CKA Exam Format: Domains, Scoring, and What Changed

The CKA exam is a 2-hour, performance-based test with 15 to 20 tasks in a live Kubernetes terminal. You need a 66% to pass. Each task is weighted differently, and you have access to the official Kubernetes documentation during the exam. That is the format in a nutshell.

This guide breaks down every domain, what the weights mean for your study time, how scoring actually works, what is allowed during the exam, and the changes that have been made to the CKA over the past year.

CKA Exam Format Overview

Detail	Value
Price	$445
Duration	2 hours
Format	Performance-based (live terminal)
Number of tasks	15 to 20
Passing score	66%
Validity	2 years
Free retake	Yes, one included
Practice sessions	Two included (36 hours each)
Prerequisites	None
Proctored	Yes, online via PSI
Open book	kubernetes.io/docs only

The exam runs in a browser-based terminal environment. You connect to real Kubernetes clusters and complete tasks. No multiple choice. No simulations. You run actual kubectl commands and the automated grading system checks whether the cluster state matches the expected result.

You interact with multiple clusters during the exam. Each question specifies which cluster to use and provides the context-switching command. Forgetting to switch contexts is one of the most common reasons people lose points. The task might be correct, but if it is on the wrong cluster, the grading system will not find it.

CKA Exam Domains and Weights

The CKA exam curriculum is organized into five domains. The Linux Foundation publishes the official curriculum on their website, and it gets updated periodically. Here are the current domains and their weights.

Cluster Architecture, Installation and Configuration (25%)

This is the "admin" core of the CKA. It covers how to set up and maintain a Kubernetes cluster.

What gets tested:

• Manage Role-Based Access Control (RBAC)
• Use kubeadm to install a basic cluster
• Manage a highly available Kubernetes cluster
• Provision underlying infrastructure for cluster deployment
• Perform a version upgrade on a Kubernetes cluster using kubeadm
• Implement etcd backup and restore

Why it matters:

This domain is 25% of the exam. The kubeadm tasks (cluster installation and upgrades) and etcd backup/restore appear on nearly every exam. RBAC questions are also common. If you study nothing else in this domain, make sure you can do these three things from memory:

1. Initialize a cluster with kubeadm init
2. Upgrade a cluster with kubeadm upgrade
3. Backup and restore etcd

The kubeadm upgrade process has a specific order that matters:

# On the control plane node:
sudo apt-get update
sudo apt-get install -y kubeadm=1.31.0-1.1
sudo kubeadm upgrade plan
sudo kubeadm upgrade apply v1.31.0

# Upgrade kubelet and kubectl
sudo apt-get install -y kubelet=1.31.0-1.1 kubectl=1.31.0-1.1
sudo systemctl daemon-reload
sudo systemctl restart kubelet

Getting the order wrong (for example, upgrading kubelet before kubeadm) will break things. Practice this sequence multiple times.

etcd backup is straightforward once you have the command memorized:

ETCDCTL_API=3 etcdctl snapshot save /tmp/etcd-backup.db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

The certificate paths trip people up. They are always in /etc/kubernetes/pki/etcd/ on a kubeadm cluster, but verify by checking the etcd pod manifest at /etc/kubernetes/manifests/etcd.yaml.

Troubleshooting (30%)

This is the highest-weighted domain. Nearly a third of your exam score comes from troubleshooting.

What gets tested:

• Evaluate cluster and node logging
• Understand how to monitor applications
• Manage container stdout and stderr logs
• Troubleshoot application failure
• Troubleshoot cluster component failure
• Troubleshoot networking

Why it matters:

30% is huge. If you are great at troubleshooting and average everywhere else, you can pass. If you are weak at troubleshooting, you probably will not.

