CKS Study Plan

This plan assumes something the CKS itself checks at registration: you already hold an active, non-expired CKA. That's not a formality — see CKS — the exam for the prerequisite explained in full — and it changes what a study plan for this exam actually needs to do. It doesn't need to rebuild kubectl fluency or the object model from nothing; the CKA already proved you have both. What it needs to do is redirect that fluency at one narrower question, asked six different ways: not "does this apply cleanly" but "does this actually close the hole." The exam's own math tells you where the hours belong. Six domains, and unlike the CKA's one dominant domain, CKS spreads its weight across three domains tied at 20% each — Minimize Microservice Vulnerabilities, Supply Chain Security, and Monitoring, Logging and Runtime Security — worth 60% of the score between them. This page lays out an eight-week plan sized to that shape, pointing at this course's own blueprint, deep dives and labs, plus genuine cross-links into DevSecOps's supply-chain and runtime shelves for the two areas this course deliberately keeps light.

The domain-weighted study budget

☺ Like you're 10: Six parts to the test, and they're not sized the same — three of them are worth double the other three, so your calendar shouldn't treat all six equally.

These are the six domains and weights exactly as published in the CNCF's CKS Exam Curriculum, version 1.34 — the same version the CKS exam page transcribes in full, including the worked examples for each one. This page doesn't re-derive that substance; it turns the same six weights into a calendar. There are six domains, no sub-weights, and they sum to exactly 100% — 15 + 15 + 10 + 20 + 20 + 20.

Underneath those six percentages sit 26 published competencies — 5 in Cluster Setup, 4 each in Cluster Hardening, System Hardening, Minimize Microservice Vulnerabilities and Supply Chain Security, and 5 in Monitoring, Logging and Runtime Security. Turning weight into an hours budget, in the curriculum's own domain order:

Add roughly ~8 hours to stand up a security-oriented lab and ~15 for timed mocks and a final readiness pass, for a full plan of about ~123 hours across eight weeks — call it 15 hours a week. That total is deliberately lighter than the CKA plan's ~125–130, not because CKS is the easier exam — it demonstrably isn't — but because this plan doesn't have to spend a foundations week teaching kubectl fluency the CKA already certified. Compress the proportions into five or six weeks if you already run security tooling daily; stretch to ten if study time is scarce. The ratio between domains, not the total, is what this plan is actually protecting.

An eight-week roadmap

☺ Like you're 10: Here's the actual calendar — which week gets which domain, and exactly which pages on this course, and occasionally on DevSecOps, to use that week.

Eight weeks, sized to the budget above. No single domain gets two full weeks the way CKA's Troubleshooting did — even the biggest CKS domain, at 20%, is smaller than CKA's 30% — so each of the six domains gets exactly one focused week, with the three 20% domains stacked back to back in weeks 5–7 so the momentum carries. The plan opens with a foundations week that isn't a scored domain at all, and closes the same way, entirely on timed practice.

What changes once grading asks "did this actually close the hole"

☺ Like you're 10: Applying a rule without an error message isn't the same as the rule actually working — the exam only credits the second one, and only your own testing tells them apart.

The CKA already taught you that grading looks at end state, not intent. CKS sharpens that same habit into something more specific: for every control you apply, try to do the exact thing it's supposed to now prevent, and confirm — don't assume — that it's prevented. A NetworkPolicy that applied without error and a NetworkPolicy that actually drops the packet are two different facts, and the exam only ever scores the second one.

# after a default-deny NetworkPolicy — prove the deny, don't assume it
kubectl exec -n payments deploy/api -- wget -T2 -qO- http://other-svc.storefront.svc.cluster.local \
  || echo "blocked, as expected"

# after labeling a namespace enforce=restricted — prove the rejection message
# actually reads the way you think it does
kubectl apply -f privileged-pod.yaml --dry-run=server    # should fail; read every line it names

# after a Kyverno/Gatekeeper signature gate — prove an unsigned image
# is refused at admission, not merely warned about
kubectl run probe --image=registry.internal/unsigned-test:latest   # should be denied, not just logged

Resources: this course, borrowed depth, and timed practice

☺ Like you're 10: Two of the six domains here go past what this course teaches on its own — know exactly when the plan means for you to open a different course.

Studying "everything you can find" wastes hours; studying the right resource for the right week doesn't. This table is deliberately honest about which pages belong to this course and which are borrowed.

Keep a running weak-spot log rather than trusting memory — the Field Notes page on this course is built for exactly that, and rereading it in week 8 is usually faster than re-doing a whole domain from scratch.

Readiness checkpoint — are you actually ready to book

☺ Like you're 10: Don't book the exam because the calendar says week 8 — book it once you can actually do these things, cold, under a clock, and once the other badge is still valid too.

Booking on a date rather than on readiness is the single most common way people waste an exam fee, and CKS adds a wrinkle the CKA doesn't have — a second certification's expiry date to watch. Before you pay, you should be able to answer "yes" to all of these without hesitating:

If more than one or two of those still feels shaky, that's not a reason to panic — it's a precise list of what to re-run before you spend the fee. Loop back to the matching week above, not to the whole plan. Item 6 is the one item on this list that isn't really about study at all — mark your CKA's expiry date on the same calendar you're using for this plan, today.

Exam logistics — verify these yourself before you pay

☺ Like you're 10: The shape of the test changes now and then, and CKS adds a second clock to watch besides — read the official page before you hand over any money.

The details below are what the Linux Foundation and CNCF publish and what candidates consistently report. They're here to help you plan a calendar, not to be quoted back at anyone.