bongoDev

Loading...

Empowering technology learners worldwide with professional online live trainings. Transform your IT career with expert-led courses.

Facebook Instagram LinkedIn Github

Company

About Us
Careers
Blog
Events

Legal

Privacy Policy
Refund Policy
Terms and Conditions

Contact us

[email protected]
01757258398 01978367094 01576641348
01757258398

Our office

Flat 5/A, Shimanto Plaza, Plot #26/D, Main Road-03, Section #11, Mirpur, Dhaka 1216

© 2026 bongoDev. All rights reserved. | ই-ট্রেড লাইসেন্স: TRADEDNCC/015304/2024

Courses Job Success

Blog Events Free Assessment Login

bongoDev | CKS Exam Preparation Pro - Knowledge Hub

Knowledge Hub/CKS Exam Preparation Pro

Englishবাংলা

Learning path

CKS Exam Preparation Pro

Performance-based Certified Kubernetes Security Specialist preparation aligned to the current Linux Foundation CKS blueprint: 73 detailed lessons, 165 original hands-on security tasks, six domain labs, a free diagnostic, and two timed mocks.

Discount price

৳ 1,220.00৳ 780.00Save ৳ 440.00

Lessons

73 published lessons · 1 free preview

01CKS Exam Orientation: Current Format, CKA Prerequisite & BlueprintUnderstand the current CKS format, prerequisite, weighting, task-driven nature, and how this course measures readiness. Blueprint: Exam Foundation.Beginner · 18 min readFree previewFree preview
02CKS Allowed Resources, Exam UI & Documentation NavigationPractice using only the documentation and terminal resources permitted in the current Linux Foundation exam environment. Blueprint: Exam Foundation.Beginner · 16 min readLockedLocked
03Security Mental Model: Build, Deploy & Runtime Attack SurfacesMap Kubernetes security across supply chain, control plane, node, workload, network, identity, data, and runtime layers. Blueprint: Exam Foundation.Beginner · 18 min readLockedLocked
04The 4Cs: Cloud, Cluster, Container & CodeUse the 4Cs model to locate a security control at the correct layer and avoid solving a host problem only inside a pod. Blueprint: Exam Foundation.Beginner · 16 min readLockedLocked
05CKS Lab Strategy: kubeadm VMs, Disposable Clusters & Security ToolsBuild a practice environment that supports both Kubernetes object security and node/control-plane hardening tasks. Blueprint: Exam Foundation.Intermediate · 20 min readLockedLocked
06Performance Exam Workflow: Read → Inspect → Change → VerifyDevelop a repeatable task workflow optimized for speed, minimal changes, and evidence-based verification. Blueprint: Exam Foundation.Intermediate · 18 min readLockedLocked
07Security Evidence Before RemediationSeparate observation from remediation so you can prove the insecure state, make the smallest safe change, and verify the result. Blueprint: Exam Foundation.Intermediate · 18 min readLockedLocked
0830-Day CKS Study Plan & Free Practical DiagnosticUse the diagnostic to identify weak domains, then sequence study around practical repetition and timed verification. Blueprint: Exam Foundation.Beginner · 16 min readLockedLocked
09Domain 1 Overview: Cluster Setup — 15%Translate the current Cluster Setup competencies into a practical study checklist: NetworkPolicy, CIS review, Ingress TLS, metadata protection, and binary verification. Blueprint: Domain 1 — Cluster Setup (15%).Intermediate · 16 min readLockedLocked
10NetworkPolicy Fundamentals: Default Deny FirstBuild namespace-level default-deny ingress/egress policies and understand additive NetworkPolicy semantics. Blueprint: Domain 1 — Cluster Setup (15%).Intermediate · 22 min readLockedLocked
11NetworkPolicy Allow Rules: Labels, Ports & DirectionAllow only the required pod-to-pod traffic by combining podSelector, namespaceSelector, ports, and policyTypes. Blueprint: Domain 1 — Cluster Setup (15%).Intermediate · 24 min readLockedLocked
12Egress Control: DNS, External CIDRs & Metadata EndpointsLock down egress while preserving DNS, and reason about node/cloud metadata endpoints and ipBlock exclusions. Blueprint: Domain 1 — Cluster Setup (15%).Advanced · 24 min readLockedLocked
