KCSA — Prerequisites & Study Plan
Do You Have the Prerequisites?
KCSA has no formal prerequisites — anyone can register and take the exam. However, having a baseline understanding of Kubernetes and general security concepts will make your preparation significantly more effective.
Use the self-assessment checklists below to evaluate your readiness. Don’t worry if you can’t check every box — this tutorial will cover what you need.
Kubernetes Knowledge Self-Assessment
Check off the concepts you’re comfortable with:
- I know what a Kubernetes cluster is (control plane + worker nodes)
- I understand what Pods, Deployments, and Services are
- I know what Namespaces are and why they’re used
- I understand what ConfigMaps and Secrets do
- I know what the API server does
- I’ve heard of RBAC (Role-Based Access Control)
- I know what kubectl is (even if I’ve only used it a few times)
- I understand basic container concepts (images, containers, registries)
- I know the difference between a container and a Pod
- I understand that Kubernetes uses YAML manifests to define resources
Scoring
| Checked | Readiness Level | Recommendation |
|---|---|---|
| 8-10 | Ready — You have solid K8s fundamentals | Jump into the study plan |
| 5-7 | Almost — A few gaps to fill | Start the tutorial; reference K8s basics as needed |
| 2-4 | Getting there — Need more K8s exposure | Spend 1 week on K8s fundamentals first |
| 0-1 | Not yet — Start with Kubernetes basics | Consider KCNA first, or complete a K8s beginner course |
Security Concepts Self-Assessment
Check off the concepts you’re comfortable with:
- I understand what encryption is (at rest and in transit)
- I know what authentication and authorization mean
- I’ve heard of the CIA Triad (Confidentiality, Integrity, Availability)
- I understand what a firewall does
- I know what TLS/SSL is and why it’s used
- I understand the concept of least privilege
- I’ve heard of vulnerability scanning
- I know what a CVE (Common Vulnerabilities and Exposures) is
- I understand what audit logging is
- I’ve heard of zero trust security
Scoring
| Checked | Readiness Level | Recommendation |
|---|---|---|
| 8-10 | Strong — Excellent security foundation | Focus on K8s-specific security topics |
| 5-7 | Good — Solid understanding of basics | The Security Concepts Overview chapter fills the gaps |
| 2-4 | Building — Need more security exposure | Read the Security Concepts Overview carefully before proceeding |
| 0-1 | Starting fresh — That’s okay! | This tutorial teaches everything from the ground up |
Study Resource Options
Here are the resources available for KCSA preparation, organized by type and cost:
Free Resources
| Resource | Type | What It Covers |
|---|---|---|
| This tutorial | Comprehensive guide | All 6 KCSA exam domains with practice questions |
| CNCF KCSA Curriculum | Official exam outline | Exam domains, topics, and subtopics |
| Kubernetes Official Documentation | Reference | kubernetes.io — in-depth docs on all K8s features |
| CNCF Cloud Native Security Whitepaper | PDF guide | Cloud-native security concepts and best practices |
| Kubernetes Security Best Practices | Blog posts | Various community blogs covering security topics |
| CNCF YouTube Channel | Videos | Talks on cloud-native security from KubeCon |
| Falco Documentation | Tool docs | Runtime security tool docs (relevant for Domain 6) |
| CIS Kubernetes Benchmark | Hardening guidelines (relevant for Domain 5) |
Paid Resources
| Resource | Type | Cost | What It Covers |
|---|---|---|---|
| Linux Foundation KCSA Course | Official online course | ~$300 USD | Structured curriculum aligned with exam domains |
| KodeKloud KCSA Course | Online course | ~$15-20/month | Video lessons + practice tests |
| Udemy KCSA Courses | Online course | ~$15-30 | Various instructors, look for high ratings |
| A Cloud Guru / Pluralsight | Online course | Subscription | Cloud-native security courses |
| Killer.sh KCSA Simulator | Practice exams | Included with exam purchase | Realistic exam simulation |
Note: Your KCSA exam purchase includes two sessions on the Killer.sh exam simulator. These sessions are the closest thing to the actual exam — use them wisely (ideally as your final prep).
3-Week Study Plan (Recommended)
This is the recommended plan for most people. It provides thorough coverage without burnout.