The troubleshooting tasks on the CKA fall into a few categories:

Broken Pods: A Pod is in CrashLoopBackOff, ImagePullBackOff, or Pending. You need to figure out why and fix it. The debugging workflow is always the same:

kubectl get pods -A
kubectl describe pod <name> -n <namespace>
kubectl logs <pod> -n <namespace>
kubectl logs <pod> -n <namespace> --previous  # for crashed containers

Broken nodes: A node shows NotReady. You SSH to the node, check the kubelet, and fix whatever is wrong. Common causes: kubelet not running, wrong configuration file path, expired certificates.

ssh node01
sudo systemctl status kubelet
sudo journalctl -u kubelet -n 50

Broken control plane components: The API server, scheduler, or controller manager is down. These run as static pods, so you check their manifests in /etc/kubernetes/manifests/. A common exam trick is a typo in the manifest file (wrong image name, wrong volume mount path).

Networking issues: A Service is not routing traffic. You check endpoints, selectors, ports, and DNS.

Build a systematic debugging approach. Do not guess randomly. Start with kubectl get, then kubectl describe, then kubectl logs, then check the node-level components if needed. Practice this workflow until it is automatic.

Services and Networking (20%)

What gets tested:

• Understand host networking configuration on cluster nodes
• Understand connectivity between Pods
• Understand ClusterIP, NodePort, and LoadBalancer service types
• Know how to use Ingress controllers and Ingress resources
• Know how to configure and use CoreDNS
• Choose an appropriate container network interface plugin

NetworkPolicies are the most common exam question in this domain. The YAML for network policies is not intuitive, and the default behavior (deny all once any policy is applied) catches people off guard.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-specific
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: database
      ports:
        - protocol: TCP
          port: 5432

Know how to create Services imperatively. This saves time on the exam:

kubectl expose deployment web --port=80 --target-port=8080 --type=NodePort
kubectl expose pod nginx --port=80 --name=nginx-svc

DNS resolution within a cluster follows a predictable pattern. A Service called my-svc in namespace my-ns is reachable at my-svc.my-ns.svc.cluster.local. You will likely need to test DNS resolution during the exam:

kubectl run test --image=busybox:1.28 --rm -it -- nslookup my-svc.my-ns.svc.cluster.local

Workloads and Scheduling (15%)

What gets tested:

• Understand deployments and how to perform rolling updates and rollbacks
• Use ConfigMaps and Secrets to configure applications
• Know how to scale applications
• Understand the primitives for creating self-healing application deployments
• Understand how resource limits can affect Pod scheduling
• Awareness of manifest management and common templating tools

This domain is worth 15%. The tasks here tend to be faster to complete, which makes them high-value points. Creating a Deployment, scaling it, and doing a rollback should take you under 3 minutes if you know the imperative commands.

# Create a deployment
kubectl create deployment web --image=nginx:1.25 --replicas=3

# Scale it
kubectl scale deployment web --replicas=5

# Update the image (triggers rolling update)
kubectl set image deployment/web nginx=nginx:1.26

# Check rollout status
kubectl rollout status deployment/web

# Rollback
kubectl rollout undo deployment/web

ConfigMaps and Secrets are also common:

# Create a ConfigMap
kubectl create configmap app-config --from-literal=DB_HOST=postgres --from-literal=DB_PORT=5432

# Create a Secret
kubectl create secret generic db-creds --from-literal=username=admin --from-literal=password=secret123

Know how to mount these as environment variables and as volume mounts. The YAML for volume-mounted ConfigMaps shows up regularly.

Storage (10%)

What gets tested:

• Understand storage classes and persistent volumes
• Understand volume modes, access modes, and reclaim policies
• Understand persistent volume claims
• Know how to configure applications with persistent storage

Storage is 10% of the exam. That is the smallest domain, but it is easy points if you know the PV/PVC workflow. A typical storage task:

1. Create a PersistentVolume with specific capacity and access mode
2. Create a PersistentVolumeClaim that binds to it
3. Mount the PVC in a Pod

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-data
spec:
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: /mnt/data
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-data
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi

Make sure the access mode and storage size match between PV and PVC, or the PVC will stay in Pending state. This is a common gotcha.

How CKA Scoring Works

The CKA does not use a simple "each question is worth the same" model. Each task has a specific point weight. The weights are displayed on the exam screen next to each question.

