy/kubectl tasks first, flag the long ones, return after the easy points are banked.