Need CKS Exam Suggestions

Certified Kubernetes Security Specialist
#1

Hi,
I appeared in CKS exam last week and could not pass it. I scored 45%. I eed some suggestions for my next try. Like i am thinking to start the long questions first then the easy ones.
I need tips and suggestions to prepare falco and dockerfile analysis in more depth to make me able to solve themin exam.

Thanks

CKS exam experience
#2

It depends on whether you found the questions too difficult - in which case revise the topics around the questions you had trouble with, or whether you just couldn’t get stuff done fast enough.

Do look at all the questions first and work out which ones may be the hardest.

If speed is the issue, then you need to

  • Be fast typing, and know the tricks in vi.
  • Ensure you set up aliases for frequently used kubectl commands - although I can manage fast enough using tab completion
  • Use kubectl explain instead of searching docs when all you need are the values for a particular property.
  • Ensure you understand the error messages from kubectl so you can quickly fix manifest issues.
  • Use CRTL-R at the command line to recall previously entered commands
  • Know how to quickly fix a cluster if you break it. If you leave a dead cluster, all questions on that cluster will score zero.
  • Have a working knowledge of simpler jq and yq commands for processing manifest output and/or things like audit logs (although grep is sometimes sufficient).
  • Be comfortable with bash and the regular Linux command line tools so you can
    • Use one-line shell scripts for repetitive tasks, e.g. if you have to trivy the images of all the pods running in a namespace, this is easy with a for loop on a jsonpath query - so know jsonpath well!
    • Use sed/awk/grep/cut/tr etc. for processing stuff like falco logs, i.e. extracting some lines, or reformatting to something other than the existing log format.
1 Like
#3

Yes, the CKS exam is really difficult. I just passed CKS on Monday only with the passing grade (67%). I think I failed the dockerfile analysis.

I saw few “easy” questions. I had 16 questions, so 7min 30seconds to answer each. It’s not enough, if you have to constantly consult the Kubernetes docs, like I had to.

While I got 95% last June on the CKA exam. The difference is practice. You have to practice, practice, practice. Previously, I obsessively practiced CKA for at least 6 months after finishing the course. (It was way too much.) This time, I took only a few weeks to review with the CKS Study Guide on DevOpsCube, then took a long 4 days weekend to practice and do the Killer Shell mock exam. It was brutal, and was a good preparation for the exam. It threw me a couple of curve balls which took me completely off guard. Each session is active for 36 hours, that helps. But it was almost not enough in my case.

Sadly, I found the CKS course labs were not enough. There are no labs for some subjects, and the OPA one is outdated and its content is not covered in the video.

I tried the CKS Challenges, but I got blocked on the first question. I had to scan images with trivy, but trivy could not download vulnerability databases from Github because the KodeKloud infrastructure had reached the free limit on the Github API. So trivy failed. I know I could have used a personal access token, but I was rather ticked off.

If you got time before your next attempt, I suggest first practicing with the Killercoda playgrounds, specifically the Killer Shell CKS scenarios. Some scenarios cover cases for which there are no labs in the CKS course. Do them many times so it becomes second nature. Then use the Killer Shell mock exam to practice: you have two free attempts with the exam purchase. That way, the commands will come automatically to you. If you don’t have a KodeKloud Pro subscription (so no access to playgrounds), you could use the Killercoda playgrounds to practice on your own, that’s what I did. (And sometimes used kind or k3d locally.)

Alistair has good tips, I often use k explain instead of relying on the docs. For example, to check what securityContext options are available on a pod, and which are only on containers. Mumshad’s course on JSONPATH is also a must, with a lot of practice, and it helped me a little. However, for Falco logs, I find it easier to override a policy so it formats the logs like it was required. I still have to use awk or cut to remove unwanted text, though. To use sed, you must be proficient with regular expressions; and I find sed pretty tricky, compared with Regular Expressions libraries for different programming languages. It also have an unorthodox syntax for character classes.

Good luck. I am so happy I don’t have to go through that a second time.