Nothing on the CKA, CKAD, or CKS is multiple choice. You get a remote desktop, a set of live Kubernetes clusters, and two hours to make them do what each task asks. The grader checks the end state of the cluster, so a Deployment that almost rolls out or a NetworkPolicy that blocks almost the right traffic earns nothing. That format matters more than any study guide when you’re deciding which of the three to take.
The CKA (Certified Kubernetes Administrator) is the operator’s exam, built around installing and repairing clusters. CKAD, the application developer credential, stays inside the namespace and asks you to ship and configure workloads fast. The CKS (Certified Kubernetes Security Specialist) can’t be your starting point at all, because the Linux Foundation requires a passing CKA before you can attempt it. For infrastructure, platform, and security people, the order I’d recommend is CKA, then CKS, with the CKAD added when your job has you writing application manifests.
Troubleshooting is 30 percent of the CKA, the single largest domain on any of the three Kubernetes exams. If you can’t diagnose a broken node from the command line, no amount of YAML practice will save you.
What Is the Difference Between CKA, CKAD, and CKS?
The three exams share the same mechanics, which makes the differences in content easier to see. According to the Linux Foundation’s official CKA pageeach exam costs $445 on its own, runs two hours, and includes a second attempt plus two sessions on the Killer.sh exam simulator. You get 12 months from purchase to sit it. The environment currently runs Kubernetes v1.35, and the Linux Foundation moves it to the newest minor release within four to eight weeks of that release shipping.
Validity changed on April 1, 2024. Certifications earned after that date last two years instead of three, per the Linux Foundation certification FAQ. Anyone planning to hold all three should put the renewal math on a calendar now.
| CKA | CKAD | CKS | |
|---|---|---|---|
| Built for | Cluster administrators, platform and SRE teams, DevOps engineers who own the cluster | Developers and DevOps engineers who deploy onto a cluster someone else runs | Security engineers and platform teams responsible for hardening clusters |
| Prerequisite | None | None | Must have passed the CKA first |
| Passing score | 66% | 66% | 67% |
| Largest domain | Troubleshooting (30%) | Application Environment, Configuration and Security (25%) | Three domains tied at 20%: microservice vulnerabilities, supply chain security, and monitoring, logging and runtime security |
| Exam fee (exam only) | $445 | $445 | $445 |
| Format and length | Performance based, 2 hours | Performance based, 2 hours | Performance based, 2 hours |
| Valid for | 2 years | 2 years | 2 years |
Identical price and identical clock hide how differently the exams feel. On the CKAD the individual tasks are smaller, and the pressure comes from volume. You can’t afford to type manifests from scratch, and candidates who never learned to generate YAML with imperative commands run out of time. On the CKA the tasks go deeper into the cluster itself, into kubelet configuration, control plane components, and node health. The CKS assumes you can already do all of that and then asks you to do it while thinking like an attacker.
What Does the CKA Exam Actually Test?
The current CKA curriculum took effect on February 18, 2025 and reorganized the exam into five weighted domains. That update pulled in Helm, Kustomize, the Gateway API, custom resource definitions, and operators, all topics that older prep material skips. If a course or practice set predates 2025, treat it as incomplete.
Where candidates actually lose the exam is the troubleshooting block, and the reason is rarely Kubernetes knowledge. A node shows NotReady. The fix lives on the node itself, which means SSH, systemctl status kubeletand reading journalctl output until you find the misconfigured flag or the expired certificate. A control plane component won’t start, and the answer sits in a static pod manifest under /etc/kubernetes/manifests that you have to read and correct by hand. You’ll barely touch kubectl for tasks like these, and people who came to Kubernetes through application work tend to stall here even when their YAML is flawless. If your Linux is rusty, fix that before you book the exam. Our Linux+ XK0-006 exam guide covers the system administration side, and the command line habits in the Linux security commands you actually need to know carry straight into CKA troubleshooting tasks.
One more point on the 2025 update. Older guides spent a lot of time on etcd backup and restore and on kubeadm version upgrades. Those skills are still fair game, but the curriculum no longer singles them out, so don’t let them eat a week of study time at the expense of networking and troubleshooting.
Training Camp runs the CKA as a 5 day CKA Boot Camp and as a CKA Fast Track Boot Camp for administrators who already work in clusters and need exam focus more than fundamentals.
What Does the CKAD Exam Test?
The CKAD lives at the application layer. Per the Linux Foundation CKAD pageits five domains are Application Environment, Configuration and Security at 25 percent, then Application Design and Build, Application Deployment, and Services and Networking at 20 percent each, with Application Observability and Maintenance at 15 percent. You won’t be installing clusters or fixing a broken kubelet.
