KCSA — Exam Overview
Exam Snapshot
Before diving into the details, here’s everything you need to know about the KCSA exam at a glance:
| Detail | Value |
|---|---|
| Full Name | Kubernetes and Cloud Native Security Associate |
| Issuing Body | Cloud Native Computing Foundation (CNCF) via The Linux Foundation |
| Exam Code | KCSA |
| Duration | 90 minutes |
| Format | Multiple-choice questions (MCQ) |
| Number of Questions | ~60 |
| Passing Score | 75% |
| Delivery | Online, proctored via PSI Secure Browser |
| Retakes | 1 free retake included |
| Certification Validity | 3 years |
| Cost | $250 USD |
| Prerequisites | None (but basic K8s knowledge recommended) |
| Languages | English |
| Scheduling | Available year-round, schedule at your convenience |
Key Point: Unlike CKA and CKS, the KCSA exam does not give you a terminal. There are no clusters to access, no
kubectlcommands to run, and no YAML files to edit. This is a pure knowledge-based exam.
Exam Domains & Weights
The KCSA exam is organized into six domains, each testing a different area of Kubernetes and cloud-native security. The weight tells you what percentage of questions come from each domain.
| # | Domain | Weight | Approx. Questions |
|---|---|---|---|
| 1 | Overview of Cloud Native Security | 14% | ~8-9 |
| 2 | Kubernetes Cluster Component Security | 22% | ~13-14 |
| 3 | Kubernetes Threat Model | 16% | ~9-10 |
| 4 | Platform Security | 16% | ~9-10 |
| 5 | Compliance and Security Frameworks | 16% | ~9-10 |
| 6 | Cloud Native Security Tooling | 16% | ~9-10 |
| Total | 100% | ~60 |
What the Weights Tell You
The Kubernetes Cluster Component Security domain carries the highest weight at 22%. This means:
- More questions will come from this domain than any other
- You should spend proportionally more study time here
- Topics like API server security, etcd encryption, and kubelet configuration are critical
The remaining five domains are fairly evenly distributed at 14-16% each, meaning you can’t afford to skip any of them.
Domain Deep Dive
Let’s look at what each domain actually covers and which chapters in this tutorial address it.
Domain 1: Overview of Cloud Native Security (14%)
This domain tests your understanding of the big picture of cloud-native security.
Topics include:
- The 4Cs of Cloud Native Security — Cloud, Cluster, Container, Code
- Cloud provider and infrastructure security
- Attack surfaces in cloud-native environments
- Controls and control categories (preventive, detective, corrective)
- Isolation techniques (namespaces, network segmentation, sandboxing)
- Artifact security and provenance (SBOM, signing, registries)
- Security principles (defense in depth, least privilege, zero trust)
Exam tip: Know the 4Cs framework inside out — it appears in many questions across multiple domains.
Domain 2: Kubernetes Cluster Component Security (22%)
This is the heaviest domain and focuses on the security of Kubernetes components themselves.
Topics include:
- API server — authentication methods, authorization modes (RBAC, ABAC, Node, Webhook), admission controllers
- etcd — encryption at rest, access controls, backup security
- Kubelet — authentication, anonymous access, read-only port
- Container runtime — runtime classes, sandboxing (gVisor, Kata)
- kube-proxy — network-level security considerations
- Scheduler and controller manager — secure configurations
- Pod Security — Pod Security Standards (PSS), Pod Security Admission (PSA)
- Secrets management — types of secrets, encryption, external secret stores
Exam tip: Understand the role of each control plane component and how to secure it. Know the difference between authentication and authorization in the context of the API server.
Domain 3: Kubernetes Threat Model (16%)
This domain tests your ability to think like an attacker — understanding threats, attack vectors, and trust boundaries.
Topics include:
- STRIDE threat model — Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege
- Kubernetes-specific threat actors — insiders, external attackers, compromised containers
- Attack vectors — exposed dashboards, misconfigured RBAC, container escape, supply chain attacks
- Trust boundaries — where trust changes in a Kubernetes architecture
- Persistence techniques — how attackers maintain access
- Threat intelligence and vulnerability databases (CVE, NVD)
Exam tip: STRIDE is a favorite exam topic. Be able to map each STRIDE category to a Kubernetes-specific example.
Domain 4: Platform Security (16%)
This domain covers the security of the broader platform — images, supply chain, and infrastructure.
Topics include:
- Supply chain security — image provenance, signing (cosign, Notary)
- Image security — base image selection, vulnerability scanning, image policies
- Software Bill of Materials (SBOM) — what it is, why it matters
- Artifact registries — private registries, pull secrets, image pull policies
- CI/CD pipeline security — securing the build and deployment pipeline
- Infrastructure as Code (IaC) security — scanning templates for misconfigurations
Exam tip: Supply chain security is a hot topic in the industry and on the exam. Understand the concept of “trust the source” and how tools like cosign and SBOM help.
