KCSA — Domain Weight Analysis

6 minute read

Domain Weight Analysis

The KCSA exam is not equally weighted across all domains. Some domains carry more than double the weight of others. Understanding these weights is the single most impactful thing you can do to optimize your remaining study time.

This page breaks down the official KCSA exam domains, maps them to tutorial chapters, and gives you a data-driven study plan.

Spending equal time on every domain is a mistake. Focus your remaining hours on the highest-weighted domains where you feel least confident.

Official KCSA Exam Domains and Weights

The Linux Foundation publishes the official domain weights for the KCSA exam. Here is the breakdown with estimated question counts based on a 60-question exam:

Domain Weight Est. Questions (~60) Study Priority
Overview of Cloud Native Security 14% ~8–9 High
Kubernetes Cluster Security 22% ~13–14 Highest
Kubernetes Cluster Component Security 22% ~13–14 Highest
Kubernetes Security Fundamentals 16% ~9–10 High
Kubernetes Threat Model 16% ~9–10 High
Compliance and Security Frameworks 10% ~6 Medium

Key takeaway: Domains 2 and 3 together account for 44% of the exam — nearly half. If you only have limited study time left, these two domains should get the majority of your attention.

Visual Weight Distribution

Cluster Security          ██████████████████████ 22%
Component Security        ██████████████████████ 22%
Security Fundamentals     ████████████████ 16%
Threat Model              ████████████████ 16%
Cloud Native Security     ██████████████ 14%
Compliance & Frameworks   ██████████ 10%

Time Allocation Strategy

If you have a fixed study block before the exam, allocate your time proportionally to the domain weights. Here is a recommended split for different time budgets:

One Week (35 hours available)

Domain Weight Allocated Hours
Overview of Cloud Native Security 14% 5 hours
Kubernetes Cluster Security 22% 8 hours
Kubernetes Cluster Component Security 22% 8 hours
Kubernetes Security Fundamentals 16% 5.5 hours
Kubernetes Threat Model 16% 5.5 hours
Compliance and Security Frameworks 10% 3 hours

Three Days (15 hours available)

Domain Weight Allocated Hours
Overview of Cloud Native Security 14% 2 hours
Kubernetes Cluster Security 22% 3.5 hours
Kubernetes Cluster Component Security 22% 3.5 hours
Kubernetes Security Fundamentals 16% 2.5 hours
Kubernetes Threat Model 16% 2.5 hours
Compliance and Security Frameworks 10% 1 hour

One Day (5 hours available)

Focus only on the top three domains by weight and review key tables:

Domain Allocated Hours
Kubernetes Cluster Security (22%) 1.5 hours
Kubernetes Cluster Component Security (22%) 1.5 hours
Kubernetes Security Fundamentals (16%) 1 hour
Quick review of remaining domains 1 hour

High-ROI Topics by Domain

These are the specific topics within each domain that are most likely to appear based on their weight and breadth of coverage:

Domain 1: Overview of Cloud Native Security (14%)

  • The 4Cs model (Cloud, Cluster, Container, Code) — almost guaranteed
  • Container image security best practices (minimal base images, non-root, scanning)
  • SBOM (Software Bill of Materials) — formats (SPDX, CycloneDX)
  • SLSA framework — the four levels and what each ensures
  • Shared responsibility model (cloud provider vs. cluster admin vs. developer)

Domain 2: Kubernetes Cluster Security (22%)

  • API server request flow — Authentication → Authorization → Admission Control (order matters)
  • RBAC — Role vs ClusterRole, RoleBinding vs ClusterRoleBinding, verbs, and resources
  • Authentication methods — X.509 certificates, OIDC tokens, service account tokens, bearer tokens
  • Authorization modes — RBAC, ABAC, Node, Webhook (and the evaluation chain)
  • Service account tokens — legacy vs projected (bound) tokens and why projected tokens are more secure

Domain 3: Kubernetes Cluster Component Security (22%)

  • etcd — encryption at rest, encryption providers (aescbc, aesgcm, secretbox, identity)
  • API server flags — --anonymous-auth, --insecure-port, --encryption-provider-config
  • kubelet — authentication modes, read-only port (10255), TLS bootstrapping
  • Secrets — base64 encoding vs encryption, Secret types, risks of etcd access
  • Audit logging — four audit levels (None, Metadata, Request, RequestResponse)

Domain 4: Kubernetes Security Fundamentals (16%)

  • Pod Security Standards — Privileged, Baseline, Restricted (what each allows/blocks)
  • Pod Security Admission — enforce, audit, warn modes
  • Security context — runAsNonRoot, readOnlyRootFilesystem, allowPrivilegeEscalation, capabilities
  • Network Policies — ingress/egress rules, AND vs OR logic (selectors within a rule vs across rules)
  • Resource limits — requests vs limits, why they matter for DoS prevention

Domain 5: Kubernetes Threat Model (16%)