The tasks center on building pods, Jobs, and CronJobs, wiring in ConfigMaps, Secrets, and ServiceAccounts, setting resource requests and limits, adding probes, and running rolling deployments. Speed decides this exam. The candidates who pass comfortably generate a skeleton with something like kubectl create deployment web --image=nginx --dry-run=client -o yamlredirect it to a file, and edit only the fields that matter. Writing manifests from a blank editor for two hours is how people end up with six unfinished tasks.
A developer who deploys to Kubernetes every week but never touches the control plane should start here. It maps to the work.
Training Camp offers a 5 day CKAD Boot Camp and a CKAD Fast Track Boot Camp.
Why You Can’t Take the CKS First
The CKS is the only one of the three with a hard prerequisite: you must have passed the CKA before attempting it. That rule makes sense once you look at the tasks. Hardening a cluster means reconfiguring the API server, locking down kubelets, and restricting what workloads can do at the kernel level, and every one of those jobs assumes you already know where the configuration lives and how to recover when a change breaks something.
Sixty percent of the CKS sits in the last three domains, which is where it stops resembling the CKA. Supply chain and runtime security bring in tooling that most administrators haven’t used day to day, so budget real lab time for image scanning and runtime detection rather than assuming your CKA prep carries you. The passing bar is also a point higher at 67 percent.
Training Camp’s CKS Boot Camp is built for candidates who already hold the CKA.
Which Kubernetes Certification Should You Take First?
Pick by the work you do, or the work you’re trying to move into. Titles vary too much between companies to be useful here, so look at your actual week.
Start with the CKA if you run clusters, build platforms, handle on call for Kubernetes infrastructure, or work in security and plan to go on to the CKS. It’s the broadest of the three, and it’s the only route to the CKS.
Start with the CKAD if you write application code and deploy it onto clusters that a platform team maintains. You’ll use every domain on that exam in your job, and the CKA’s node level troubleshooting would be study time spent on someone else’s responsibilities.
Plan for the CKS second if security is the destination. There’s no shortcut around the CKA requirement, and trying to learn cluster administration and cluster hardening at the same time is the slowest possible path.
If containers themselves are still new to you, none of the three is the right first step. The exams assume you already understand pods, Deployments, Services, and how kubectl talks to the API server. A Kubernetes Fundamentals course closes that gap before you spend $445 on an attempt. And if you’re earlier than that, still weighing whether infrastructure or security is your direction, Jeff Porch’s piece on whether to learn cloud or cybersecurity first is worth reading before you commit to a track.
Study tip for all three: Practice inside the documentation, not around it. The exam lets you open the official Kubernetes docs in the exam browser, so the skill being tested is partly how fast you can find the right example on kubernetes.io and adapt it. Do your lab work with only that site open. Set alias k=kubectl and shell autocompletion on day one so the muscle memory is there by exam day. Use your two Killer.sh sessions late in your prep, since the simulator is deliberately harder than the real exam and works best as a final stress test.
Frequently Asked Questions About CKA, CKAD, and CKS
Which is harder, the CKA or the CKAD?
The CKA is broader and goes deeper into cluster internals, especially in its 30 percent troubleshooting domain, which requires Linux administration on the nodes. CKAD scope is narrower, but the time pressure is higher, because its tasks reward fast YAML generation. Which one feels harder depends mostly on whether your background is operations or development.
Do I need the CKA before taking the CKS?
Yes. The Linux Foundation requires CKS candidates to have passed the CKA before attempting the CKS exam. Neither the CKA nor the CKAD has a prerequisite.
How much do the CKA, CKAD, and CKS exams cost?
Each exam costs $445 when purchased on its own from the Linux Foundation. The price includes two exam attempts and two Killer.sh simulator sessions, and you have 12 months from purchase to take the exam.
What is the passing score for the CKA, CKAD, and CKS?
The CKA and CKAD both require a score of 66 percent or higher. For the CKS, the bar is 67 percent or higher.
How long are Kubernetes certifications valid?
Certifications earned on or after April 1, 2024 are valid for two years. Anything earned before that date kept the original three year validity period.
Can I use the Kubernetes documentation during the exam?
Yes. All three exams allow access to the official Kubernetes documentation from within the exam environment. Knowing where to find working examples quickly is part of what separates candidates who finish from those who run out of time.
Should I take the CKA or CKAD first?
Take the CKA first if you administer clusters or plan to earn the CKS. Developers deploying applications onto clusters another team runs are better served starting with the CKAD.
Director, Educational Services | Training Camp
Mark Sabo is the Director of Educational Services at Training Camp, where he oversees the training team, course design, and certification program development. He holds a B.S. in Information Sciences and Technology from Penn State University and more than 50 industry certifications. Mark joined Training Camp in 2005, became a Technical Trainer in 2007, and assumed his current leadership role in 2015. His specialty is practice exam development and exam preparation strategy, built from years of teaching students in the classroom and studying how certification exams are constructed. His writing focuses on the technical details that matter most to professionals preparing for high stakes exams.