What is the difference between CKA and CKAD?

CKA focuses on installing, configuring, and operating a Kubernetes cluster - control plane, nodes, networking, storage, and troubleshooting. CKAD focuses on building and deploying applications onto a cluster someone else manages, covering Pods, Deployments, ConfigMaps, Secrets, and application-level troubleshooting.

Do I need CKA before I can take CKS?

Yes. CKS is the only one of the three with a hard prerequisite: you must hold a current, active CKA certification to register for the CKS exam.

Do I need CKA before I can take CKAD?

No. CKAD has no prerequisite. You can take CKAD first if your role is application-focused and you never plan to administer a cluster directly.

Which is hardest: CKA, CKAD, or CKS?

CKS is generally considered the hardest, because it assumes CKA-level cluster knowledge and adds a security specialization on top. CKA is broader than CKAD, and CKAD is often the most approachable for developers who already write application code.

Are CKA, CKAD, and CKS multiple choice exams?

No. All three are performance-based exams. You solve real tasks on a live remote Kubernetes cluster using a terminal and kubectl, rather than choosing from answer options.

How long are the CKA, CKAD, and CKS exams?

Each is roughly two hours, delivered as a proctored, open-book, hands-on exam where you can reference the official Kubernetes documentation while you work.

How long is a Kubernetes certification valid for?

CKA, CKAD, and CKS are each valid for two years from the date you pass, reflecting how quickly the Kubernetes ecosystem and curriculum evolve.

Which Kubernetes certification should I take first?

Start with CKA if you work on cluster operations or platform engineering, or CKAD if your role is purely application development. Add CKS afterward once you hold CKA and want to specialize in security.

CKA vs CKAD vs CKS: Which Kubernetes Certification?

The Cloud Native Computing Foundation (CNCF) and the Linux Foundation offer three Kubernetes certifications, and the acronyms blur together fast: CKA, CKAD, and CKS. They share an exam format, a governing body, and a two-year validity period, but they test almost entirely different skills and are aimed at different jobs. This guide breaks down what each one actually measures, how difficult each is in practice, and the order that makes sense depending on whether you operate clusters, build applications, or focus on security.

The three certifications at a glance

Before the details, here is the short version of who each certification is for and what it proves.

CKA - Certified Kubernetes Administrator: for people who install, configure, and operate Kubernetes clusters. The broadest and most requested of the three.
CKAD - Certified Kubernetes Application Developer: for developers who build and deploy applications onto Kubernetes, not necessarily people who manage the cluster itself.
CKS - Certified Kubernetes Security Specialist: a deep, security-focused add-on that assumes CKA-level cluster knowledge and requires an active CKA to even register.

CKA: Certified Kubernetes Administrator

CKA is the administrator's exam. It covers cluster architecture and installation, upgrading and configuring control plane and worker nodes, workloads and scheduling, services and networking, storage, and - the largest single domain - troubleshooting a broken cluster or workload under time pressure. The audience is platform engineers, infrastructure engineers, SREs, and anyone whose job is keeping a cluster healthy rather than shipping code into it.

CKA is also the most commonly requested of the three in job postings, and it doubles as a strong general foundation: even developers who eventually take CKAD often find that a working knowledge of CKA-level cluster concepts makes everything else easier.

CKAD: Certified Kubernetes Application Developer

CKAD is written for developers, not administrators. It assumes you already know how to code and focuses on designing, building, and deploying applications on top of Kubernetes: writing Pod and Deployment manifests, using ConfigMaps and Secrets, multi-container Pod patterns, Jobs and CronJobs, application-level networking and Services, and troubleshooting an application from the developer's side rather than the cluster's side.

You do not need to know how to install or upgrade a cluster to pass CKAD, which is exactly why it appeals to application teams who consume a Kubernetes cluster someone else manages. A developer who is comfortable with YAML and the Kubernetes object model can often move faster through CKAD prep than through CKA.

CKS: Certified Kubernetes Security Specialist

CKS goes deep on a single concern: securing a Kubernetes cluster and the workloads running on it. Domains include cluster setup and hardening, host and system hardening, minimizing microservice vulnerabilities, supply chain security (image scanning, admission control, trusted registries), and runtime security, monitoring, and logging. It is written for security engineers and senior platform engineers, and it assumes you can already do everything CKA tests, then adds a security lens on top.

CKS has a hard prerequisite the other two do not: you must hold a current, active CKA certification to register for the CKS exam. It is the only cross-certification requirement in the CNCF Kubernetes lineup, so CKA has to come first no matter which path you are on.

All three are performance-based, not multiple choice

This is the detail that surprises people coming from other certification programs. CKA, CKAD, and CKS are not multiple-choice exams. Each one is a performance-based, hands-on exam delivered on a live remote Kubernetes cluster through a browser terminal. You are given a set of tasks - fix this broken Deployment, create a NetworkPolicy that restricts traffic, harden this Pod's security context - and you solve them directly with kubectl and a text editor, under a timer, with a proctor watching over a remote session.

Format: live cluster, terminal access, no answer choices to pick from.
Duration: roughly two hours for each exam.
Open book: you are allowed to reference the official Kubernetes documentation and a short list of other approved sites during the exam.
Validity: certifications are valid for two years from the date you pass.

Difficulty, ranked

Difficulty depends heavily on your background, but a reasonable general ranking from a cluster-operations starting point looks like this:

CKAD - often the most approachable of the three for people who already write application code, since it does not require deep cluster-administration knowledge.
CKA - broader in scope than CKAD, with more cluster-level plumbing (networking, storage, control plane components) and a heavier troubleshooting emphasis.
CKS - generally considered the hardest, because it assumes CKA-level fluency and then layers on security concepts (admission controllers, runtime detection, supply chain tooling) that most engineers have less day-to-day exposure to.

Which order should you take them in?

None of these exams have a prerequisite exam requirement except CKS, so in theory you could attempt any of CKA or CKAD first. In practice, the order usually follows your role.

Platform, infrastructure, or SRE track: start with CKA. It is the closest match to the job and opens the door to CKS later.
Application development track: start with CKAD. If your role never touches cluster administration, CKAD alone may be all you need.
Security track: CKA first, then CKS. There is no way around this order since CKS requires an active CKA to register.
Generalist or DevOps-leaning role: CKA, then CKAD to round out the application side, then CKS if security becomes part of your responsibilities.

Explore all Kubernetes practice exams

Building the knowledge before you sit the real exam

Because the real CKA, CKAD, and CKS exams are hands-on rather than multiple choice, no practice question bank can fully replicate sitting at a live terminal under a timer. What structured practice questions are genuinely good for is building the conceptual foundation first: knowing what a NetworkPolicy actually restricts, which object you would reach for to store a Secret versus a ConfigMap, how RBAC bindings are structured, and why a given troubleshooting scenario points to one command over another. Get that foundation solid with practice questions, then move into hands-on labs on a real or sandboxed cluster to build the muscle memory the exam actually tests.

Bottom line

Choose CKA if you operate clusters, CKAD if you build applications for them, and add CKS once you hold CKA and want to specialize in security. All three are performance-based hands-on exams administered by the Linux Foundation on behalf of CNCF, so however you sequence them, plan to pair concept study with real terminal practice before exam day.

Practice CKA free