The CKS certification (Certified Kubernetes Security Specialist) is a hands-on exam from the Linux Foundation and CNCF that proves you can secure Kubernetes clusters and workloads. As of November 2026, it costs $445, lasts 2 hours, needs a score of 67% to pass, requires a passed CKA, and stays valid for 2 years.
What is CKS certification?
CKS is the security credential in the Kubernetes line run by the Cloud Native Computing Foundation (CNCF) and delivered by the Linux Foundation. The CNCF program page describes it as proof that a holder can secure container-based applications and Kubernetes platforms during build, deployment, and runtime.
There is no multiple choice. You work at a command line in live clusters and complete security tasks against the clock. Among Linux Foundation certifications, it is the only one of the three core Kubernetes exams (CKA, CKAD, CKS) with a prerequisite.
CKS certification exam at a glance
| Item | Detail (as of November 2026) |
| Format | Online, remotely proctored, performance-based command-line tasks |
| Duration | 2 hours |
| Passing score | 67% |
| Kubernetes version | v1.37 (moved to each new minor release within about 4 to 8 weeks) |
| Languages | English, Simplified Chinese, Japanese |
| Results | Emailed within 24 hours of finishing |
| Included with purchase | 12 months to schedule, one retake, two simulator attempts |
| Validity | 2 years |
| Exam fee (USD) | $445, exam only |
Sources: the Linux Foundation CKS page and the official CKA, CKAD and CKS FAQ. Several guides still list Kubernetes v1.35 or an older fee; the exam vendor’s pages are the ones to trust.
What do the six CKS domains cover?
| Domain | Weight (Linux Foundation page) | What you practice |
| Cluster Setup | 15% | Network policies, CIS benchmark review, Ingress with TLS, node metadata protection, binary verification |
| Cluster Hardening | 15% | RBAC, service account limits, API access, upgrades |
| System Hardening | 10% | Host OS footprint, least-privilege IAM, AppArmor, seccomp |
| Minimize Microservice Vulnerabilities | 20% | Pod Security Standards, secrets, sandboxed containers, Pod-to-Pod encryption with Cilium or Istio |
| Supply Chain Security | 20% | Base images, SBOMs, signed artifacts, static analysis with tools such as KubeLinter |
| Monitoring, Logging and Runtime Security | 20% | Behavioral detection, attack investigation, container immutability, audit logs |
The CNCF page still lists Cluster Setup at 10% and System Hardening at 15%, the reverse of the Linux Foundation page. Treat those two as one 25% block, and check the open-source CNCF curriculum before you start. The three 20% domains make up 60% of the score either way, so they deserve about 60% of your lab time.
For More Information: What’s the CKAD Certification Cost in 2027? $445 + Discounts
CKS certification prerequisites: does your CKA need to be active?
The only formal prerequisite is the Certified Kubernetes Administrator (CKA). The official wording is that candidates must have taken and passed the CKA before attempting CKS. The CNCF page goes further and says the CKA does not have to be active.
Many popular guides, and older versions of the FAQ, still say you need a current, unexpired CKA. If yours has lapsed, read the current official pages before paying for a CKA retake you may not need, and confirm on the day you book.
There is no experience form, no required course, and no KCSA requirement. The CKA itself has no prerequisites, according to the Linux Foundation CKA page.
Learn more about: CKAD Certification 2027: The Complete Guide to the Kubernetes Developer Exam
CKS certification cost: three real paths
Each Kubernetes exam lists at $445 (USD, exam only, November 2026). The table adds up the common routes using current Linux Foundation prices only.
| Your starting point | What you buy | Total (USD) |
| Already passed CKA | CKS exam only | $445 |
| No CKA yet, self-study | CKA exam $445 + CKS exam $445 | $890 |
| No CKA yet, official courses | CKA + LFS258 bundle $645 + CKS + LFS260 bundle $645 | $1,290 |
A fourth option bundles the CKS exam with a THRIVE-ONE annual subscription for $625, which covers all Linux Foundation e-learning courses for a year.
One retake is included, so failing once costs nothing extra. Standard registrations also include two simulator attempts with 36 hours of access each, but the FAQ notes that registrations sold as CKS-SINGLE do not include the simulator. Check which one you are buying.
Renewal math: why CKS can renew your CKA
Both certifications last 2 years, and you renew by passing the exam again before it expires. The Linux Foundation CARE program links several Linux Foundation certifications: earning or recertifying CKS on or after June 18, 2026 automatically renews a CKA you previously earned, even a lapsed one, and aligns its expiry with your CKS. It also renews KCSA and KCNA if you held them.
At current prices, renewing CKA and CKS separately costs $445 + $445 = $890 every two years. Renewing through CKS costs $445, a saving of $445 per cycle. A CKS passed before June 18, 2026 does not renew your CKA retroactively.
