- What You're Actually Signing Up For
- Exam Mechanics: Format, Scoring, and Rules
- The Five Domains and Where to Focus First
- Troubleshooting: The Domain That Decides Your Score
- Open-Book Strategy: Using the Allowed Docs Effectively
- An Eight-Week Study Plan Built Around the CKA Domains
- Getting the Most Out of Your Two Killer.sh Attempts
- Exam-Day Execution: 15-20 Tasks in 120 Minutes
- Frequently Asked Questions
- Troubleshooting is the largest domain at 30%-it alone can make or break your passing score of 66%.
- Your $445 registration includes one free retake and two Killer.sh simulator sessions; use both strategically.
- The exam runs Kubernetes v1.35 (verify the FAQ before scheduling); the Linux Foundation product page may show a different version.
- All tasks are performance-based at a Linux command line-zero multiple choice; partial credit is awarded per task.
What You're Actually Signing Up For
The CKA Certification is not a trivia test. There are no multiple-choice questions, no drag-and-drop diagrams, and no scenario exhibits to read passively. Every one of the 15-20 tasks you face is a live, hands-on command-line problem solved inside a real Kubernetes environment. You will kubectl apply, edit broken manifests, debug crashing pods, and configure networking policies-all under a two-hour clock. That format is what makes the CKA genuinely valuable, and it's also what catches underprepared candidates off guard.
If you're still exploring what this credential actually covers, our overview of What Is CKA Certification? is a good starting point before diving into domain-level preparation. This guide focuses specifically on passing-what to study, in what order, and how to execute on exam day.
Exam Mechanics: Format, Scoring, and Rules
Cost, Attempts, and Scheduling Window
The exam-only fee is $445, which covers two exam attempts-your first sit and one free retake if needed. You have 12 months from purchase to schedule both attempts, so there is no pressure to rush, but there is also no reason to delay indefinitely. For a full breakdown of what's included and how bundled options compare, see our CKA Certification Cost 2026: Complete Pricing Breakdown.
Passing score is 66%. Partial credit is possible within each task, which means a partially completed task still contributes to your score. That partial-credit mechanic changes how you should approach time management: a partially done hard task may outscore a skipped easy task if you get the core configuration right.
Kubernetes Version in the Exam Environment
This is a detail that trips up candidates who study against outdated resources. The Linux Foundation FAQ currently lists the CKA environment as Kubernetes v1.35, while the product page lists v1.34. The Linux Foundation's stated policy is that the environment aligns with the latest Kubernetes minor release within approximately 4-8 weeks of its availability. Always verify the FAQ page on The Linux Foundation's site immediately before you schedule-do not rely on the product listing or any third-party guide, including this one, as your source of truth for the active version.
Open-Resource Rules
The CKA is open-resource, but the term is often misunderstood. You are permitted to access specific documentation inside the exam VM browser tab. Allowed sources include:
- The official Kubernetes documentation at kubernetes.io/docs
- The Kubernetes Blog at kubernetes.io/blog
- Helm documentation at helm.sh/docs
- Task-specific documentation referenced in question prompts
- CKA Gateway API documentation
- Terminal instructions, /usr/share documents, and packages available inside the VM
What is explicitly not allowed: external search engines, Google, Stack Overflow, GitHub, YouTube, or any site outside the approved list. If you have been practicing by Googling syntax mid-task, you need to retrain that habit before exam day.
Certification Validity
For credentials earned after April 1, 2024, the CKA is valid for two years. Renewal requires retaking and passing the exam before expiration-there is no continuing education path or renewal fee shortcut.
The Five Domains and Where to Focus First
The CKA blueprint is divided into five domains with explicit percentage weights. Understanding those weights tells you exactly how to allocate your study hours. Our CKA Exam Domains 2026: Complete Guide to All 5 Content Areas goes deep on each domain; here is the strategic overview.
| Domain | Weight | Study Priority |
|---|---|---|
| Domain 5: Troubleshooting | 30% | Highest - practice daily |
| Domain 1: Cluster Architecture, Installation & Configuration | 25% | High - foundational for everything |
| Domain 3: Services & Networking | 20% | High - complex and frequently tested |
| Domain 2: Workloads & Scheduling | 15% | Medium - solid kubectl fluency required |
| Domain 4: Storage | 10% | Lower - focused, learnable in one week |
Domains 5, 1, and 3 together account for 75% of your score. If you are short on time, those three domains are where every available hour must go.
Domain 1: Cluster Architecture, Installation & Configuration (25%)
This domain covers kubeadm-based cluster bootstrapping, etcd backup and restore, RBAC (Roles, ClusterRoles, RoleBindings), and managing kubeconfig contexts. Etcd backup/restore is a near-certain task-practice it until the commands are reflex.