13CIS Benchmark Workflow with kube-benchUse CIS benchmark findings as evidence and map a failed control back to the relevant kube-apiserver, etcd, kubelet, or DNS configuration. Blueprint: Domain 1 — Cluster Setup (15%).Intermediate · 22 min readLockedLocked
14kube-apiserver Security ConfigurationInspect and harden static-pod flags such as anonymous authentication, authorization modes, admission plugins, and audit settings. Blueprint: Domain 1 — Cluster Setup (15%).Advanced · 26 min readLockedLocked
15kubelet Security ConfigurationReview kubelet authentication, authorization, read-only endpoints, TLS behavior, and configuration-file permissions. Blueprint: Domain 1 — Cluster Setup (15%).Advanced · 24 min readLockedLocked
16etcd Security: TLS, Exposure & File PermissionsInspect etcd client/peer TLS configuration, listen addresses, certificate paths, and sensitive-file permissions. Blueprint: Domain 1 — Cluster Setup (15%).Advanced · 26 min readLockedLocked
17Ingress TLS Configuration & VerificationCreate or repair TLS termination for an Ingress using a TLS Secret and verify the host/certificate relationship. Blueprint: Domain 1 — Cluster Setup (15%).Intermediate · 22 min readLockedLocked
18Protecting Node Metadata & Sensitive EndpointsReduce workload access to metadata and node-local sensitive endpoints using network policy and architecture-aware controls. Blueprint: Domain 1 — Cluster Setup (15%).Advanced · 22 min readLockedLocked
19Verify Platform Binaries & Supply Integrity at Install TimeVerify downloaded Kubernetes/security binaries against trusted checksums before installation and understand what the checksum proves. Blueprint: Domain 1 — Cluster Setup (15%).Intermediate · 20 min readLockedLocked
20Domain 2 Overview: Cluster Hardening — 15%Translate the current Cluster Hardening domain into RBAC, ServiceAccount, API-access, and upgrade practice. Blueprint: Domain 2 — Cluster Hardening (15%).Intermediate · 16 min readLockedLocked
21RBAC Least Privilege: Roles, ClusterRoles & BindingsReplace broad RBAC with the smallest verbs/resources/scope necessary for the stated workload or operator. Blueprint: Domain 2 — Cluster Hardening (15%).Intermediate · 24 min readLockedLocked
22RBAC Privilege Escalation & Wildcard AuditingIdentify dangerous verbs/resources and bindings that enable privilege escalation or unauthorized secret/workload control. Blueprint: Domain 2 — Cluster Hardening (15%).Advanced · 24 min readLockedLocked
23ServiceAccount Hardening & Token AutomountDisable unnecessary token automount, create dedicated service accounts, and grant narrowly scoped permissions. Blueprint: Domain 2 — Cluster Hardening (15%).Intermediate · 22 min readLockedLocked
24Short-Lived ServiceAccount Tokens & TokenRequestUse projected/short-lived ServiceAccount tokens and understand why legacy long-lived Secret tokens are higher risk. Blueprint: Domain 2 — Cluster Hardening (15%).Intermediate · 20 min readLockedLocked
25Restricting Kubernetes API AccessHarden API endpoint exposure through authentication, authorization, network boundaries, and client certificate/kubeconfig protection. Blueprint: Domain 2 — Cluster Hardening (15%).Advanced · 24 min readLockedLocked
26Admission Control & NodeRestrictionUnderstand security-relevant admission plugins and verify NodeRestriction is active when required. Blueprint: Domain 2 — Cluster Hardening (15%).Advanced · 22 min readLockedLocked
27Kubeconfig, Client Certificates & Admin Credential HygieneProtect admin kubeconfigs and client certificates with correct ownership, permissions, and scope. Blueprint: Domain 2 — Cluster Hardening (15%).Intermediate · 22 min readLockedLocked
28Security-Driven Kubernetes Upgrade WorkflowPlan and execute a kubeadm control-plane/node upgrade with version-skew awareness and post-upgrade verification. Blueprint: Domain 2 — Cluster Hardening (15%).Advanced · 26 min readLockedLocked
