CKA vs CKAD vs CKS: Which Kubernetes Certification Should You Take First?
The Cloud Native Computing Foundation offers three Kubernetes certifications, and the most common mistake is treating them as a difficulty ladder. They are not. CKA and CKAD test different jobs at a similar level. Only CKS sits genuinely above them — and it is the one with a hard prerequisite.
The short answer
- You operate the cluster — nodes, etcd, upgrades, things being broken at 3am: take CKA.
- You deploy onto someone else's cluster — manifests, probes, config, debugging your own workload: take CKAD.
- You already hold CKA and security is your remit: take CKS. You cannot sit it otherwise.
What each one actually covers
These weightings come from the published curriculum for each exam.
CKA — Certified Kubernetes Administrator
| Domain | Weight |
|---|---|
| Troubleshooting | 30% |
| Cluster Architecture, Installation & Configuration | 25% |
| Services & Networking | 20% |
| Workloads & Scheduling | 15% |
| Storage | 10% |
Note what dominates: troubleshooting is the single largest domain at 30%. CKA is not really an exam about installing Kubernetes. It is an exam about fixing it when it is already broken.
CKAD — Certified Kubernetes Application Developer
| Domain | Weight |
|---|---|
| Application Environment, Configuration and Security | 25% |
| Application Design and Build | 20% |
| Application Deployment | 20% |
| Services and Networking | 20% |
| Application Observability and Maintenance | 15% |
Flatter, and entirely from the workload's point of view. There is no etcd, no node management, no cluster upgrade. If your day job stops at the manifest, CKAD is your exam.
CKS — Certified Kubernetes Security Specialist
| Domain | Weight |
|---|---|
| Minimize Microservice Vulnerabilities | 20% |
| Supply Chain Security | 20% |
| Monitoring, Logging and Runtime Security | 20% |
| Cluster Setup | 15% |
| Cluster Hardening | 15% |
| System Hardening | 10% |
CKS requires an active CKA to book. That is not a recommendation, it is a gate, and it settles the ordering question for anyone aiming at security work: CKA first, always.
Something you must know before you buy any practice material
All three exams are 100% performance-based. There are no multiple-choice questions. You get a terminal, live clusters and roughly two hours to complete a set of hands-on tasks. CKA and CKAD pass at 66%; CKS at 67%.
This matters for how you prepare, and we would rather say it plainly than sell around it: a written practise exam for Kubernetes cannot reproduce that format. Our Kubernetes mock tests are knowledge checks built to the same published curriculum — they are excellent for finding which of the six or seven domains you are weak in before you spend hours in a terminal, and they will not teach you to type quickly under pressure. Every Kubernetes exam page on this site carries that disclosure at the top.
Use them for what they are good at. Sit a CKA knowledge check or a CKAD knowledge check first, find the domain that scores worst, then spend your terminal hours there rather than practising what you already know. Get a mock test pack and use the domain breakdown to aim your revision.
So which one first?
If you genuinely cannot choose between CKA and CKAD, take CKA. Its troubleshooting weighting forces you to understand how the pieces fit together, and that understanding makes CKAD substantially easier afterwards. The reverse is much less true. And if security is where you are heading, the decision is made for you.
Wondering how do I pass CKA on the first attempt? Know the domain weights, be fast in a terminal, and go in knowing which 30% you are weakest at — troubleshooting, most likely, because it is the largest domain and the hardest to fake.
See the full DevOps and Platform Engineer path for where these three sit alongside the cloud and automation certifications, or buy a CKS pack if you are already CKA-certified and going straight for the security specialism.