- Bootstrap a cluster with kubeadm init and kubeadm join
- Perform etcd snapshot backup and restore from a snapshot file
- Create and bind RBAC resources to specific service accounts
- Upgrade a cluster node using kubeadm upgrade
Domain 2: Workloads & Scheduling (15%)
Covers Deployments, DaemonSets, resource requests and limits, node affinity, taints and tolerations, and ConfigMaps/Secrets. Scheduling constraints show up frequently-understand the difference between nodeSelector, nodeAffinity, and taints/tolerations at the YAML level.
- Scale and roll back Deployments imperatively and declaratively
- Configure resource requests/limits and understand their scheduling impact
- Apply taints to nodes and tolerations to pods correctly
Domain 3: Services & Networking (20%)
Services (ClusterIP, NodePort, LoadBalancer), Ingress resources, NetworkPolicies, CoreDNS, and the newer Gateway API are all in scope. NetworkPolicies have caused failures for many candidates-practice writing egress and ingress rules that match specific pod selectors and namespaces.
- Create and troubleshoot all Service types
- Write NetworkPolicy manifests restricting traffic between namespaces
- Configure Ingress rules with path-based routing
- Understand Gateway API objects (GatewayClass, Gateway, HTTPRoute)
Domain 4: Storage (10%)
PersistentVolumes, PersistentVolumeClaims, StorageClasses, and volume mounts. This is the smallest domain-focused study for one to two weeks is sufficient for most candidates with basic Linux file system knowledge.
- Create PVs and PVCs with matching access modes and storage classes
- Mount volumes into pods at specific paths
- Understand static versus dynamic provisioning
Troubleshooting: The Domain That Decides Your Score
At 30%, Troubleshooting is the single largest domain on the CKA. It is also the domain where candidates who "know Kubernetes conceptually" tend to underperform, because troubleshooting requires you to read real error output and act on it-not recall a definition.
Typical troubleshooting tasks include: diagnosing a pod that won't schedule, fixing a broken Service that isn't reaching its pods, repairing a misconfigured kubelet on a worker node, and identifying why a node has gone NotReady. For every one of these scenarios, your diagnostic sequence matters as much as the fix.
A Repeatable Troubleshooting Sequence
- Check pod/object status:
kubectl get pods -n <namespace> -o wide- identify the state and the node. - Read events:
kubectl describe pod <name>- events section tells you scheduling failures, image pull errors, and probe failures. - Read logs:
kubectl logs <pod> --previousfor crashed containers. - Check node health:
kubectl describe node <node>- conditions, allocatable resources, and taints. - Inspect system components: For control-plane or kubelet issues,
systemctl status kubeletandjournalctl -u kubelet -n 50.
Key Takeaway
Troubleshooting tasks are often multi-step: you must find the problem AND fix it. Partial credit rewards candidates who correctly identify the root cause even if their fix is incomplete. Always leave a comment in the task terminal about what you found-some proctoring environments allow partial scoring based on state, but your visible commands also demonstrate intent.
Open-Book Strategy: Using the Allowed Docs Effectively
Having documentation available sounds like a safety net. It is not. Candidates who enter the exam planning to "look things up" almost universally run out of time. The documentation is a reference for syntax confirmation, not a teaching resource mid-exam.
The most effective approach: practice navigating to specific pages in under 30 seconds. Before exam day, you should know exactly which URL paths lead to the etcd backup procedure, the NetworkPolicy examples, the PersistentVolume configuration reference, and the kubeadm upgrade guide. Bookmark structure inside the allowed browser tab can be prepared in advance during practice sessions.
--set flags. Practice basic Helm commands (helm repo add, helm install, helm upgrade, helm list, helm rollback) until they are automatic.
An Eight-Week Study Plan Built Around the CKA Domains
Generic study advice (spaced repetition, active recall) is well-established-but it only works if you apply it to the right content in the right sequence. Here is a domain-weighted schedule designed around the CKA's actual score distribution.
