CKS Exam Prep 2026 Updated Practice Questions
Comprehensive Kubernetes Security Certification
Review | Detailed Rationales | Verified Answers |
Complete Success Workbook
Exam Reference: Certified Kubernetes Security Specialist (CKS)
Exam Details:
• Format: 100% performance-based (hands-on, terminal-based)
• Duration: 2 hours
• Questions: ~15–20 performance-based tasks
• Passing Score: ~67% (CNCF does not publish exact score)
• Cost: $445 USD (includes one free retake)
• Validity: 2 years
• Prerequisite: Valid CKA certification (must be current)
• Environment: Remote proctored, browser-based terminal access
• Documentation: kubernetes.io/docs and kubernetes.io/blog allowed
• Kubernetes Version: v1.34–v1.35 (2026)
IMPORTANT NOTE: The actual CKS exam is 100% performance-
based — you work in a live Kubernetes cluster and complete real security tasks.
The multiple-choice questions in this guide are designed to test your conceptual
knowledge and reinforce the understanding needed to succeed on the performance-
based exam. Hands-on practice with kubectl, security tools (kube-bench, Trivy,
Falco, OPA/Gatekeeper, AppArmor, Seccomp), and real clusters is absolutely
essential.
Exam Domains & Weighting:
,Domain Weight
1. Cluster Setup 15%
2. Cluster Hardening 15%
3. System Hardening 10%
4. Minimize Microservice Vulnerabilities 20%
5. Supply Chain Security 20%
6. Monitoring, Logging, and Runtime Security 20%
Key 2026 Updates:
• Cluster Setup weight increased from 10% to 15% (new focus on Ingress
with TLS)
• System Hardening refined to 10% with emphasis on least-privilege IAM
and kernel hardening
• Supply Chain Security now includes SBOM (Software Bill of Materials)
requirements
• Microservice Vulnerabilities (20%) and Supply Chain Security (20%)
remain tied as highest-weighted domains
• Open book: kubernetes.io/docs allowed during the exam
DOMAIN 1: CLUSTER SETUP (15%)
Question 1
A Kubernetes administrator is setting up a new cluster and needs to ensure that the
,API server only accepts requests from clients with valid certificates. Which API
server flag should be configured to enforce client certificate authentication?
A) --client-ca-file
B) --tls-cert-file
C) --requestheader-client-ca-file
D) --kubelet-client-certificate
Answer: A
Rationale: --client-ca-file specifies the Certificate Authority (CA) bundle used to
validate client certificates for authentication. This enforces that only clients
presenting valid certificates signed by the specified CA can authenticate to the API
server. --tls-cert-file (B) is for the server's own TLS certificate, not client
authentication. --requestheader-client-ca-file (C) is used for authentication proxy
request headers (e.g., for aggregator). --kubelet-client-certificate (D) is for the API
server's client certificate when connecting to kubelets.
Question 2
A cluster administrator needs to enable audit logging to track all API requests for
compliance purposes. Which API server flag enables audit logging and specifies
the audit policy file?
A) --audit-log-path and --audit-policy-file
B) --audit-log-maxage and --audit-log-maxbackup
C) --audit-log-format
D) --audit-dynamic-configuration
Answer: A
Rationale: --audit-log-path specifies the file path where audit logs are written,
and --audit-policy-file specifies the audit policy file that defines which events are
logged and at what level. --audit-log-maxage (B) and --audit-log-maxbackup (B)
control log rotation, not enabling audit logging. --audit-log-format (C) specifies the
log format (json or legacy). --audit-dynamic-configuration (D) enables dynamic
audit configuration.
, Question 3
A cluster is being set up with strict network isolation requirements. The
administrator needs to ensure that Pods in different namespaces cannot
communicate by default unless explicitly allowed. Which Kubernetes resource
should be deployed to enforce this?
A) NetworkPolicy with a deny-all rule applied to all namespaces
B) NetworkPolicy with a default-deny ingress rule applied to each namespace
C) Service with externalTrafficPolicy: Local
D) Ingress with TLS termination
Answer: B
Rationale: A NetworkPolicy with a default-deny ingress rule (and optionally
egress) applied to each namespace ensures that no Pods in that namespace can
receive traffic unless explicitly allowed by another NetworkPolicy. This is the
standard approach for network isolation in Kubernetes. Option A would require
applying a policy that selects all Pods, which is less granular. Option C affects
external traffic routing, not namespace isolation. Option D is for HTTP routing, not
network isolation.
Question 4
A cluster administrator is securing the Kubernetes API server. Which of the
following is the MOST secure way to control access to the API server?
A) Disable anonymous authentication and enable RBAC
B) Enable anonymous authentication and use Webhook authentication
C) Use only basic authentication (username/password)
D) Disable all authentication and rely on network security
Answer: A
Rationale: Disabling anonymous authentication and enabling RBAC (Role-Based
Access Control) is the most secure approach. Anonymous authentication allows
unauthenticated requests, which is a security risk. Webhook authentication (B) can
be secure but is not the primary recommended approach. Basic authentication (C)
transmits credentials in plaintext and is deprecated/disabled in modern Kubernetes.