Week 1: Foundation & Core Concepts
| Day | Focus | Duration | Activities |
|---|---|---|---|
| Day 1 | Introduction & Exam Overview | 1.5 hrs | Read Ch 1 intro, exam format, domains, study plan (this page) |
| Day 2 | Security Concepts Overview | 2 hrs | CIA Triad, defense in depth, least privilege, zero trust |
| Day 3 | Cloud Native Security (4Cs) | 2 hrs | 4Cs framework, cloud provider security, attack surfaces |
| Day 4 | Cloud Native Security (continued) | 2 hrs | Security controls, isolation techniques, artifact security |
| Day 5 | Kubernetes Components Security (Part 1) | 2 hrs | API server authentication & authorization, RBAC basics |
| Day 6 | Kubernetes Components Security (Part 2) | 2 hrs | etcd security, kubelet, container runtime |
| Day 7 | Review & Practice | 1.5 hrs | Review notes, practice questions from Ch 1 and Ch 2 |
Week 2: Threats, Platform Security & Compliance
| Day | Focus | Duration | Activities |
|---|---|---|---|
| Day 8 | Kubernetes Cluster Components (continued) | 2 hrs | Admission controllers, Pod Security Standards, Secrets |
| Day 9 | Kubernetes Threat Model (Part 1) | 2 hrs | STRIDE, threat actors, attack vectors |
| Day 10 | Kubernetes Threat Model (Part 2) | 2 hrs | Trust boundaries, persistence, Kubernetes-specific threats |
| Day 11 | Platform Security (Part 1) | 2 hrs | Supply chain security, image scanning, SBOM |
| Day 12 | Platform Security (Part 2) | 2 hrs | Image signing, CI/CD security, IaC security |
| Day 13 | Compliance & Frameworks (Part 1) | 2 hrs | CIS benchmarks, PSS/PSA, audit logging |
| Day 14 | Review & Practice | 1.5 hrs | Review notes, practice questions from Ch 3, 4, and 5 |
Week 3: Tooling, Review & Exam Prep
| Day | Focus | Duration | Activities |
|---|---|---|---|
| Day 15 | Compliance & Frameworks (Part 2) | 2 hrs | NIST framework, SOC 2/ISO 27001 awareness |
| Day 16 | Cloud Native Security Tooling (Part 1) | 2 hrs | Admission controllers, OPA/Gatekeeper |
| Day 17 | Cloud Native Security Tooling (Part 2) | 2 hrs | Falco, Trivy, network policies |
| Day 18 | Cloud Native Security Tooling (Part 3) | 2 hrs | Service mesh, secrets tools, vulnerability management |
| Day 19 | Full Review | 2.5 hrs | Review all chapters, focus on weak areas |
| Day 20 | Killer.sh Simulator Session 1 | 2 hrs | Take the full practice exam, review answers |
| Day 21 | Killer.sh Simulator Session 2 + Exam | 2 hrs | Retake simulator, address weak spots, take the exam |
Total study time: ~40 hours over 3 weeks
2-Week Accelerated Plan
For people with existing Kubernetes and security knowledge who want a faster pace.
Week 1: All Domains
| Day | Focus | Duration | Activities |
|---|---|---|---|
| Day 1 | Intro + Security Concepts | 2.5 hrs | Exam overview, CIA Triad, zero trust, defense in depth |
| Day 2 | Cloud Native Security | 2.5 hrs | 4Cs, attack surfaces, controls |
| Day 3 | Cluster Component Security (Part 1) | 2.5 hrs | API server, RBAC, Authentication |
| Day 4 | Cluster Component Security (Part 2) | 2.5 hrs | etcd, kubelet, PSS/PSA, Secrets |
| Day 5 | Threat Model | 2.5 hrs | STRIDE, attack vectors, trust boundaries |
| Day 6 | Platform Security | 2.5 hrs | Supply chain, image security, SBOM |
| Day 7 | Compliance & Frameworks | 2.5 hrs | CIS benchmarks, PSS, audit logging, NIST |
Week 2: Tooling, Review & Exam
| Day | Focus | Duration | Activities |
|---|---|---|---|
| Day 8 | Cloud Native Tooling (Part 1) | 2.5 hrs | Admission controllers, OPA, Falco |
| Day 9 | Cloud Native Tooling (Part 2) | 2.5 hrs | Trivy, network policies, service mesh |
| Day 10 | Full Review — Domains 1-3 | 2 hrs | Review notes, practice questions |
| Day 11 | Full Review — Domains 4-6 | 2 hrs | Review notes, practice questions |
| Day 12 | Killer.sh Session 1 | 2 hrs | Full practice exam + review |
| Day 13 | Weak Area Review | 2 hrs | Focus on domains where you scored lowest |
| Day 14 | Killer.sh Session 2 + Exam Day | 2 hrs | Final practice + take the exam |
Total study time: ~33 hours over 2 weeks
1-Week Crash Course
For experienced Kubernetes practitioners who just need a focused review. Only recommended if you already work with K8s security regularly.