Domain 5: Compliance and Security Frameworks (16%)
This domain covers the frameworks and standards that guide security practices.
Topics include:
- CIS Kubernetes Benchmarks — what they are, how to use them, kube-bench
- Pod Security Standards (PSS) — Privileged, Baseline, Restricted levels
- Pod Security Admission (PSA) — enforce, audit, warn modes
- NIST Cybersecurity Framework — Identify, Protect, Detect, Respond, Recover
- Audit logging — what gets logged, audit policy, audit backends
- Compliance requirements — SOC 2, ISO 27001 (high-level awareness)
- Security benchmarks and hardening guides
Exam tip: Know the three PSS levels (Privileged, Baseline, Restricted) and what each one allows/restricts. Also know the three PSA modes.
Domain 6: Cloud Native Security Tooling (16%)
This domain tests your awareness of the tools used to implement and monitor security.
Topics include:
- Admission controllers — what they are, built-in vs. dynamic, validating vs. mutating
- OPA/Gatekeeper — policy-as-code, ConstraintTemplates, Constraints
- Runtime security — Falco (rules, alerts, sources), container runtime monitoring
- Vulnerability scanning — Trivy, Grype, image scanning in CI/CD
- Network policies — ingress/egress rules, default deny, namespace isolation
- Service mesh security — mTLS, Istio/Linkerd security features
- Secrets management tools — Vault, Sealed Secrets, External Secrets Operator
Exam tip: You won’t need to write Falco rules or OPA policies from memory, but you must understand what each tool does, when to use it, and how it fits into the security picture.
Tutorial-to-Domain Mapping
Here’s how the chapters in this tutorial map to the six exam domains:
| Tutorial Chapter | Exam Domain | Weight |
|---|---|---|
| Ch 1: Introduction | — | Foundation for all domains |
| Ch 2: Overview of Cloud Native Security | Domain 1: Overview of Cloud Native Security | 14% |
| Ch 3: Kubernetes Cluster Component Security | Domain 2: Kubernetes Cluster Component Security | 22% |
| Ch 4: Kubernetes Threat Model | Domain 3: Kubernetes Threat Model | 16% |
| Ch 5: Platform Security | Domain 4: Platform Security | 16% |
| Ch 6: Compliance and Security Frameworks | Domain 5: Compliance and Security Frameworks | 16% |
| Ch 7: Cloud Native Security Tooling | Domain 6: Cloud Native Security Tooling | 16% |
Each tutorial chapter directly corresponds to one exam domain. Study every chapter, and you’ll have covered the entire exam.
How KCSA Compares to Performance-Based Exams
If you’ve heard about CKA or CKS, you might be wondering how KCSA’s MCQ format differs. Here’s a detailed comparison:
| Aspect | KCSA (Multiple-Choice) | CKA / CKS (Performance-Based) |
|---|---|---|
| Question Format | Choose from A, B, C, D options | Solve tasks on live K8s clusters |
| Environment | PSI Secure Browser, no terminal | Browser-based terminal + K8s cluster |
| Tools Available | None (just the question) | kubectl, vim, systemctl, etc. |
| Reference Docs | Not allowed | kubernetes.io allowed |
| Partial Credit | No (each MCQ is right or wrong) | Yes (partial completion may earn points) |
| Time Pressure | ~1.5 min per question | ~5-8 min per task |
| Skill Tested | Recognition & understanding | Recall & execution |
| Preparation Style | Read, understand, practice questions | Practice on real clusters |
| Difficulty | Breadth over depth | Depth over breadth |
What This Means for Your Study Approach
For KCSA, your study approach should be:
- Read and understand concepts — Don’t just memorize; understand why each security control exists
- Practice with MCQs — Get comfortable with the question format and elimination technique
- Build mental models — Create comparison tables and flowcharts in your mind
- Cover all domains — You can’t skip any domain; the exam is broad
This is different from CKA/CKS prep, where you’d spend most of your time in a terminal practicing commands.
Scoring and Results
- Each correct answer earns points proportional to the domain weight
- There’s no negative marking — guessing is always better than leaving a question blank
- You’ll receive your score via email within 24 hours of completing the exam
- If you don’t pass, you get 1 free retake (included in the exam fee)
- The passing score is 75%, which means you can afford to miss about 15 questions
Key Takeaways
- KCSA has 6 domains with the heaviest being Kubernetes Cluster Component Security (22%)
- The exam is multiple-choice only — no terminal, no kubectl, no live clusters
- You get 90 minutes for ~60 questions (~1.5 minutes per question)
- No reference docs are allowed during the exam (unlike CKA/CKS)
- Every chapter in this tutorial maps to one exam domain
- There’s no negative marking — always answer every question
- One free retake is included if needed
What’s Next?
Now let’s compare KCSA with the other Kubernetes certifications in detail — understanding these differences will help you plan your certification journey.