Key scoring facts:

• Tasks range from about 2% to 13% of the total score
• You need 66% total to pass
• Partial credit exists for some tasks (if a task has multiple parts, you can get points for the parts you complete correctly)
• The automated grading system checks cluster state, not your process. If you get the right result using a different method than expected, you still get credit
• There is no penalty for wrong answers. Attempting a question cannot hurt you

What 66% means in practice: If the exam has 17 tasks, you could potentially fail 5 or 6 lower-weighted tasks and still pass. But that math only works if you nail the high-value tasks. Always check the point weight before starting a question. A 13% question deserves more time than a 2% question.

What Changed in the CKA Exam

The CKA curriculum gets updated periodically to match new Kubernetes versions. Here are the notable changes over the past year.

Kubernetes version updates: The exam environment runs a recent Kubernetes version. As of early 2026, expect clusters running Kubernetes 1.30 or 1.31. The core concepts have not changed, but some API versions and feature gates differ.

PSI Secure Browser: The exam uses the PSI secure browser instead of the older Chrome-based proctor setup. The experience is similar, but the browser handles clipboard operations differently. Practice copy-pasting within the secure browser environment during your practice sessions.

Documentation access: You can still access kubernetes.io/docs, the Kubernetes blog (kubernetes.io/blog), and the kubectl reference. No other websites are allowed. GitHub, Stack Overflow, and any other resources are blocked.

Practice sessions: The two included practice sessions now run for 36 hours each. They simulate the real exam environment. Use them. The practice questions are often harder than the real exam, which is exactly what you want.

Remote desktop: Some tasks require you to SSH into nodes. The exam environment provides this, and you need to be comfortable working across multiple terminal sessions.

Time Management on the CKA

Two hours. 15 to 20 tasks. That works out to 6 to 8 minutes per task on average. But that average is misleading because some tasks take 2 minutes and others take 15.

Strategy that works:

1. First pass (60 to 70 minutes): Work through every question in order. Solve the ones you know quickly. Flag anything that will take more than 8 minutes.
2. Second pass (40 to 50 minutes): Return to flagged questions. Tackle the highest-weighted ones first.
3. Final check (10 to 15 minutes): Review your answers. Verify that you ran the context-switch command for each question. Check that Pods are actually Running, not stuck in Pending or CrashLoopBackOff.

Time-saving habits:

• Use kubectl aliases and autocompletion from the start
• Generate YAML with --dry-run=client -o yaml instead of writing it from scratch
• Use imperative commands for simple resources (Services, ConfigMaps, Secrets, RoleBindings)
• Copy commands from the Kubernetes docs when the exact syntax is complex (like etcd backup)
• Always verify with kubectl get after creating or modifying a resource

# Set up at the start of the exam
alias k=kubectl
source <(kubectl completion bash)
complete -F __start_kubectl k
export EDITOR=vim

The alias k instead of kubectl saves roughly 6 characters per command. Over 100+ commands in an exam, that adds up.

What You Can and Cannot Do During the CKA

Allowed:

• Access kubernetes.io/docs, kubernetes.io/blog, and the kubectl reference
• Use the built-in terminal and text editors (vim, nano)
• Copy and paste within the exam environment
• Use one external monitor (or laptop screen)
• Have a glass of water on your desk

Not allowed:

• Personal notes, cheat sheets, or bookmarks
• Second monitors or additional screens
• Headphones or earbuds (unless explicitly permitted by the proctor)
• Other browser tabs or applications
• Talking to anyone
• Leaving the camera view

Gray areas:

• The Kubernetes docs site occasionally links to external GitHub pages. Clicking those links will be blocked. Stick to kubernetes.io only.
• You can use kubectl explain to get resource field documentation directly from the terminal. This is faster than searching the web docs for many tasks.

# Use kubectl explain instead of searching the docs
kubectl explain pod.spec.containers
kubectl explain deployment.spec.strategy
kubectl explain networkpolicy.spec.ingress

kubectl explain is your secret weapon. It shows the fields and descriptions for any resource type directly in your terminal. No tab switching, no searching. Learn to use it.

