Kubernetes certifications compared: KCNA vs CKA vs CKAD vs CKS

The four certifications, in brief

Each of the four targets a different stage or specialism within Kubernetes:

• KCNA (Kubernetes and Cloud Native Associate) — entry-level, multiple-choice, conceptual; covers what Kubernetes is and how the wider cloud-native ecosystem fits together. No prerequisites. Our KCNA certification guide covers it in full.
• CKA (Certified Kubernetes Administrator) — performance-based, hands-on; tests the ability to operate and administer a live cluster: install, configure, troubleshoot and maintain it under real conditions.
• CKAD (Certified Kubernetes Application Developer) — performance-based, hands-on; tests the ability to design, build and deploy applications that run on Kubernetes, from a developer’s perspective rather than an administrator’s.
• CKS (Certified Kubernetes Security Specialist) — performance-based, hands-on, security-focused; tests hardening, runtime security and threat detection on a live cluster. It is the most advanced of the four and requires an active CKA to take it.

The crucial format point

KCNA is the only one of the four that is multiple-choice. CKA, CKAD and CKS all put you in a live terminal connected to real clusters and score you on tasks you actually complete under time pressure — there is no recognising-the-right-answer-from-a-list involved. That is a very different kind of exam from KCNA, and it demands a very different kind of preparation: reading and structured study are enough for KCNA, while CKA, CKAD and CKS require sustained, repeated hands-on practice with kubectl and real cluster configuration until the muscle memory is there.

This is also why the three hands-on exams are widely respected within the industry — they cannot be passed by recognition alone. If you are researching preparation advice online, check which exam it was written for before you follow it; drills built for CKA will over-prepare a KCNA candidate and under-prepare nobody, but KCNA-style revision will leave a CKA candidate badly short. Our explainer on what Kubernetes is covers the underlying technology if you want the concepts before tackling any of these four.

How to sequence them

A sensible default order is KCNA first, then CKA or CKAD depending on your role, then CKS last. KCNA builds the conceptual foundation — pods, the control plane, orchestration, the cloud-native ecosystem — so that the hands-on exams are testing applied skill on top of understanding you already have, rather than teaching you the concepts under exam pressure. From there, choose CKA if your work is closer to operating and administering clusters, or CKAD if it is closer to building and deploying applications on top of them; both sit at a similar level of difficulty and neither is a prerequisite for the other. CKS comes last by design — it requires an active CKA, and its security focus assumes the administration skills CKA already certified.

Experienced Kubernetes administrators sometimes skip KCNA and go straight to CKA. That is a reasonable shortcut if you already know the concepts cold; if you are newer to the ecosystem, consolidating the fundamentals first tends to make the hands-on study faster, not slower.

Who each one suits

KCNA suits people at the start of the cloud-native path: developers and administrators new to Kubernetes, students, career changers, and people in adjacent roles who need to speak the language accurately without running clusters themselves. CKA suits platform and infrastructure engineers who operate clusters as their main job. CKAD suits application developers who deploy and manage workloads on Kubernetes but are not responsible for administering the cluster itself. CKS suits security engineers and senior administrators who already hold a CKA and want to prove they can secure what they run.

Logistics: cost, format and validity

All four are administered by the Linux Foundation. For KCNA, the exam runs around 60 multiple-choice questions in 90 minutes, the passing score is 75%, the fee is about $250 USD at the time of writing, and the certification is valid for three years — full detail is in our KCNA guide. CKA, CKAD and CKS are each roughly two-hour, performance-based exams and are valid for two years. Their fees and passing thresholds change more often than KCNA’s and are not repeated here on purpose — check the Linux Foundation’s training site for the current price, retake policy and passing score before you book any of the three.

How Kubernetes certifications relate to the cloud-provider certs

All four CNCF certifications are vendor-neutral: they test Kubernetes itself, not any one company’s implementation of it. That matters because Kubernetes runs as a managed service on every major cloud — Amazon EKS, Azure AKS and Google GKE — as well as on your own hardware, and a CNCF certification carries across all of them in a way a single provider’s certification does not. A cloud-provider associate certification, by contrast, proves you can operate that provider’s wider platform, of which Kubernetes is one service among many. The two tracks complement each other well: a provider certification anchors you to a platform employers actually deploy on, and a CNCF certification signals your container and orchestration knowledge isn’t locked to one vendor.