Exampractice
DevOps & Linux

CKAD vs CKA: Which Exam Should You Take First?

CKAD or CKA first? Compare scope, difficulty, curriculum overlap and career fit to pick the right starting exam — and the right order if you plan to take both.

Kenji Nakamura · 9 min read
Flowchart showing the choice between CKA administrator path and CKAD developer path converging at the CKS security exam

People searching "CKAD vs CKA which first" are usually hoping the Cloud Native Computing Foundation (CNCF) has answered the question for them — that one exam is officially the junior step and the other the senior one. It has not. Neither the Certified Kubernetes Administrator (CKA) nor the Certified Kubernetes Application Developer (CKAD) is a prerequisite for the other, and neither sits lower on the ladder.

Short answer: with no mandated sequence, the sensible order falls out of two facts. First, the exams certify different jobs — CKAD examines the person shipping applications onto Kubernetes, CKA the person keeping the clusters themselves running — so your day-to-day work nominates a natural starting exam. Second, the CNCF ladder contains exactly one sequencing constraint: the Certified Kubernetes Security Specialist (CKS) can only be attempted with a current CKA, never a CKAD. If security certification is anywhere in your plans, CKA belongs first, or at least not last.

The rest of this article earns that answer. We will compare what each exam actually covers, how their difficulty differs in kind rather than degree, where their curricula overlap (more than you might expect), and then walk through the reader scenarios that decide the order in practice. What this article will not do is teach you how to prepare for either exam — the CKA preparation checklist and the CKAD study plan for developers exist for exactly that.

Two exams, one platform, different jobs

Sequencing would be easier if the logistics separated the exams, but they barely do. CNCF designs both certifications; the Linux Foundation administers both. Each is a two-hour, online remotely proctored session of hands-on tasks worked from a command line against live Kubernetes clusters — no multiple-choice questions anywhere, which remains unusual among major IT certifications. As of 2026, each runs on Kubernetes v1.35, carries a $445 USD standalone fee (confirm current pricing on the Linux Foundation's site, as bundles and regional taxes vary), sets the pass mark at 66%, and stays valid for two years, renewable only by retaking the then-current exam.

With the mechanics near-identical, everything that matters for ordering lives in the role each exam examines.

The CKAD examines you as a consumer of a cluster. Its domains — Application Environment, Configuration and Security (25%), Application Design and Build (20%), Application Deployment (20%), Services and Networking (20%), and Application Observability and Maintenance (15%) — all live in the space a developer occupies: defining workloads, wiring configuration and secrets into them, deploying and rolling them back, exposing them, and working out why they are misbehaving. You are never asked to build or repair the cluster underneath.

The CKA examines you as the owner of the cluster. Its weights tell the story: Troubleshooting alone is 30%, Cluster Architecture, Installation and Configuration is 25%, then Services and Networking (20%), Workloads and Scheduling (15%) and Storage (10%). CKA candidates bootstrap clusters with kubeadm, upgrade nodes, back up and restore etcd, revive broken kubelets, and untangle networking at the infrastructure layer. A February 2025 curriculum revision pushed it further towards real operations work, adding Gateway API, Helm and Kustomize, and troubleshooting of the container-runtime, storage and network plugin interfaces.

Put crudely: CKAD asks "can you run your application well on Kubernetes?"; CKA asks "can you keep Kubernetes itself alive?".

