Certifications for DevSecOps
Three certifications come up again and again when DevSecOps engineers compare notes: a hands-on generalist exam, a Kubernetes-specific specialist exam, and a cloud-provider specialty exam. They test different things in different ways — one puts you on a live environment with five challenges and no multiple-choice safety net, one drops you onto real clusters for two hours and won't even let you register without a prerequisite already in hand, and one asks sixty-five questions about identity, encryption, and incident response across a single cloud platform. None of the three is a superset of the others, and none of them is a checklist you work through in order. This page covers what each one actually tests, what it costs in time and prerequisites, and which lessons on this site map onto which exam.
Imagine three different tests for three different jobs. One test hands you a busted go-kart and says "fix it, we're timing you" — no essay questions, just tools and a clock. Another test won't even let you in the room unless you've already passed an easier test on the same go-kart. And the third test asks you a hundred questions — well, sixty-five — about one specific brand of go-kart: where the fuel line runs, who's allowed to drive it, what to do if it catches fire — but you answer by picking from a list instead of turning a single bolt. All three prove something real. None of them proves the same thing.
The landscape
☺ Like you're 10: One test says "prove you can fix it," one test says "prove you already passed a different test first," and one test says "prove you know this one brand really well."
The three certifications split along two independent axes, and it's worth separating them before picking one. The first axis is assessment style: the Certified DevSecOps Professional (CDP) and the Certified Kubernetes Security Specialist (CKS) are both entirely performance-based — you're graded on what you actually did to a live environment, not on which box you checked — while the AWS Certified Security – Specialty exam is multiple-choice and multiple-response, testing whether you know the right answer rather than whether you can produce it under a clock. The second axis is scope: CDP is a general DevSecOps practitioner exam that isn't tied to any one platform, CKS is narrow and deep on exactly one technology, and the AWS exam is broad across one cloud provider's entire security surface — identity, encryption, logging, incident response — rather than narrow on one tool.
There's also a natural ordering hidden in the prerequisites, even though none of the three formally requires the others. CKS is the only one of the three gated behind a different certification entirely — you cannot sit it without an active CKA — which makes it structurally the wrong place to start if Kubernetes fluency isn't already established. CDP and the AWS exam both have no formal prerequisite, which is part of why either is a more natural first stop: CDP if the gap you want to close is "can I actually do the work," the AWS exam if the gap is "do I know one specific cloud's security services well enough to be trusted with them."
Certified DevSecOps Professional (CDP)
☺ Like you're 10: No quiz. You get a real broken environment, five challenges to fix, and a clock — then you have to write down what you did.
The Certified DevSecOps Professional is a vendor certification from Practical DevSecOps, a training and certification provider built specifically around hands-on DevSecOps skill rather than a broad general-IT catalog. It exists for practitioners who want proof they can actually do the work — find a vulnerability, exploit it, remediate it, harden the pipeline that let it through — rather than proof they recognize the right vocabulary on a form. It's aimed at engineers already doing DevSecOps work, or about to, who want a credential that can't be passed by memorizing flashcards.
The format is the whole point: 100% practical and task-based, with no multiple-choice component anywhere. Candidates work through 5 challenges, each containing multiple tasks, against a live environment — not a simulated quiz interface. Chatbots and AI assistants are explicitly not allowed during the exam window, which keeps the test measuring the candidate's own hands rather than a model's.
| Item | Detail |
|---|---|
| Format | 100% practical / task-based — no multiple-choice questions |
| Structure | 5 challenges, each with multiple tasks, on a live environment |
| Duration | 6 hours to complete the challenges (verify at the vendor's own page) |
| Report submission | Up to 24 hours after the challenge window to submit a written report (PDF, Markdown, or screenshots as evidence) |
| AI / chatbot policy | Not allowed during the exam |
| Prerequisites | None formally required; the vendor's own course content is the expected preparation |
| Passing score | Not published |
| Validity | Not published |
The connection to this course is direct rather than incidental — the practical challenges are testing exactly the muscle this course builds. The secure SDLC covers the phase-by-phase discipline of catching issues before they ship, which is the same instinct a live, timed challenge rewards. SAST, DAST & SCA covers the scanning categories a candidate needs to actually run and interpret, not just define. And security in CI/CD covers the pipeline-hardening controls a hands-on challenge environment is likely to exercise in some form. None of that is a guarantee of specific exam content — Practical DevSecOps doesn't publish a domain breakdown for the five challenges — but a candidate who can execute what these three lessons describe is closer to exam-ready than one who has only read about it.
↗ Practical DevSecOps official page
Certified Kubernetes Security Specialist (CKS)
☺ Like you're 10: You don't get to take this test until you've already passed a different one — and once you're in, it's all real clusters, no clicking multiple choice.
The Certified Kubernetes Security Specialist is run by the Linux Foundation under the CNCF's certification program — the same body behind the CKA and CKAD. It's aimed at engineers who already operate Kubernetes in production and now own, or want to own, the security half of that job: hardening clusters, minimizing the attack surface of running workloads, and securing the software supply chain that feeds them. It is not an entry point into Kubernetes; it assumes that fluency already exists.