| Day | Focus | Duration | Activities |
|---|---|---|---|
| Day 1 | Exam Overview + Security Concepts | 3 hrs | All intro material, CIA, zero trust, defense in depth |
| Day 2 | Cloud Native Security + Components | 3.5 hrs | 4Cs, API server, RBAC, etcd, kubelet, PSS |
| Day 3 | Threat Model + Platform Security | 3.5 hrs | STRIDE, supply chain, image security, SBOM |
| Day 4 | Compliance + Tooling | 3.5 hrs | CIS, NIST, Falco, Trivy, OPA, network policies |
| Day 5 | Killer.sh Session 1 + Review | 3 hrs | Full practice exam, identify weak areas |
| Day 6 | Weak Area Deep Dive | 3 hrs | Focus study on lowest-scoring domains |
| Day 7 | Killer.sh Session 2 + Exam | 2.5 hrs | Final practice + take the exam |
Total study time: ~22 hours over 1 week
Study Tips for KCSA
1. Focus on Understanding, Not Memorization
KCSA questions test whether you understand why something is done, not just what is done. For example:
- Weak prep: “CIS Benchmarks are security guidelines” (memorized fact)
- Strong prep: “CIS Benchmarks provide automated checks for Kubernetes hardening because manual review doesn’t scale — tools like kube-bench automate this” (understanding)
2. Use Comparison Tables
Many KCSA questions ask you to distinguish between similar concepts. Build comparison tables in your notes:
- Authentication vs Authorization
- PSS levels: Privileged vs Baseline vs Restricted
- Preventive vs Detective vs Corrective controls
- RBAC Role vs ClusterRole
- Validating vs Mutating admission controllers
3. Know the Tools by Function
You won’t write Falco rules or OPA policies on the exam, but you MUST know:
| Tool | Primary Function |
|---|---|
| Falco | Runtime threat detection |
| Trivy | Vulnerability scanning |
| OPA/Gatekeeper | Policy enforcement |
| kube-bench | CIS benchmark compliance |
| cosign | Image signing & verification |
| Notary | Image signing (Docker Content Trust) |
| Vault | Secrets management |
4. Practice Elimination
For MCQ exams, elimination is your best friend. Practice identifying why options are wrong, not just why the right answer is right.
5. Take Notes in Your Own Words
Don’t just read — rewrite key concepts in your own words. Teaching yourself is the fastest way to learn.
Learning Resources
Official CNCF Resources
- KCSA Exam Page — Registration, curriculum, FAQs
- KCSA Exam Curriculum (GitHub) — Detailed topic list for each domain
- CNCF Cloud Native Security Whitepaper — Comprehensive security guide
- Kubernetes Documentation — Security — Official K8s security docs
Community Resources
- Kubernetes Security Best Practices — Official overview
- CNCF TAG Security — Community-driven security resources
- Falco Documentation — Runtime security tool
- Open Policy Agent Documentation — Policy engine
Video Content
- CNCF YouTube — KubeCon security talks
- Linux Foundation Training — KCSA official course
- KodeKloud — Structured video courses
Your Next Step
Pick the study plan that matches your timeline and background:
| Your Situation | Recommended Plan |
|---|---|
| New to K8s security, have 3+ weeks | 3-Week Study Plan |
| Some K8s experience, 2 weeks available | 2-Week Accelerated Plan |
| Experienced with K8s security, 1 week | 1-Week Crash Course |
Regardless of which plan you choose, make sure to use both Killer.sh simulator sessions before taking the real exam.
What’s Next?
Now let’s cover specific strategies for tackling multiple-choice questions on exam day — how to eliminate wrong answers, manage your time, and maximize your score.