CKA vs CKAD Exam Format Comparison

If you are deciding between the CKA and CKAD, here is how the formats compare.

Aspect	CKA	CKAD
Duration	2 hours	2 hours
Passing score	66%	66%
Format	Performance-based	Performance-based
Tasks	15 to 20	15 to 20
Focus	Cluster administration	Application development
Cluster access	Multi-cluster	Multi-cluster
Price	$445	$445

The format is identical. The difference is content. The CKA tests cluster setup, maintenance, and troubleshooting. The CKAD focuses on deploying, configuring, and troubleshooting applications. There is about 40% overlap between the two exams.

For a detailed comparison, read CKA vs CKAD: Which Should You Take First?. For a broader perspective on all three professional certs, see CKA vs CKAD vs CKS Comparison.

How to Prepare for the CKA Exam Format

The format is as much a challenge as the content. Here is how to prepare for the format itself, separate from studying the material.

Practice in a terminal every day. The exam is 100% command line. If you study by reading documentation or watching videos without running commands, you are not preparing for the exam format. Our CKA study guide has a complete study plan.

Build and destroy clusters. Use kubeadm on VMs (Vagrant works well), kind for quick local clusters, or minikube for single-node testing. The act of building clusters from scratch teaches you what can go wrong and how to fix it.

Simulate time pressure. Give yourself 10 minutes to complete a set of 3 tasks. The time pressure on the CKA is real, and the only way to get faster is to practice under pressure.

Use the practice sessions. Your exam purchase includes two practice sessions. They use the same environment as the real exam. Take the first one 7 to 10 days before your exam date to identify weak spots. Take the second one 2 to 3 days before as a final check.

For a detailed guide on setting up practice environments and specific exercises to run, see our CKA Practice Labs guide.

FAQ

How many questions are on the CKA exam?

The CKA has 15 to 20 performance-based tasks. The exact number varies between exam sessions. Each task has a different point weight, displayed on screen. Some tasks are worth 2% while others are worth 8% or more.

What is the CKA passing score?

You need 66% to pass the CKA. With the variable task weights, this means you can miss several lower-weighted tasks and still pass, as long as you do well on the high-value questions.

How long is the CKA exam?

The CKA exam is 2 hours (120 minutes). There is no break. You can flag questions and return to them, but the timer does not pause.

Can I use the Kubernetes docs during the CKA?

Yes. You can access kubernetes.io/docs, kubernetes.io/blog, and the kubectl reference during the exam. No other websites are allowed. You cannot use personal notes, bookmarks, or external resources.

What Kubernetes version is on the CKA exam?

The exam runs a recent stable Kubernetes version. As of early 2026, expect Kubernetes 1.30 or 1.31. The exact version is listed on the Linux Foundation's CKA page and is updated when the curriculum changes.

Is the CKA multiple choice?

No. The CKA is entirely performance-based. You work in a live terminal with real Kubernetes clusters. There are no multiple-choice questions. You type commands, create resources, and fix problems. The automated grading system checks the cluster state to determine your score.

What happens if I fail the CKA?

You get one free retake included with your exam purchase. Schedule the retake whenever you are ready. Use the time between attempts to practice the domains where you lost points. If you fail the retake too, you need to purchase a new exam.

How often does the CKA exam format change?

The CKA curriculum is updated periodically, usually once or twice a year, to align with new Kubernetes versions. The exam format itself (performance-based, 2 hours, live terminal) has remained consistent since its introduction. Domain weights may shift slightly with curriculum updates.

Is the CKA harder than the CKAD?

Most people find the CKA slightly harder because it covers cluster-level operations (etcd, kubeadm, node troubleshooting) that the CKAD does not touch. The CKAD focuses on application-level tasks, which tend to be more straightforward if you are comfortable with kubectl. Both exams have the same passing score (66%) and time limit (2 hours).