Foundation: Linux & Kubernetes Basics
- kubectl imperative commands fluency: run, create, expose, set, label, annotate
- YAML structure and multi-document manifests
- Namespaces, contexts, and kubeconfig switching
- Set up a local cluster (kubeadm on VMs or kind/k3s for speed)
Domain 1: Cluster Architecture, Installation & Configuration (25%)
- Bootstrap a cluster with kubeadm from scratch at least three times
- Practice etcd backup and restore until the command sequence is memorized
- Create Roles, ClusterRoles, RoleBindings, and ServiceAccounts for specific access scenarios
- Run a kubeadm upgrade sequence on a control plane and worker node
Domains 2 & 4: Workloads, Scheduling, and Storage (25% combined)
- Deploy, scale, roll back, and update Deployments and StatefulSets
- Apply node affinity rules and taints/tolerations in multi-node scenarios
- Create PVs and PVCs, bind them, and mount into pods
- Practice StorageClass-based dynamic provisioning
Domain 3: Services & Networking (20%)
- Create all Service types and verify connectivity with kubectl exec
- Write and apply NetworkPolicy manifests-ingress and egress rules
- Configure Ingress resources with TLS and path routing
- Explore Gateway API: GatewayClass, Gateway, HTTPRoute objects
Domain 5: Troubleshooting (30%) - First Pass
- Introduce deliberate failures: break kubelet, misconfigure Services, corrupt pod specs
- Practice the full diagnostic sequence: describe, logs, journalctl, systemctl
- Repair broken nodes: restart kubelet, fix /etc/kubernetes/manifests files
First Killer.sh Simulator Attempt
- Attempt all questions under timed, exam-like conditions
- After the session: identify every gap and build a remediation list
- Spend the remainder of week 7 drilling gaps-especially Troubleshooting failures
Second Killer.sh + Final Consolidation
- Run second Killer.sh attempt; compare scores and remaining gaps to week 7
- Review the CKA-allowed documentation pages you used most-practice navigating them faster
- Final two days: light review only, no new material, confirm exam logistics
Getting the Most Out of Your Two Killer.sh Attempts
Your $445 registration includes two Killer.sh simulator sessions (note: verify this is not an excluded single-exam SKU when purchasing). Killer.sh is deliberately harder than the actual CKA-tasks are more complex, time pressure is greater, and the environment closely mirrors the real exam terminal. That difficulty is intentional and useful.
The mistake most candidates make is burning both Killer.sh attempts back-to-back in the final week. A more effective approach: use the first attempt at week 7 (after domain study is complete) as a diagnostic, not a rehearsal. Use the gap analysis from attempt one to drive your final week of study, then use attempt two as a true dress rehearsal three to four days before your scheduled exam date.
Practice tests at our CKA practice test platform are a strong complement to Killer.sh throughout your preparation-use them during domain study weeks to build task-level confidence before the full simulator pressure.
Exam-Day Execution: 15-20 Tasks in 120 Minutes
Time Budget Per Task
With 15-20 tasks and 120 minutes, your average time budget is 6-8 minutes per task. That sounds reasonable until you hit an etcd restore or a broken cluster node task that legitimately requires 12-15 minutes. Build your strategy around two passes:
- First pass (60-70 minutes): Complete every task you can solve confidently within 5-7 minutes. Flag anything complex or unfamiliar.
- Second pass (remaining time): Return to flagged tasks with the time remaining. Prioritize by weight-a 13% task deserves more time than a 4% task.
Context Switching Is a Real Risk
The CKA exam environment contains multiple clusters, each accessible via a different kubeconfig context. Every task begins with a context-switch command that you must run before doing anything else. Skipping this-or running commands in the wrong cluster-is one of the most common sources of lost points. Make it a physical habit: read the context-switch command first, paste it, verify with kubectl config current-context, then begin the task.
alias k=kubectl and enable kubectl autocompletion (source <(kubectl completion bash)). These two configurations alone can save five to ten minutes over a two-hour exam. Practice with these aliases so they are natural, not unfamiliar shortcuts added at the last moment.
After the Exam
Results are typically delivered within 24 hours. If you pass, your CKA credential is valid for two years and is renewable by retaking the exam. If you need to use your free retake, review the Killer.sh session and your remembered task failures carefully-the retake exam will be a different set of tasks but drawn from the same domain blueprint.
Curious about what the CKA credential actually unlocks professionally? Our CKA Salary Guide 2026: Complete Earnings Analysis covers compensation trends across roles and geographies, and our analysis of Is the CKA Certification Worth It? examines the ROI in concrete terms. You can also explore CKA Jobs to understand which roles specifically list the certification as a requirement or preference.
Continue building your exam readiness with CKA practice tests that mirror the performance-based format and help you develop the command-line speed the real exam demands.
Frequently Asked Questions
The CKA contains approximately 15-20 performance-based tasks. There are no multiple-choice questions. Every task requires you to produce a working result in a live Kubernetes environment via the Linux command line.
The passing score is 66%. Partial credit is available within individual tasks, so a well-executed partial solution still contributes to your total score. You do not need to complete every task perfectly to pass.
The Linux Foundation FAQ lists the current CKA environment as Kubernetes v1.35, while the product page shows v1.34. The stated policy is that the environment aligns with the latest Kubernetes minor release within 4-8 weeks. Always check the Linux Foundation FAQ immediately before scheduling your exam-do not rely on any third-party source for the active version.
No. The CKA is open-resource only to approved documentation inside the exam VM browser tab-official Kubernetes docs, the Kubernetes Blog, Helm docs, and a few other specified sources. External search engines, personal notes, and any site outside the approved list are strictly prohibited.
The CKA is considered a practitioner-level exam because every task is hands-on. Candidates with strong kubectl fluency and real-world cluster experience typically find it manageable; those with only theoretical knowledge often struggle with time pressure and troubleshooting tasks. Our detailed analysis at How Hard Is the CKA Exam? Complete Difficulty Guide 2026 covers the difficulty in depth.