Disabling all authentication (D) is a severe security risk.
Comprehensive Kubernetes Security Certification
Review | Detailed Rationales | Verified Answers |
Complete Success Workbook
Exam Reference: Certified Kubernetes Security Specialist (CKS)
Exam Details:
• Format: 100% performance-based (hands-on, terminal-based)
• Duration: 2 hours
• Questions: ~15–20 performance-based tasks
• Passing Score: ~67% (CNCF does not publish exact score)
• Cost: $445 USD (includes one free retake)
• Validity: 2 years
• Prerequisite: Valid CKA certification (must be current)
• Environment: Remote proctored, browser-based terminal access
• Documentation: kubernetes.io/docs and kubernetes.io/blog allowed
• Kubernetes Version: v1.34–v1.35 (2026)
IMPORTANT NOTE: The actual CKS exam is 100% performance-
based — you work in a live Kubernetes cluster and complete real security tasks.
The multiple-choice questions in this guide are designed to test your conceptual
knowledge and reinforce the understanding needed to succeed on the performance-
based exam. Hands-on practice with kubectl, security tools (kube-bench, Trivy,
Falco, OPA/Gatekeeper, AppArmor, Seccomp), and real clusters is absolutely
essential.
Exam Domains & Weighting:
,Domain Weight
1. Cluster Setup 15%
2. Cluster Hardening 15%
3. System Hardening 10%
4. Minimize Microservice Vulnerabilities 20%
5. Supply Chain Security 20%
6. Monitoring, Logging, and Runtime Security 20%
Key 2026 Updates:
• Cluster Setup weight increased from 10% to 15% (new focus on Ingress
with TLS)
• System Hardening refined to 10% with emphasis on least-privilege IAM
and kernel hardening
• Supply Chain Security now includes SBOM (Software Bill of Materials)
requirements
• Microservice Vulnerabilities (20%) and Supply Chain Security (20%)
remain tied as highest-weighted domains
• Open book: kubernetes.io/docs allowed during the exam
DOMAIN 1: CLUSTER SETUP (15%)
Question 1
A Kubernetes administrator is setting up a new cluster and needs to ensure that the
,API server only accepts requests from clients with valid certificates. Which API
server flag should be configured to enforce client certificate authentication?
A) --client-ca-file
B) --tls-cert-file
C) --requestheader-client-ca-file
D) --kubelet-client-certificate
Answer: A
Rationale: --client-ca-file specifies the Certificate Authority (CA) bundle used to
validate client certificates for authentication. This enforces that only clients
presenting valid certificates signed by the specified CA can authenticate to the API
server. --tls-cert-file (B) is for the server's own TLS certificate, not client
authentication. --requestheader-client-ca-file (C) is used for authentication proxy
request headers (e.g., for aggregator). --kubelet-client-certificate (D) is for the API
server's client certificate when connecting to kubelets.
Question 2
A cluster administrator needs to enable audit logging to track all API requests for
compliance purposes. Which API server flag enables audit logging and specifies
the audit policy file?
A) --audit-log-path and --audit-policy-file
B) --audit-log-maxage and --audit-log-maxbackup
C) --audit-log-format
D) --audit-dynamic-configuration
Answer: A
Rationale: --audit-log-path specifies the file path where audit logs are written,
and --audit-policy-file specifies the audit policy file that defines which events are
logged and at what level. --audit-log-maxage (B) and --audit-log-maxbackup (B)
control log rotation, not enabling audit logging. --audit-log-format (C) specifies the
log format (json or legacy). --audit-dynamic-configuration (D) enables dynamic
audit configuration.
, Question 3
A cluster is being set up with strict network isolation requirements. The
administrator needs to ensure that Pods in different namespaces cannot
communicate by default unless explicitly allowed. Which Kubernetes resource
should be deployed to enforce this?
A) NetworkPolicy with a deny-all rule applied to all namespaces
B) NetworkPolicy with a default-deny ingress rule applied to each namespace
C) Service with externalTrafficPolicy: Local
D) Ingress with TLS termination
Answer: B
Rationale: A NetworkPolicy with a default-deny ingress rule (and optionally
egress) applied to each namespace ensures that no Pods in that namespace can
receive traffic unless explicitly allowed by another NetworkPolicy. This is the
standard approach for network isolation in Kubernetes. Option A would require
applying a policy that selects all Pods, which is less granular. Option C affects
external traffic routing, not namespace isolation. Option D is for HTTP routing, not
network isolation.
Question 4
A cluster administrator is securing the Kubernetes API server. Which of the
following is the MOST secure way to control access to the API server?
A) Disable anonymous authentication and enable RBAC
B) Enable anonymous authentication and use Webhook authentication
C) Use only basic authentication (username/password)
D) Disable all authentication and rely on network security
Answer: A
Rationale: Disabling anonymous authentication and enabling RBAC (Role-Based
Access Control) is the most secure approach. Anonymous authentication allows
unauthenticated requests, which is a security risk. Webhook authentication (B) can
be secure but is not the primary recommended approach. Basic authentication (C)
transmits credentials in plaintext and is deprecated/disabled in modern Kubernetes.
Disabling all authentication (D) is a severe security risk.
