Fix all issues via configuration and restart the affected components to ensure the new settings take effect. Fix all of the following violations that were found against the kubelet: The cluster uses the Docker Engine as its…
docs · k8s.io/docs/reference/access-authn-authz/kubelet-authn-authzCKS Exam Topics & Practice Tasks
Every task in the CKS lab maps to a domain in the official Certified Kubernetes Security Specialist curriculum. Below is the full list - what you'll practice, what each task tests, and how it maps to the exam blueprint.
16
graded tasks
6
CKS domains
120
min per attempt
Mapped
curriculum domains
Domain 1
10% of CKS exam
Cluster Setup
Lock down network access, the kubelet, API authentication, and ingress TLS, and run CIS benchmark checks.
The worker node is running an older kubelet patch version (v1.35.0) and must be upgraded to v1.35.1. Access The upgrade is performed on the worker node itself.
docs · k8s.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgradeFirst, secure the cluster's API server configuring it as follows: Forbid anonymous authentication Use authorization mode Node,RBAC Use admission controller NodeRestriction The cluster uses the Docker Engine as its container…
docs · k8s.io/docs/reference/access-authn-authz/authentication
Domain 2
15% of CKS exam
Cluster Hardening
Restrict RBAC and service accounts, tighten API server flags, and keep the cluster patched.
Create a TLS Secret named clever-cactus in the clever-cactus namespace for an existing Deployment named clever-cactus. Use the following SSL files: Certificate: /home/candidate/clever-cactus/web.k8s.local.crt Key:…
docs · k8s.io/docs/concepts/configuration/secretFirst, create a NetworkPolicy named deny-policy in the prod namespace to block all ingress traffic. The prod namespace is labeled env:prod.
docs · k8s.io/docs/concepts/services-networking/network-policiesCreate an Ingress resource named web in the prod namespace and configure it as follows: Route traffic for host web.k8s.local and all paths to the existing Service web. Enable TLS termination using the existing Secret web-cert.
docs · k8s.io/docs/concepts/services-networking/ingressIstio is installed in the cluster. Deployment target-app runs in namespace app-ns, but the namespace was never enabled for sidecar injection, so its pods are not in the mesh.
docs · istio.io/latest/docs/tasks/security/authentication/authn-policy
Domain 3
15% of CKS exam
System Hardening
Reduce the host attack surface with AppArmor, seccomp, and kernel hardening.
Perform the following tasks to secure the cluster node: Remove user developer from the docker group. Do not remove the user from any other group.
docs · docs.docker.com/engine/security
Domain 4
20% of CKS exam
Minimize Microservice Vulnerabilities
Apply Pod Security Standards, securityContext, and mTLS, and protect secrets at rest.
Modify the existing Deployment named lamp-deployment, running in namespace lamp, so that its containers: run with user ID 20000 use a read-only root filesystem forbid privilege escalation The Deployment's manifest file can be…
docs · k8s.io/docs/tasks/configure-pod-container/security-contextFirst, modify the existing ServiceAccount stats-monitor-sa in the namespace monitoring to turn off automounting of API credentials.
docs · k8s.io/docs/tasks/configure-pod-container/configure-service-accountNamespace restricted-ns enforces the restricted Pod Security Standard. A Deployment pss-app in this namespace is currently non-compliant and its Pods cannot start.
docs · k8s.io/docs/concepts/security/pod-security-standards
Domain 5
20% of CKS exam
Supply Chain Security
Scan images for vulnerabilities, harden Dockerfiles, generate SBOMs, and enforce image policy.
Analyze and edit the Dockerfile located at /home/candidate/subtle-bee/build/Dockerfile, fixing one instruction present in the file that is a prominent security/best-practice issue.
docs · k8s.io/docs/tasks/configure-pod-container/security-contextThe alpine Deployment in the alpine namespace has three containers that run different versions of the alpine image. First, find out which version of the alpine image contains the libcrypto3 package at version 3.1.4-r5.
docs · github.com/kubernetes-sigs/bomGiven an incomplete configuration located at /etc/kubernetes/bouncer and a functional container image scanner with an HTTPS endpoint at https://smooth-yak.local/review, perform the following tasks to implement a validating…
docs · k8s.io/docs/reference/access-authn-authz/admission-controllers
Domain 6
20% of CKS exam
Monitoring, Logging and Runtime Security
Detect threats at runtime with Falco, behavioral analytics, and audit logging.
One of the Pods belonging to the application ollama is misbehaving. It is directly accessing the system's memory reading from the sensitive file /dev/mem. First, identify the misbehaving Pod accessing /dev/mem.
docs · falco.org/docs/concepts/rulesFirst, reconfigure the cluster's API server, so that: the basic audit policy located at /etc/kubernetes/logpolicy/audit-policy.yaml is used, logs are stored at /var/log/kubernetes/audit-logs.txt, and a maximum of 2 logs are…
docs · k8s.io/docs/tasks/debug/debug-cluster/auditCKS access, clearly explained
$39 USD · 30 days · one payment. 16 graded tasks, 5 attempts at the full exam simulation and unlimited single-task practice during the access window. The clock starts when you activate.
Public task descriptions; the selected weekly lab is free with an account. 2 free weekly starts per certification. Read this week's free task →
List price before any applicable checkout taxes or discounts. Create an account →