Like the CDP, the format is 100% performance-based — live command-line tasks against real clusters, no multiple choice anywhere in the exam. Unlike the CDP, it carries a hard, formal gate: candidates must hold an active, non-expired CKA certification on the date they sit the CKS exam. This is the only CNCF exam with a formal prerequisite of this kind, which is why it isn't the certification to start with if Kubernetes administration isn't already a passed, current credential.
| Item | Detail |
|---|---|
| Format | 100% performance-based — live command-line tasks on real clusters, no multiple choice |
| Duration | 2 hours |
| Passing score | 67% |
| Prerequisite | An active, non-expired CKA certification on the date of the CKS exam — the only CNCF exam with a formal prerequisite |
| Domain | Weight |
|---|---|
| Minimize Microservice Vulnerabilities | 20% |
| Supply Chain Security | 20% |
| Monitoring, Logging and Runtime Security | 20% |
| Cluster Setup | 10% |
| Cluster Hardening | 15% |
| System Hardening | 15% |
Two of those domains map straight onto lessons already on this site. The 20% Supply Chain Security domain is the CKS-exam version of container & supply-chain security — image scanning, base-image hygiene, and provenance, applied specifically to how images move into a cluster. And the Cluster Hardening and System Hardening domains, 15% and 10%, are the enforcement layer IaC security & policy as code describes in the abstract — RBAC, admission control, and policy-as-code, made concrete against a real API server instead of a diagram.
↗ Linux Foundation official page
AWS Certified Security – Specialty (SCS-C03)
☺ Like you're 10: A sixty-five-question quiz about keeping one specific cloud locked down — who can log in, what's encrypted, who's watching the logs.
The AWS Certified Security – Specialty exam is run directly by AWS as part of its own certification program, the same one behind the Solutions Architect and Developer tracks. It's aimed at security engineers, security architects, and anyone whose job is defending workloads that run specifically on AWS — where CDP is platform-agnostic and CKS is Kubernetes-only, this exam is bounded by a single cloud provider's own service catalog, examined in depth.
Unlike the other two, the format is multiple-choice and multiple-response — a knowledge exam, not a live-environment task exam. AWS does not require a specific prerequisite certification, but it does publish a recommendation: 5 years of IT security experience, with 2 or more years specifically securing AWS workloads. That recommendation isn't enforced at registration, but it's a real signal about the level the exam is pitched at.
| Item | Detail |
|---|---|
| Format | Multiple-choice and multiple-response |
| Question count | 65 total — 50 scored, 15 unscored (unscored questions are used by AWS for future exam research and aren't counted toward the score) |
| Duration | 170 minutes |
| Passing score | A scaled score of 750 out of 1000 |
| Prerequisites | None formally required; AWS recommends 5 years of IT security experience, including 2+ years securing AWS workloads |
This exam lines up with the cloud-specific half of this course. Cloud security posture covers the shared-responsibility line and the misconfiguration categories — public buckets, over-permissioned roles, open management ports — that the exam tests as AWS-specific service configuration. IaC security & policy as code covers catching those same misconfigurations before they're deployed, the preventive half of what a candidate is expected to be able to design. And compliance & governance covers the evidence and audit trail that AWS-specific logging and monitoring exist to produce — the "prove it" half of what the exam is really asking.
Which one should you take?
☺ Like you're 10: Pick based on what you actually do all day, not on which badge sounds the most impressive.
There isn't one universally correct order here, because the three aren't rungs on a single ladder — they're answers to three different questions about what you do day to day.
| If you... | Consider | Because |
|---|---|---|
| Want to prove hands-on DevSecOps skill without committing to one cloud or one orchestrator | CDP | No prerequisite, 100% practical, platform-agnostic — the broadest hands-on proof of the three |
| Already hold a current CKA and own cluster security in production | CKS | The deepest and narrowest of the three, and the only one that requires a different certification already in hand |
| Work primarily inside AWS and need to prove breadth across its security services | AWS Security – Specialty | Knowledge-based rather than hands-on, but the only one of the three that tests one cloud provider's full security surface in depth |
| Don't yet run Kubernetes in production, or don't hold a CKA | Not CKS, not yet | The exam is literally unbookable without an active CKA — no amount of extra studying works around a missing prerequisite |
Exam codes, prices, question formats, and prerequisite rules change without much warning — vendors have retired entire exam versions with a few weeks' notice, and certification pages get revised regularly enough that a fact copied from an old blog post is a real risk. Everything on this page reflects what each vendor published as of August 2026. Before you register or build a study plan around any number here — duration, passing score, price, prerequisite wording — check it against the vendor's own current page, linked above for each certification. Treat this page as a map for choosing between the three, not as the final word on any one exam's logistics.
Foxy: Okay, I've got budget for one certification this quarter. Which one?
Professor Owl: Depends what you're actually short on. If it's "can I do the work under pressure," that's the CDP — five challenges, a live environment, no multiple choice to hide behind.
Timmy the Turtle: And if you're eyeing the CKS, check your CKA first. It's not a suggestion, it's a locked door — no active CKA, no CKS booking, full stop.
Foxy: We don't run much Kubernetes yet. Most of what we ship goes straight onto AWS.
Professor Owl: Then the AWS Security Specialty is the one that actually matches your day job. Sixty-five questions, no cluster required — but don't mistake "multiple choice" for "easy." AWS recommends five years of security experience behind it for a reason.
Timmy the Turtle: One certification that matches your actual work beats three that don't.
1. Which of the three certifications is the only one with a formal prerequisite, and what is it? 2. Which two of the three are 100% performance-based, and which one is multiple-choice? 3. How many total questions does the AWS exam have, and how many of those are actually scored? 4. What's the passing score for CKS? 5. If a candidate doesn't hold a CKA yet, which of the three is unavailable to them regardless of how much they study?
Check your answers
- The CKS — it requires an active, non-expired CKA certification on the date the CKS exam is taken. It's the only CNCF exam with a formal prerequisite.
- CDP and CKS are both 100% performance-based (a live environment and live clusters, no multiple choice). The AWS Certified Security – Specialty exam is multiple-choice and multiple-response.
- 65 total questions, of which 50 are scored — the other 15 are unscored, used by AWS for future exam research, and don't count toward the result.
- 67%.
- CKS. It's gated behind an active CKA regardless of preparation — no amount of studying substitutes for holding the prerequisite certification.