KCSA — What is KCSA?
What is KCSA?
The Kubernetes and Cloud Native Security Associate (KCSA) is a certification offered by the Cloud Native Computing Foundation (CNCF) — the same organization behind Kubernetes, Prometheus, and other major cloud-native projects.
KCSA is designed to validate your foundational knowledge of security concepts as they apply to Kubernetes and the cloud-native ecosystem. It’s the entry-level security certification in the CNCF family — think of it as the “security awareness” exam.
The Key Difference: Theory, Not Hands-On
This is one of the most important things to understand about KCSA:
KCSA is a multiple-choice exam. You will NOT have a terminal. You will NOT run kubectl commands. You will NOT configure live clusters.
This is fundamentally different from CKA (Certified Kubernetes Administrator) and CKS (Certified Kubernetes Security Specialist), which are both performance-based exams where you solve problems on real Kubernetes clusters.
| Aspect | KCSA | CKA / CKS |
|---|---|---|
| Format | Multiple-choice questions | Performance-based (live terminal) |
| Environment | PSI Secure Browser, no terminal | Browser-based terminal with real clusters |
| Interaction | Select answers from options | Run commands, edit YAML, solve problems |
| Reference Docs | Not allowed during exam | kubernetes.io docs allowed |
| Skill Tested | Conceptual understanding | Practical execution |
KCSA tests whether you know the right answer. CKA and CKS test whether you can do the right thing. Both matter — but they’re very different skills.
Who Should Take KCSA?
KCSA is designed for a broad audience. You don’t need to be a security specialist — in fact, the exam is aimed at people who are building their security knowledge, not those who already have deep expertise.
Target Audience
| Role | Why KCSA Matters |
|---|---|
| DevOps Engineers | Understand security implications of the infrastructure you manage |
| Site Reliability Engineers (SREs) | Learn how security fits into reliability and incident response |
| Platform Engineers | Build secure foundations for the teams that deploy on your platform |
| Cloud Engineers | Connect cloud-level security with Kubernetes-level controls |
| Security-Curious Developers | Start your security journey without needing deep ops experience |
| IT Professionals | Validate your cloud-native security awareness for career growth |
| Students & Career Changers | Entry-level certification that doesn’t require years of experience |
You’re a Good Fit If…
- You’ve worked with Kubernetes (even briefly) and want to learn the security side
- You’re planning to take CKS eventually but want a stepping stone
- You want a certification that proves security awareness without needing hands-on mastery
- You’re exploring cloud-native security as a career direction
- You’re a developer who wants to understand “shift-left” security
You Might Want to Skip KCSA If…
- You already hold CKS — KCSA covers a subset of what you already know
- You’re looking for a hands-on certification — KCSA is theory-based
- You have zero Kubernetes knowledge — learn basics first, then KCSA
The CNCF Certification Landscape
KCSA fits into a family of five CNCF Kubernetes certifications. Understanding where each one sits helps you plan your learning path.
Certification Overview Table
| Certification | Full Name | Level | Focus | Format |
|---|---|---|---|---|
| KCNA | Kubernetes and Cloud Native Associate | Entry | General K8s & cloud-native concepts | Multiple-choice |
| KCSA | Kubernetes and Cloud Native Security Associate | Entry | Security concepts & awareness | Multiple-choice |
| CKA | Certified Kubernetes Administrator | Intermediate | Cluster administration | Performance-based |
| CKAD | Certified Kubernetes Application Developer | Intermediate | Application development on K8s | Performance-based |
| CKS | Certified Kubernetes Security Specialist | Advanced | Hands-on cluster security | Performance-based |
How They Relate
Think of these certifications in layers:
┌─────────────────────────────────┐
│ CKS (Advanced) │ ← Hands-on security specialist
├─────────────────────────────────┤
│ CKA │ CKAD │ ← Hands-on admin / developer
├─────────────────────────────────┤
│ KCNA │ KCSA │ ← Theory-based associate level
└─────────────────────────────────┘
- KCNA and KCSA are both entry-level, theory-based exams. KCNA covers general Kubernetes concepts; KCSA focuses on security.
- CKA and CKAD are intermediate, hands-on exams. CKA is for admins; CKAD is for developers.