29Domain 3 Overview: System Hardening — 10%Translate host hardening competencies into service minimization, IAM/identity, external-access reduction, AppArmor, and seccomp practice. Blueprint: Domain 3 — System Hardening (10%).Intermediate · 16 min readLockedLocked
30Minimize Host OS Footprint & Disable Unneeded ServicesInventory enabled/running services and disable a task-specified unnecessary service without destabilizing Kubernetes. Blueprint: Domain 3 — System Hardening (10%).Intermediate · 22 min readLockedLocked
31Host Users, Groups, sudo & Least PrivilegeAudit local identities, group membership, sudo access, and sensitive-file ownership for least privilege. Blueprint: Domain 3 — System Hardening (10%).Intermediate · 22 min readLockedLocked
32Network Exposure on Nodes: Listeners & Firewall ControlsIdentify listening services and restrict task-specified external access while preserving required control-plane/node communication. Blueprint: Domain 3 — System Hardening (10%).Advanced · 24 min readLockedLocked
33Sensitive File Permissions & Runtime Socket ProtectionProtect kubeconfig, PKI, manifests, and container-runtime sockets from unnecessary local users. Blueprint: Domain 3 — System Hardening (10%).Intermediate · 22 min readLockedLocked
34AppArmor Fundamentals, Profiles & Pod AttachmentLoad an AppArmor profile, attach it to a workload using current Kubernetes mechanisms, and verify enforcement. Blueprint: Domain 3 — System Hardening (10%).Advanced · 26 min readLockedLocked
35seccomp RuntimeDefault: Reduce Syscall Attack SurfaceApply RuntimeDefault seccomp at Pod/container level and verify the effective securityContext. Blueprint: Domain 3 — System Hardening (10%).Intermediate · 22 min readLockedLocked
36seccomp Localhost ProfilesInstall a custom seccomp JSON profile on the node, reference it with Localhost, and validate the workload. Blueprint: Domain 3 — System Hardening (10%).Advanced · 26 min readLockedLocked
37Kernel Hardening Evidence: sysctl, Modules & Host ControlsInspect task-relevant kernel parameters/modules and change only the explicitly required control. Blueprint: Domain 3 — System Hardening (10%).Advanced · 22 min readLockedLocked
38Domain 4 Overview: Minimize Microservice Vulnerabilities — 20%Translate PSS/PSA, secrets, isolation, sandboxing, and pod-to-pod encryption into workload-level security practice. Blueprint: Domain 4 — Minimize Microservice Vulnerabilities (20%).Intermediate · 16 min readLockedLocked
39Pod Security Standards & Pod Security AdmissionApply baseline/restricted Pod Security Admission labels and understand how enforce, audit, and warn modes differ. Blueprint: Domain 4 — Minimize Microservice Vulnerabilities (20%).Intermediate · 24 min readLockedLocked
40Run as Non-Root & Explicit User/Group IDsConfigure runAsNonRoot and explicit non-root identity while considering image USER behavior. Blueprint: Domain 4 — Minimize Microservice Vulnerabilities (20%).Intermediate · 20 min readLockedLocked
41Disable Privilege Escalation & Drop Linux CapabilitiesSet allowPrivilegeEscalation=false and drop capabilities, adding back only a task-required capability. Blueprint: Domain 4 — Minimize Microservice Vulnerabilities (20%).Intermediate · 22 min readLockedLocked
42Read-Only Root Filesystem & Writable Scratch VolumesSet readOnlyRootFilesystem and provide explicit writable emptyDir volumes only where the application needs them. Blueprint: Domain 4 — Minimize Microservice Vulnerabilities (20%).Intermediate · 22 min readLockedLocked
43Dangerous Pod Features: privileged, hostPID, hostNetwork & hostPathAudit and remove unnecessary host-sharing/privileged features that collapse container isolation. Blueprint: Domain 4 — Minimize Microservice Vulnerabilities (20%).Advanced · 24 min readLockedLocked
44Kubernetes Secrets: Exposure, Mounts & Safe UseUse Secret volume/env references safely, understand base64 is not encryption, and minimize who/what can read the Secret. Blueprint: Domain 4 — Minimize Microservice Vulnerabilities (20%).Intermediate · 24 min readLockedLocked
