Certified Kubernetes Security Specialist Exam Prep

Covers foundational cluster security setup tasks, including network policy enforcement, CIS benchmark review, ingress security, node metadata protection, dashboard hardening, and binary verification. These controls reduce exposure at the cluster boundary and help ensure trusted components are deployed.

• Task 1.1: Use Network security policies to restrict cluster level access
• Kubernetes NetworkPolicy resources (ingress/egress rules)
• Default-deny policies, namespace isolation
• Calico, Cilium, Weave Net CNI plugins for NetworkPolicy enforcement
• Task 1.2: Use CIS benchmark to review the security configuration of Kubernetes components
• CIS Kubernetes Benchmark scoring
• kube-bench tool for automated CIS audit

Key references: CKS official exam guide · ExamPal shared topic tree

Covers hardening of Kubernetes control plane access, RBAC design, service account token handling, and upgrade discipline. The domain emphasizes minimizing exposure through secure API server settings, least-privilege authorization, and timely version updates.

• Task 2.1: Restrict access to Kubernetes API
• API server flags: --anonymous-auth, --insecure-port, --authorization-mode
• API server audit logging configuration
• Task 2.2: Use Role Based Access Controls to minimize exposure
• ClusterRole vs Role, ClusterRoleBinding vs RoleBinding
• Aggregated ClusterRoles, default ClusterRoles (cluster-admin, edit, view)
• RBAC best practices: least privilege, named subjects

Key references: CKS official exam guide · ExamPal shared topic tree

Covers host operating system hardening, cloud IAM minimization, network exposure reduction, and kernel-level confinement tools. The domain focuses on reducing attack surface across nodes and workloads using platform and kernel controls.

• Task 3.1: Minimize host OS footprint (reduce attack surface)
• Removing unnecessary packages, services, ports
• Minimal container-optimized OS (Bottlerocket, Flatcar, COS)
• Task 3.2: Minimize IAM roles
• Cloud provider IAM least-privilege for cluster nodes
• IRSA (IAM Roles for Service Accounts) on EKS, Workload Identity on GKE
• Task 3.3: Minimize external access to the network

Key references: CKS official exam guide · ExamPal shared topic tree

Covers workload-level security controls that reduce microservice exposure, including pod security standards, secret management, runtime sandboxes, service mesh encryption, and pod/container security context settings. The domain emphasizes preventing privilege escalation and protecting sensitive data in multi-tenant environments.

• Task 4.1: Setup appropriate OS level security domains
• Pod Security Standards (Privileged, Baseline, Restricted)
• Pod Security Admission (PSA) labels at namespace level
• Migration from PodSecurityPolicy (deprecated) to PSA
• Task 4.2: Manage Kubernetes secrets
• Secret encryption at rest (--encryption-provider-config)
• External secret managers: HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager via ESO/CSO

Key references: CKS official exam guide · ExamPal shared topic tree

Covers securing container images and Kubernetes manifests throughout the software supply chain. Topics include minimizing base image footprint, image signing and verification, static analysis, policy enforcement, and vulnerability scanning in CI/CD.

• Task 5.1: Minimize base image footprint
• Distroless images, scratch images, Alpine vs Ubuntu base
• Multi-stage Docker builds to reduce final image size
• Task 5.2: Secure your supply chain: whitelist allowed image registries, sign and validate images
• ImagePolicyWebhook admission controller
• Cosign for image signing (Sigstore project)
• Notary, Connaisseur for image verification

Key references: CKS official exam guide · ExamPal shared topic tree

Covers runtime detection, threat hunting, forensic investigation, container immutability, and audit logging. The domain emphasizes observing behavior across hosts, containers, workloads, and Kubernetes control plane activity to detect and investigate malicious actions.

• Task 6.1: Perform behavioral analytics of syscall process and file activities at the host and container level to detect malicious activities
• Falco for runtime threat detection
• Tracee, Tetragon (eBPF-based)
• Custom Falco rules, default ruleset
• Task 6.2: Detect threats within physical infrastructure, apps, networks, data, users and workloads
• Cloud Security Posture Management (CSPM) tools
• Vulnerability management lifecycle

Key references: CKS official exam guide · ExamPal shared topic tree