- CKS is the most advanced and requires a valid CKA. It’s the only certification that requires a prerequisite.
Recommended Learning Paths
There’s no single “right” path — it depends on your background and goals. Here are the most common routes:
Path 1: KCSA → CKA → CKS (Security-Focused)
This is the recommended path if you’re building toward a career in Kubernetes security:
KCSA (security theory) → CKA (cluster admin skills) → CKS (hands-on security)
Why this works: KCSA gives you the security vocabulary and conceptual framework. CKA gives you the hands-on admin skills CKS requires. CKS ties it all together.
Path 2: KCNA → KCSA (Associate Path)
If you’re new to Kubernetes entirely:
KCNA (general K8s concepts) → KCSA (security concepts)
Why this works: KCNA ensures you understand Kubernetes fundamentals before layering on security knowledge.
Path 3: Standalone KCSA
If you simply want to validate your security awareness:
KCSA (done!)
Why this works: Not everyone needs to climb the full certification ladder. KCSA is valuable on its own for roles where security awareness — not deep expertise — is what matters.
Path 4: CKA → CKS (Skip KCSA)
If you already have strong Kubernetes experience:
CKA (admin skills) → CKS (hands-on security)
Why this works: If you’re already comfortable with Kubernetes and want to go straight to hands-on security, you can skip KCSA and go directly to CKA → CKS.
Why KCSA Matters for Your Career
You might wonder: “Is an entry-level, multiple-choice exam really worth it?”
The answer is yes, and here’s why:
1. Security Is the #1 Concern in Cloud Native
Every year, the CNCF survey shows security as the top concern for organizations adopting cloud-native technologies. Companies need people who understand security — at every level.
2. It Demonstrates Structured Knowledge
Studying for KCSA forces you to learn security concepts in a structured way. Even if you work with security tools daily, the exam ensures you understand the why, not just the how.
3. Career Differentiation
In a crowded job market, a security certification sets you apart:
| Scenario | Without KCSA | With KCSA |
|---|---|---|
| Applying for DevOps role | “I know some security” | “I’m KCSA certified” |
| Internal promotion | General K8s skills | Proven security awareness |
| Transitioning to security | No formal validation | CNCF-recognized credential |
| Building toward CKS | No foundation | Documented learning path |
4. It’s Achievable
Unlike CKS (which requires CKA and deep hands-on skill), KCSA is accessible. With 2-3 weeks of focused study, most people with basic Kubernetes knowledge can pass.
5. Entry Point to the Security Field
If you’re curious about security but intimidated by the depth of CKS, KCSA is the perfect on-ramp. It gives you the vocabulary, the framework, and the confidence to keep learning.
What Topics Does KCSA Cover?
The KCSA exam spans six domains. We’ll explore each one in detail in the Exam Overview, but here’s a preview:
| Domain | Weight | What It Covers |
|---|---|---|
| Overview of Cloud Native Security | 14% | 4Cs, cloud provider security, attack surfaces |
| Kubernetes Cluster Component Security | 22% | API server, etcd, kubelet, control plane hardening |
| Kubernetes Threat Model | 16% | STRIDE, trust boundaries, threat actors |
| Platform Security | 16% | Supply chain, image scanning, artifact signing |
| Compliance and Security Frameworks | 16% | CIS benchmarks, NIST, PSS, audit logging |
| Cloud Native Security Tooling | 16% | Falco, Trivy, OPA, admission controllers |
Notice that this is a breadth exam — it covers a wide range of topics at a conceptual level. You need to understand many things broadly rather than a few things deeply.
Quick Knowledge Check
Before moving on, see if you can answer these questions. Don’t worry if you can’t — that’s exactly what this tutorial is for!
- What does KCSA stand for?
- Is KCSA a hands-on or multiple-choice exam?
- Which CNCF certification requires CKA as a prerequisite?
- Name three target audiences for KCSA.
- What are the six exam domains?
If you got stuck on any of these, you’re in the right place. Let’s keep going!
What’s Next?
Now that you understand what KCSA is and where it fits, let’s look at the exam itself in detail — duration, question count, domains, weights, and how this tutorial maps to each domain.