45ServiceAccount Token Exposure Inside PodsDisable token automount for workloads that do not need Kubernetes API access and inspect projected token mounts. Blueprint: Domain 4 — Minimize Microservice Vulnerabilities (20%).Intermediate · 20 min readLockedLocked
46Multi-Tenancy Isolation: Namespace, RBAC, Network & PolicyCombine namespace boundaries, RBAC, NetworkPolicy, Pod Security, resource controls, and identity to isolate tenants. Blueprint: Domain 4 — Minimize Microservice Vulnerabilities (20%).Advanced · 26 min readLockedLocked
47RuntimeClass & Sandboxed ContainersUse RuntimeClass to select a configured sandboxed runtime for higher-risk workloads and verify the selected runtime. Blueprint: Domain 4 — Minimize Microservice Vulnerabilities (20%).Advanced · 22 min readLockedLocked
48Pod-to-Pod Encryption with Cilium WireGuardUnderstand and verify Cilium WireGuard transparent encryption for cross-node pod traffic, including what is and is not tunneled. Blueprint: Domain 4 — Minimize Microservice Vulnerabilities (20%).Advanced · 28 min readLockedLocked
49Resource Limits as a Security Boundary Against DoSUse resource requests/limits and namespace policies as part of preventing one compromised workload from exhausting shared capacity. Blueprint: Domain 4 — Minimize Microservice Vulnerabilities (20%).Intermediate · 22 min readLockedLocked
50Domain 5 Overview: Supply Chain Security — 20%Map image minimization, SBOM, CI/CD, repositories, permitted registries, signatures, and static analysis to exam tasks. Blueprint: Domain 5 — Supply Chain Security (20%).Intermediate · 16 min readLockedLocked
51Minimal Base Images & Multi-Stage Container BuildsReduce image attack surface using multi-stage builds, non-root runtime users, minimal packages, and immutable app artifacts. Blueprint: Domain 5 — Supply Chain Security (20%).Intermediate · 22 min readLockedLocked
52Secure Dockerfile ReviewFind risky Dockerfile patterns such as secrets in build context, root runtime, curl|sh installation, broad package installs, and mutable tags. Blueprint: Domain 5 — Supply Chain Security (20%).Intermediate · 22 min readLockedLocked
53SBOM Fundamentals & Kubernetes BOM ToolGenerate and inspect software bills of materials and understand how SBOMs support inventory, vulnerability response, and provenance. Blueprint: Domain 5 — Supply Chain Security (20%).Intermediate · 24 min readLockedLocked
54Container Image Vulnerability ScanningScan a container image with an available scanner, filter actionable severity, and distinguish finding evidence from remediation. Blueprint: Domain 5 — Supply Chain Security (20%).Intermediate · 24 min readLockedLocked
55KubeLinter Static Workload AnalysisUse KubeLinter to detect risky Kubernetes manifest patterns and correct a task-specific finding. Blueprint: Domain 5 — Supply Chain Security (20%).Intermediate · 22 min readLockedLocked
56Kubesec Security Scoring & Manifest ReviewUse Kubesec-style static analysis to identify dangerous workload fields and translate findings into explicit securityContext changes. Blueprint: Domain 5 — Supply Chain Security (20%).Intermediate · 22 min readLockedLocked
57Permitted Registries & Image Source PolicyRestrict workload image sources to approved registries using the mechanism provided by the task environment and verify rejected/accepted images. Blueprint: Domain 5 — Supply Chain Security (20%).Advanced · 24 min readLockedLocked
58Immutable Image References & Digest PinningReplace mutable tags with approved image digests and verify the runtime imageID aligns with the intended artifact. Blueprint: Domain 5 — Supply Chain Security (20%).Intermediate · 22 min readLockedLocked
59Artifact Signing & Verification Concepts with cosignVerify signed artifacts/images using a task-provided public key or trust policy and understand the limit of signature verification. Blueprint: Domain 5 — Supply Chain Security (20%).Advanced · 24 min readLockedLocked
