Learn CKS Training

Prepare for the Certified Kubernetes Security Specialist (CKS) exam with a structured, hands-on learning path. This roadmap focuses on practical Kubernetes security across cluster and system hardening, minimizing microservice vulnerabilities, supply chain security, and monitoring, logging, and runtime security, plus performance-based exam tasks and real-world cloud-native scenarios. Guided CKS courses, labs, and mock exam practice will be added over time to help you build skills aligned with CKS objectives.

27 Skills|3 Courses

CKS Prep

CKS Training Courses

CKS Prep

Beginner

kubernetesckscertification

A beginner-friendly CKS preparation course with 45 guided Kubernetes security labs arranged from security foundations to cluster setup, hardening, workload security, supply chain, audit, and runtime investigation.

Completed 0 of 45 Labs

Security Foundations for Kubernetes

Map Kubernetes Security Boundaries

Collect Security Evidence with kubectl

Review Namespaces and Tenant Isolation

Inspect RBAC Subjects and Permissions

Inspect ServiceAccount Token Behavior

Apply Pod Security Standards

Cluster Setup Security

Restrict Namespace Traffic with NetworkPolicy

Allow DNS Through Default-Deny Egress

Publish Ingress with TLS

Deny Workload Access to Node Metadata

Verify Kubernetes Binaries

Review CIS Findings with kube-bench

Check Admission and Pod Security Readiness

Cluster Hardening

Minimize a Role's Permissions

Reduce an Overprivileged ClusterRoleBinding

Disable Default ServiceAccount Token Mounts

Scope a Namespace Operator Role

Block API Server Proxy Escalation

Contain a Leaked ServiceAccount Token

Audit Access to Sensitive Resources

System and Node Hardening

Inspect Host Attack Surface Safely

Disable a Host Debug Service

Review kubelet Exposure

Review AppArmor Profile Enforcement on a Workload

Install a Local seccomp Profile

Remove HostPath Access from a Workload

Workload and Microservice Security

Harden a Pod Security Context

Drop Linux Capabilities

Run Containers as Non-Root

Protect Secrets with Projected Files

Rotate and Constrain Application Secrets

Isolate a Risky Sidecar Boundary

Enforce Immutable Runtime Containers

Quarantine a Suspicious Workload

Supply Chain Security

Build a Minimal Approved Image

Scan Workload Manifests with kube-linter

Scan Helm Output with kube-linter

Verify SBOM and Checksum Evidence

Enforce Trusted Image Registries

Remove Build Secrets from an Image

Monitoring, Audit, and Runtime Security

Review Audit Events for Secret Access

Investigate Unauthorized API Activity

Detect Suspicious Runtime Processes

Detect Runtime File Drift

Restore Policy from Audit Evidence

CKS Practice Exam 01

Advanced

kubernetesckscertification

A hands-on CKS practice exam with 20 independent Kubernetes security challenges covering cluster setup, cluster hardening, system hardening, microservice vulnerability reduction, supply chain security, and runtime security.

Completed 0 of 20 Labs

CKS Practice Exam 02

Advanced

kubernetesckscertification

A second independent CKS-style practice exam with 20 Kubernetes security challenges covering the public CKS domains through different operational security scenarios.

Completed 0 of 20 Labs