CertGrid CertGrid
Concepts·Certified Kubernetes Security Specialist

Moving from KCSA to CKS

If you have come from KCSA you already know most of the vocabulary, and that is worth less than it feels. This guide counts twenty security terms across both question banks to show where CKS goes deeper, where it asks about tools KCSA never names, and - just as usefully - where KCSA was actually the heavier exam.

Orientation Guide 2 of 40 Beginner

Written against the versions above. Term frequency is a crude measure and an honest one: it counts how often each term appears in each pool, as a percentage of that pool's own size, so the two columns are comparable despite the different pool sizes.

The cka6001 cluster: one control plane and 2 schedulable workers, on Cilium.
Server NameIP AddressOSRolesCPURAMHDD
CKA6001192.168.0.46Ubuntu 26.04 LTSControl Plane Node (tainted NoSchedule)2 Core4 GB50 GB
CKA6001-NODE01192.168.0.47Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA6001-NODE02192.168.0.48Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB

Before you start

  1. Twenty terms, counted across both banks

    871 CKS questions against 889 KCSA ones.

    bash Example session 
    cd ~/cksmock && python3 overlap.pyterm                      CKS (n=871)   KCSA (n=889)   verdict---------------------- -------------- --------------   ------------------------rbac                      120   13.8%    194   21.8%   heavier in KCSAnetwork policy             86    9.9%     80    9.0%   carries oversecrets                   117   13.4%    180   20.2%   heavier in KCSAservice account            96   11.0%    142   16.0%   carries overpod security               54    6.2%     66    7.4%   carries overadmission control         117   13.4%    129   14.5%   carries overaudit logging             165   18.9%    125   14.1%   carries overimage / registry          159   18.3%    171   19.2%   carries overetcd                       53    6.1%    142   16.0%   heavier in KCSAkubelet                   146   16.8%    150   16.9%   carries overseccomp                    54    6.2%     34    3.8%   deeper in CKSapparmor                   22    2.5%      5    0.6%   NEW ground for CKSruntime sandbox            34    3.9%     27    3.0%   carries overimage signing              64    7.3%     62    7.0%   carries oversbom                       19    2.2%     10    1.1%   deeper in CKSstatic analysis             7    0.8%      2    0.2%   deeper in CKScis / kube-bench           36    4.1%     27    3.0%   carries overruntime detection          86    9.9%     34    3.8%   deeper in CKSmtls / service mesh        28    3.2%     25    2.8%   carries overupgrade / patching         17    2.0%      3    0.3%   NEW ground for CKS

    Expected resultA verdict per term - carries over, deeper in CKS, heavier in KCSA, or NEW ground for CKS.

    Success conditionYou know which parts of your KCSA revision to reuse and which to start from scratch.

  2. The same table, sorted into a plan

    Ratio between the two banks, cut into the three things you do with it.

    bash Example session 
    cd ~/cksmock && python3 gaps.pyLEARN FROM ZERO   barely in the KCSA bank, named in the CKS blueprint    upgrade / patching     CKS   2.0%   KCSA   0.3%   x5.8    apparmor               CKS   2.5%   KCSA   0.6%   x4.5    static analysis        CKS   0.8%   KCSA   0.2%   x3.6    runtime detection      CKS   9.9%   KCSA   3.8%   x2.6 PRACTISE          same ground, asked harder    sbom                   CKS   2.2%   KCSA   1.1%   x1.9    seccomp                CKS   6.2%   KCSA   3.8%   x1.6    cis / kube-bench       CKS   4.1%   KCSA   3.0%   x1.4    audit logging          CKS  18.9%   KCSA  14.1%   x1.3    runtime sandbox        CKS   3.9%   KCSA   3.0%   x1.3 REVISE            carries over, or was heavier in KCSA    mtls / service mesh    CKS   3.2%   KCSA   2.8%   x1.1    network policy         CKS   9.9%   KCSA   9.0%   x1.1    image signing          CKS   7.3%   KCSA   7.0%   x1.1    kubelet                CKS  16.8%   KCSA  16.9%   x1.0    image / registry       CKS  18.3%   KCSA  19.2%   x0.9    admission control      CKS  13.4%   KCSA  14.5%   x0.9    pod security           CKS   6.2%   KCSA   7.4%   x0.8    service account        CKS  11.0%   KCSA  16.0%   x0.7    secrets                CKS  13.4%   KCSA  20.2%   x0.7    rbac                   CKS  13.8%   KCSA  21.8%   x0.6    etcd                   CKS   6.1%   KCSA  16.0%   x0.4

    Expected resultLEARN FROM ZERO - upgrade/patching at x5.8, apparmor x4.5, static analysis x3.6, runtime detection x2.6. Then PRACTISE, then REVISE, which ends with etcd CKS 6.1% KCSA 16.0% x0.4.

    Success conditionYou will not assume CKS is simply KCSA with more of everything.

Troubleshooting

Official sources

← All CKS guides