CKS Exam Topics & Practice Tasks

Every task in the CKS lab maps to a domain in the official Certified Kubernetes Security Specialist curriculum. Below is the full list - what you'll practice, what each task tests, and how it maps to the exam blueprint.

Try 3 tasks free → CKS overview

graded tasks

CKS domains

120

min per attempt

100%

curriculum coverage

Domain 1 10% of CKS exam

Cluster Setup

Lock down network access, the kubelet, API authentication, and ingress TLS, and run CIS benchmark checks.

Task 01

CIS Benchmark: Harden the Kubelet and etcd

Fix all issues via configuration and restart the affected components to ensure the new settings take effect. Fix all of the following violations that were found against the kubelet: The cluster uses the Docker Engine as its…

docs · k8s.io/docs/reference/access-authn-authz/kubelet-authn-authz

Task 10

Upgrade a Worker Node by One Patch Version

The worker node is running an older kubelet patch version (v1.30.0) and must be upgraded to v1.30.1. Access The upgrade is performed on the worker node itself.

docs · k8s.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade

Task 16

Secure the API Server (Anonymous Auth, Node,RBAC, NodeRestriction)

First, secure the cluster's API server configuring it as follows: Forbid anonymous authentication Use authorization mode Node,RBAC Use admission controller NodeRestriction The cluster uses the Docker Engine as its container…

docs · k8s.io/docs/reference/access-authn-authz/authentication

Domain 2 15% of CKS exam

Cluster Hardening

Restrict RBAC and service accounts, tighten API server flags, and keep the cluster patched.

Task 02

Create a TLS Secret for clever-cactus

Create a TLS Secret named clever-cactus in the clever-cactus namespace for an existing Deployment named clever-cactus. Use the following SSL files: | File | Path | |---|---| | Certificate |…

docs · k8s.io/docs/concepts/configuration/secret

Task 07

NetworkPolicies for Namespace Isolation

First, create a NetworkPolicy named deny-policy in the prod namespace to block all ingress traffic. The prod namespace is labeled env:prod.

docs · k8s.io/docs/concepts/services-networking/network-policies

Task 08

Cilium Ingress with TLS Termination and HTTP-to-HTTPS Redirect

Create an Ingress resource named web in the prod namespace and configure it as follows: Route traffic for host web.k8s.local and all paths to the existing Service web. Enable TLS termination using the existing Secret web-cert.

docs · k8s.io/docs/concepts/services-networking/ingress

Task 14

Configure Istio Mutual TLS (mTLS) Authentication

Istio is installed in the cluster. Deployment target-app runs in namespace app-ns; client-pod runs in namespace client-ns.

docs · istio.io/latest/docs/tasks/security/authentication/authn-policy

Domain 3 15% of CKS exam

System Hardening

Reduce the host attack surface with AppArmor, seccomp, and kernel hardening.

Task 13

Harden the Docker Daemon on a Node

Perform the following tasks to secure the cluster node: Remove user developer from the docker group. Do not remove the user from any other group.

docs · docs.docker.com/engine/security

Domain 4 20% of CKS exam

Minimize Microservice Vulnerabilities

Apply Pod Security Standards, securityContext, and mTLS, and protect secrets at rest.

Task 05

Enforce Container Immutability on lamp-deployment

Modify the existing Deployment named lamp-deployment, running in namespace lamp, so that its containers: run with user ID 20000 use a read-only root filesystem forbid privilege escalation The Deployment's manifest file can be…

docs · k8s.io/docs/tasks/configure-pod-container/security-context

Task 09

Lock Down ServiceAccount Token Automounting

First, modify the existing ServiceAccount stats-monitor-sa in the namespace monitoring to turn off automounting of API credentials.

docs · k8s.io/docs/tasks/configure-pod-container/configure-service-account

Task 12

Fix Deployment for Restricted Pod Security Standard

Namespace restricted-ns enforces the restricted Pod Security Standard. A Deployment pss-app in this namespace is currently non-compliant and its Pods cannot start.

docs · k8s.io/docs/concepts/security/pod-security-standards

Domain 5 20% of CKS exam

Supply Chain Security

Scan images for vulnerabilities, harden Dockerfiles, generate SBOMs, and enforce image policy.

Task 03

Fix a Vulnerable Dockerfile and Deployment Manifest

Analyze and edit the Dockerfile located at /home/candidate/subtle-bee/build/Dockerfile, fixing one instruction present in the file that is a prominent security/best-practice issue.

docs · k8s.io/docs/tasks/configure-pod-container/security-context

Task 11

Identify a Vulnerable Package and Generate an SPDX SBOM

The alpine Deployment in the alpine namespace has three containers that run different versions of the alpine image. First, find out which version of the alpine image contains the libcrypto3 package at version 3.1.4-r5.

docs · github.com/kubernetes-sigs/bom

Task 15

ImagePolicyWebhook Admission Control

Given an incomplete configuration located at /etc/kubernetes/bouncer and a functional container image scanner with an HTTPS endpoint at https://smooth-yak.local/review, perform the following tasks to implement a validating…

docs · k8s.io/docs/reference/access-authn-authz/admission-controllers

Domain 6 20% of CKS exam

Monitoring, Logging and Runtime Security

Detect threats at runtime with Falco, behavioral analytics, and audit logging.

Task 04

Finding a Pod Reading from /dev/mem

One of the Pods belonging to the application ollama is misbehaving. It is directly accessing the system's memory reading from the sensitive file /dev/mem. First, identify the misbehaving Pod accessing /dev/mem.

docs · falco.org/docs/concepts/rules

Task 06

Implement and Extend an API Server Audit Policy

First, reconfigure the cluster's API server, so that: the basic audit policy located at /etc/kubernetes/logpolicy/audit-policy.yaml is used, logs are stored at /var/log/kubernetes/audit-logs.txt, and a maximum of 2 logs are…

docs · k8s.io/docs/tasks/debug/debug-cluster/audit