  • STRIDE — all six categories with Kubernetes-specific examples
  • Attack surfaces — control plane (API server, etcd), node (kubelet), network, container runtime
  • Container escape techniques — privileged containers, hostPID, hostNetwork, mounting host paths
  • Persistence techniques — malicious workloads, backdoor containers, stolen credentials
  • Cloud metadata attacks — IMDS (Instance Metadata Service), link-local address 169.254.169.254

Domain 6: Compliance and Security Frameworks (10%)

  • CIS Kubernetes Benchmark — sections and what they cover, kube-bench tool
  • NIST SP 800-190 — focus on container security (not general NIST)
  • Policy-as-code — OPA/Gatekeeper vs Kyverno (architecture and approach differences)
  • GDPR — data protection requirements mapped to Kubernetes controls
  • Compliance automation — continuous compliance, drift detection, audit trails

Tutorial Chapter to Domain Mapping

Use this table to quickly jump back to the chapter that covers a specific domain:

KCSA Exam Domain Tutorial Chapter(s)
Overview of Cloud Native Security (14%) Chapter 2 — Cloud Native Security
Kubernetes Cluster Security (22%) Chapter 4 — Authentication & Authorization
Kubernetes Cluster Component Security (22%) Chapter 3 — Cluster Component Security
Kubernetes Security Fundamentals (16%) Chapter 5 — Pod & Network Security
Kubernetes Threat Model (16%) Chapter 6 — Threat Modeling
Compliance and Security Frameworks (10%) Chapter 8 — Compliance & Security Frameworks

Cross-cutting chapters (relevant to multiple domains):

  • Chapter 7 — Platform Security (node hardening, admission controllers, runtime sandboxing)
  • Chapter 9 — Cloud Native Security Tools (Falco, Trivy, OPA, Kyverno, service mesh)

Study Priority Matrix

Use this matrix to decide where to focus. Plot each domain based on its exam weight and your self-assessed confidence level:

                    HIGH WEIGHT
                        │
     ┌──────────────────┼──────────────────┐
     │ HIGH PRIORITY     │ MEDIUM PRIORITY   │
     │ (Study first)    │ (Maintain)        │
     │                  │                   │
     │ High weight +    │ High weight +     │
     │ Low confidence   │ High confidence   │
LOW  ├──────────────────┼──────────────────┤ HIGH
CONF │ MEDIUM PRIORITY   │ LOW PRIORITY      │ CONF
     │ (Quick review)   │ (Skim only)       │
     │                  │                   │
     │ Low weight +     │ Low weight +      │
     │ Low confidence   │ High confidence   │
     └──────────────────┼──────────────────┘
                        │
                    LOW WEIGHT

How to use this:

  1. Rate your confidence in each domain (1–5)
  2. Multiply confidence by weight to get a “readiness score”
  3. Study lowest readiness scores first

Weak Area Self-Assessment

Rate your confidence in each domain from 1 (not confident) to 5 (very confident). Then calculate your readiness score:

Domain Weight Your Confidence (1–5) Readiness Score (Weight × Confidence)
Cloud Native Security 14% ___ ___
Cluster Security 22% ___ ___
Component Security 22% ___ ___
Security Fundamentals 16% ___ ___
Threat Model 16% ___ ___
Compliance & Frameworks 10% ___ ___

Interpretation:

  • Readiness score below 50 → This domain needs significant review. Go back to the relevant chapter.
  • Readiness score 50–80 → Light review. Re-read the key takeaways and practice questions.
  • Readiness score above 80 → You are ready for this domain. Quick skim only.

Exam Time Management

You have 90 minutes for approximately 60 questions. That gives you about 1.5 minutes per question.

Recommended strategy:

Phase Time Action
First pass 60 minutes Answer all questions you are confident about. Flag uncertain ones.
Second pass 20 minutes Return to flagged questions. Eliminate wrong answers then choose.
Final review 10 minutes Check flagged questions one last time. Never leave blanks.

Per-domain time budget (proportional to weight):

Domain Weight Minutes (~90 total)
Cloud Native Security 14% ~13 minutes
Cluster Security 22% ~20 minutes
Component Security 22% ~20 minutes
Security Fundamentals 16% ~14 minutes
Threat Model 16% ~14 minutes
Compliance & Frameworks 10% ~9 minutes

Questions are not grouped by domain — they appear in random order. Do not try to track time per domain during the exam. Instead, use the two-pass strategy: fast first pass, then return to difficult questions.

Key Takeaways

Principle Detail
44% = two domains Cluster Security + Component Security dominate the exam
Never skip Compliance 10% is still ~6 questions — enough to make or break your score
Study proportionally Allocate time based on weight, not interest
Identify weak areas first Use the self-assessment to find your gaps
Practice under time pressure 1.5 minutes per question — practice with a timer
Use the two-pass strategy First pass fast, flag uncertain, second pass deliberate

Next: Mock Exam — Part 1

Updated:

You may also enjoy