Read More About: CKA Certification Cost in 2026-27: What $445 Gets You and How to Pay Less
How to register and schedule the CKS exam
- Buy the exam on the Linux Foundation CKS page. Your 12-month window to schedule and sit it starts then.
- Open your exam preparation checklist in the Linux Foundation training portal. It holds your name verification, scheduling, and simulator link.
- Verify your name matches your government ID exactly.
- Run the PSI system check on the computer you will use.
- Use simulator attempt one early to find weak domains, and save attempt two for a timed rehearsal shortly before your booked date.
What to expect on exam day
The exam runs on PSI’s Bridge platform through the PSI Secure Browser. According to the FAQ, you need:
- One active monitor (dual monitors are not supported), with 15 inches or larger and 1080p recommended
- A movable webcam, a working microphone, and stable internet
- An unexpired, physical government-issued photo ID whose name matches your verified name
- A private, well-lit room with a clear desk and the door closed
The Linux Foundation advises against work-provided laptops, since their security software can disrupt the exam browser. The FAQ also links the list of resources allowed during CKS; read it before you practice, so you rehearse with the same documentation you can use for real.
CKA and CKS certification: how they differ
| CKA | CKS | |
| Focus | Installing, running, and troubleshooting clusters | Securing clusters, workloads, supply chain, and runtime |
| Prerequisite | None | Passed CKA |
| Passing score | 66% | 67% |
| Duration | 2 hours | 2 hours |
| Fee (USD, exam only) | $445 | $445 |
| Validity | 2 years | 2 years |
CKA proves you can run a cluster; CKS proves you can lock one down. That is why the order is fixed: CKA first, then CKS.
Read More: CKAD vs CKA in 2027: Which Kubernetes Exam Should You Take?
Is CKS certification hard?
Neither CNCF nor the Linux Foundation publishes a pass rate, so any percentage you see online is a guess. The official facts show where the difficulty comes from:
- Time. Every task is hands-on, and two hours is short for six domains.
- Tool breadth. The curriculum names AppArmor, seccomp, Cilium, Istio and static analysis tools, beyond core Kubernetes.
- A slightly higher bar. You need 67%, one point above CKA.
Candidate reviews on the Linux Foundation CKS page (individual comments, not statistics) mention time pressure most often. People who already secure clusters at work tend to find it manageable; people who have only studied theory tend to find it the hardest of the three Kubernetes exams. Build each control in a lab cluster until the YAML and kubectl commands come quickly.
CKS certification salary: what the data shows
The US Bureau of Labor Statistics does not track pay by certification. The closest official occupation for most CKS holders is Information Security Analysts (SOC 15-1212), so treat these figures as a proxy, not pay for the credential.
| Measure (Information Security Analysts, US) | Value |
| Median annual wage, May 2025 | $129,180 |
| Lowest 10% earned less than | $75,090 |
| Highest 10% earned more than | $199,850 |
| Median in the Information industry | $138,650 |
| Projected job growth, 2025 to 2035 | 21% |
| Average openings per year | About 14,100 |
Source: BLS Occupational Outlook Handbook. Platform and DevOps engineers who do Kubernetes security fall under other BLS occupations, and pay varies by location, experience, and employer. A certification supports a move into these roles; it does not set your salary.
Who should take CKS in 2027?
- You passed CKA and run production clusters: book CKS. It is $445 and renews your CKA too.
- Your CKA has lapsed: check the prerequisite wording first; CKS may be your cheaper route back to two current credentials.
- You have no CKA: start with CKA and budget $890 for both exams.
- You build applications rather than run clusters: CKAD is the closer fit.
FAQs
What score do you need to pass the CKS exam?
You need 67% or higher; CKA and CKAD use 66%. Exams are scored automatically, and results usually arrive by email within 24 hours.
Can I take CKS if my CKA has expired?
The official requirement is that you have taken and passed the CKA, and the CNCF CKS page states it does not have to be active. Confirm the current wording on the Linux Foundation FAQ before booking, because older guidance said otherwise.
How long is CKS valid and how do you renew it?
CKS is valid for 2 years. You renew by passing the exam again before it expires, and the new certification runs 2 years from your pass date.
Are there official CKS practice questions?
Yes. Standard registrations include two Killer.sh simulator attempts, each with 36 hours of access and 17 questions, with graded results. The free Introduction to Kubernetes course and the LFS260 course are the official study options.
Is CKS one of the Linux Foundation certifications?
Yes. CKS sits in the Linux Foundation catalog alongside Linux certifications such as LFCS, but it tests Kubernetes security, not Linux system administration. Linux skills still help, because System Hardening works at the host OS level.