Side-by-side comparison

FactorCKADCKA
Best forDevelopers building and deploying applications on KubernetesAdministrators, platform, SRE and DevOps engineers running clusters
Format2-hour, online-proctored, performance-based (live clusters)2-hour, online-proctored, performance-based (live clusters)
Difficulty characterSpeed-dominated: familiar developer tasks, unforgiving paceDepth-dominated: heavier troubleshooting and cluster internals, plus time pressure
PrerequisitesNoneNone
Cost (2026, standalone)$445 USD (bundles extra; verify current fee)$445 USD (bundles extra; verify current fee)
Heaviest domainApplication Environment, Configuration & Security (25%)Troubleshooting (30%)
Skills signalledWorkload design, config/secrets, deployment strategies, app debuggingCluster install/upgrade, etcd backup/restore, node and network troubleshooting, RBAC
Career path it feedsBackend/platform-adjacent developer roles on Kubernetes teamsPlatform engineering, SRE, infrastructure and DevOps roles; gateway to CKS
UnlocksNothing further (terminal credential)Eligibility for the CKS security specialist exam
Validity & renewal2 years; renew by retaking the current exam2 years; renew by retaking the current exam

Both purchases include a 12-month eligibility window, one free retake, and two sessions of the killer.sh exam simulator — worth knowing because it means a wrong first choice costs you time, not a forfeited fee, within that window.

Is one harder than the other?

Neither exam publishes a pass rate, so any confident claim that "CKA is 30% harder" is invented. What can be said honestly is that they are difficult in different ways.

The CKAD's difficulty is almost entirely tempo. Its individual tasks — write a Deployment, mount a Secret, fix a probe — are things a working Kubernetes developer has done before; the challenge is doing many of them, correctly, inside two hours. Candidates who fail tend to fail on pace and fiddly detail rather than on concepts.

The CKA layers time pressure on top of broader and deeper subject matter. Its troubleshooting-heavy weighting means you can be dropped into a cluster that is broken in a way you have never seen, spanning Linux service management, certificates, networking plugins and etcd — territory most application developers have simply never visited. For someone coming from operations, though, that material is home turf, and plenty of ops engineers find CKAD's application-modelling emphasis the more foreign of the two.

That is the honest resolution of the "CKAD vs CKA difficulty" question: the harder exam is the one further from your day job. Deeper single-exam difficulty assessments live in how hard is the CKA exam? and how hard is the CKAD exam?.

One myth worth flattening while we are here: CKAD is not "the beginner exam". Both certifications are intermediate, hands-on credentials. The genuine entry point to the CNCF ladder is the multiple-choice Kubernetes and Cloud Native Associate (KCNA); the full ladder, including the associate tier, is mapped in Kubernetes certifications explained.

How much does the first exam help with the second?

More than the marketing suggests, which matters enormously for sequencing. Both exams share:

  • The exam machinery itself. Same two-hour performance format, same PSI Bridge remote-proctoring platform, same allowed-use of specified official documentation inside the environment, same 66% bar. Sitting either one teaches you how to sit the other.
  • Core kubectl fluency. Imperative resource creation, context and namespace switching, kubectl explain, log-reading and describe-driven debugging are the working currency of both exams.
  • A whole overlapping domain. Services and Networking is 20% of each exam, and workload management, configuration, probes and basic scheduling appear on both sides in different depths.

In practice, whichever exam you pass first, you arrive at the second with the format anxiety gone and a substantial minority of the material already banked. The delta from CKAD to CKA is cluster operations (kubeadm, etcd, node troubleshooting, RBAC depth); the delta from CKA to CKAD is application-design detail and sheer drill speed. Both deltas are very manageable as a second project — which is why the order should be decided by career logic, not by hunting for the "easier" starting point.

The decision framework: four questions

Answer these in order; stop at the first decisive one.

  1. What does your calendar say you do? Look at your last month of work. Mostly writing and shipping services that run on a cluster someone else maintains → CKAD first. Mostly maintaining, upgrading or debugging clusters (or wanting to) → CKA first.
  2. Do you want CKS within the next couple of years? The security specialist exam requires a current, unexpired CKA — CKAD does not count. If security specialisation is the destination, take CKA first so the two-year clocks line up sensibly; the sequencing economics are explored in CKA vs CKS.
  3. Which job are you applying for? If a target role or internal move names one credential, that one goes first — a certification aimed at next quarter's interview beats a theoretically tidier order.
  4. Still tied? Take CKA first. It is the more broadly recognised operations signal, it is the only one that gates a further credential, and its curriculum superset means the subsequent CKAD feels like a speed-run rather than a second mountain.