60CI/CD Supply-Chain Controls & Incident ResponseDesign a secure build/promotion path with isolated credentials, immutable artifacts, scan/sign/verify gates, and controlled registries. Blueprint: Domain 5 — Supply Chain Security (20%).Advanced · 26 min readLockedLocked
61Domain 6 Overview: Monitoring, Logging & Runtime Security — 20%Map behavioral analytics, threat detection, attack investigation, runtime immutability, and Kubernetes audit logging to hands-on workflows. Blueprint: Domain 6 — Monitoring, Logging & Runtime Security (20%).Intermediate · 16 min readLockedLocked
62Kubernetes Audit Policy FundamentalsWrite an audit policy that captures security-relevant API activity without indiscriminately logging sensitive request/response bodies. Blueprint: Domain 6 — Monitoring, Logging & Runtime Security (20%).Advanced · 24 min readLockedLocked
63Enable kube-apiserver Audit LoggingConfigure audit-policy/log flags and hostPath mounts on the static kube-apiserver manifest, then verify audit records appear. Blueprint: Domain 6 — Monitoring, Logging & Runtime Security (20%).Advanced · 28 min readLockedLocked
64Audit Log Investigation: Who Did What?Filter audit events by user, verb, namespace, resource, source IP, and response code to reconstruct suspicious API activity. Blueprint: Domain 6 — Monitoring, Logging & Runtime Security (20%).Advanced · 24 min readLockedLocked
65Falco Fundamentals: Rules, Fields & Runtime EventsRead Falco alerts and understand conditions, output fields, macros/lists, priorities, and container/Kubernetes context. Blueprint: Domain 6 — Monitoring, Logging & Runtime Security (20%).Advanced · 24 min readLockedLocked
66Writing a Custom Falco RuleCreate a focused rule for a task-specified behavior such as an interactive shell or write under a sensitive path, validate syntax, and test it. Blueprint: Domain 6 — Monitoring, Logging & Runtime Security (20%).Advanced · 28 min readLockedLocked
67Behavioral Analytics & Attack-Phase ReasoningConnect runtime observations to attack phases such as initial access, discovery, credential access, privilege escalation, persistence, and exfiltration. Blueprint: Domain 6 — Monitoring, Logging & Runtime Security (20%).Advanced · 24 min readLockedLocked
68Runtime Immutability & Detecting Unauthorized WritesUse read-only filesystems, immutable image design, and runtime observation to detect unexpected file/process changes. Blueprint: Domain 6 — Monitoring, Logging & Runtime Security (20%).Intermediate · 22 min readLockedLocked
69Node/Container Runtime Investigation with crictl & journalctlInvestigate suspicious containers/processes from the node when Kubernetes-level visibility is insufficient. Blueprint: Domain 6 — Monitoring, Logging & Runtime Security (20%).Advanced · 24 min readLockedLocked
70Compromised ServiceAccount & RBAC ContainmentTrace a ServiceAccount's effective permissions, identify abuse, remove excess bindings/token exposure, and verify containment. Blueprint: Domain 6 — Monitoring, Logging & Runtime Security (20%).Advanced · 26 min readLockedLocked
71Runtime Network Investigation & Egress ContainmentCorrelate suspicious outbound connections with Pods/processes and apply the smallest NetworkPolicy containment necessary. Blueprint: Domain 6 — Monitoring, Logging & Runtime Security (20%).Advanced · 26 min readLockedLocked
72CKS Timed Strategy: 15–20 Tasks in 120 MinutesPractice triage, task weighting, skipping/revisiting, documentation navigation, and final verification under the current 2-hour performance format. Blueprint: Final Review / Timed Strategy.Intermediate · 18 min readLockedLocked
73CKS Final Command, Security Evidence & Exam-Day CheatsheetConsolidate the commands, decision trees, verification patterns, and security controls needed for final revision. Blueprint: Final Review / Timed Strategy.Intermediate · 28 min readLockedLocked