If, on the other hand, you only ever intend to hold one of the two, that is a different question from ordering — the head-to-head CKA vs CKAD choice article settles it. And for how either exam slots into a longer progression of roles and seniority, see the Kubernetes certification career path. Pay outcomes for certified Kubernetes professionals get one sentence here because they have their own home: the Kubernetes certification salary guide covers ranges by role and region.

Four realistic scenarios

The backend developer on a product team. Three years of Python services, deploys to a cluster the platform team owns, has never run kubeadm in her life. CKAD first, unambiguously — it certifies the job she already does and fills gaps (NetworkPolicies, probes, resource limits) that make her better at it this quarter. CKA can follow later if she drifts platform-wards.

The sysadmin becoming a platform engineer. A decade of Linux administration, newly handed a Kubernetes migration. CKA first — the curriculum is essentially his new job description, from cluster bootstrap to etcd recovery, and his Linux depth neutralises the exam's hardest terrain. CKAD afterwards is optional polish for empathising with his developer customers.

The DevOps engineer who genuinely does both. Writes deployment pipelines, owns some cluster care, wants CKS eventually because her organisation is security-sensitive. CKA first, because of the CKS gate: CKA → CKS → CKAD (if still wanted) wastes nothing, whereas CKAD → CKA → CKS pushes the security credential a cycle further out.

The career-changer with modest Kubernetes exposure. Completed courses, built home-lab projects, no professional cluster time yet. Consider whether either intermediate exam is the right first step at all — the associate-level KCNA exists precisely for this stage — then choose between CKAD and CKA by the role being targeted, not by perceived ease. A useful reality check before committing $445 is an hour with free sample questions: browse the CKA practice questions and CKAD practice questions pages and notice which exam's tasks read like your work and which read like a foreign language — that instinct is usually the correct order.

Frequently asked questions

Can I take the CKA and CKAD in either order, or together?

Either order — neither requires the other, and nothing stops you holding both. Each purchase carries its own 12-month eligibility window, so many people book the second exam a few months after the first while the shared skills are fresh. The Linux Foundation also sells a CKA + CKAD + CKS bundle (listed at $1,245 as of 2026 against $1,335 separately) for those committed to the full set from the start.

Does holding both CKA and CKAD look better than holding one?

It signals range — you can both run clusters and build well-behaved applications on them — and it is two of the five certifications in the CNCF's Kubestronaut recognition programme for people who hold all five. But a single certification aligned to your actual role, backed by real experience, beats a mismatched pair collected for completeness.

If I fail my first choice, should I switch to the other exam?

Usually not. Your purchase includes one free retake, and a near-miss on the right exam is worth more than a fresh start on the wrong one. Switch only if the failure revealed that the exam's subject matter — not its pace — is genuinely alien to your work.

Do both expire on the same schedule?

Yes: any CNCF Kubernetes certification earned on or after 1 April 2024 is valid for two years, and renewal means retaking the then-current exam. Factor that in before racking up multiple credentials whose retake dates will land in the same year.

The order, settled

Sequencing CKAD and CKA is a career decision wearing an exam costume. Developers start with CKAD because it certifies today's job; operations and platform people start with CKA because it certifies theirs and is the sole doorway to CKS; genuine hybrids default to CKA for the doors it opens. There is no wrong first exam — only a slower route to the same pair — but there is a faster one, and it is the exam whose tasks you could almost do already. Pick that one, book it, and let the second exam inherit everything the first one taught you.

Exam facts in this guide were checked against official certification-provider pages on . Fees, exam codes and policies change — confirm on the provider’s own site before you book.

Put it into practice

Test what you have just read

Reading about an exam only takes you so far. Work through practice questions for your certification and find the gaps before exam day does.

You may also like