KCSA
Kubernetes and Cloud Native Security Associate (KCSA)
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The Kubernetes and Cloud Native Security Associate (KCSA) is a pre-professional, vendor-neutral certification from CNCF and the Linux Foundation for people starting a cloud native security career. The source describes it as designed for candidates who want to advance to the professional level by demonstrating foundational knowledge and skills in cloud native security technologies, and notes there are no prerequisites and the experience level is beginner. It suits platform, DevOps, and security practitioners who need to evaluate a cluster's security configuration against requirements, harden controls, test and monitor security, and help identify and assess risks and vulnerabilities. The exam is online, proctored, and multiple-choice, lasts 90 minutes, and costs $250 including one free retake. Its six weighted domains are Overview of Cloud Native Security (14%), Kubernetes Cluster Component Security (22%), Kubernetes Security Fundamentals (22%), Kubernetes Threat Model (16%), Platform Security (16%), and Compliance and Security Frameworks (10%). Preparation should follow the published curriculum, which CNCF has open sourced, plus the Candidate Handbook and Exam Preparation Handbook. A sensible plan is to study the 4Cs and component-level hardening first, then fundamentals such as authentication, authorization, and network policy, then threat modelling and supply chain topics. This page is independent study material and is not affiliated with or endorsed by CNCF or the Linux Foundation.
What you'll study
About KCSA preparation
What is the exam format and how long do I have?
It is an online, proctored, multiple-choice exam with a 90-minute duration. You take it remotely under proctoring rather than at a test centre, and the experience level is listed as beginner. Because 90 minutes is tight for a multiple-choice set, practise answering domain-weighted questions quickly so you are not rushed on the harder threat-model and compliance items.
How much does KCSA cost and what does the fee include?
The exam costs $250 and includes one free retake. The Linux Foundation page also lists a bundle with the THRIVE-ONE Annual Subscription at $495, and states that certification is valid for 2 years with 12 months of exam eligibility. If your employer is paying, request a corporate quote for bulk purchases through CNCF training partners.
Are there any prerequisites or required years of experience?
No. The source states there are no prerequisites for this exam and lists the experience level as beginner. It is positioned as a pre-professional credential and a first step toward professional-level certifications, so you do not need prior certification or production security experience, though familiarity with Kubernetes objects and basic Linux concepts makes the material far easier to absorb.
How hard is KCSA, and how should I order my study?
It is an associate-level, multiple-choice exam, so difficulty comes from breadth rather than hands-on troubleshooting. Follow the domain weights: start with the 4Cs, isolation, and artifact repository security, then work through API server, kubelet, etcd, and container runtime hardening, then authentication, authorization, secrets, and network policy. Finish with the threat model, supply chain, observability, PKI, and compliance frameworks.
What are the most common failure modes?
Candidates typically lose points by memorising commands instead of concepts, skipping the lower-weight domains such as compliance frameworks and threat modelling, and confusing authentication with authorization or pod security standards with admission control. Others underestimate cluster component coverage, which carries 22%, and never review the open-sourced curriculum. Study every listed competency, including client security, storage, and service mesh connectivity.
Which domains carry the most weight?
Kubernetes Cluster Component Security and Kubernetes Security Fundamentals are tied at 22% each, so together they are 44% of the exam. Kubernetes Threat Model and Platform Security follow at 16% each, Overview of Cloud Native Security is 14%, and Compliance and Security Frameworks is 10%. Budget your revision time in roughly those proportions rather than studying topics in the order they appear.
What official preparation resources exist?
The source points to the open-sourced curriculum around which the exam was created, the Candidate Handbook, the Linux Foundation Global Certification & Confidentiality Agreement, an Exam Preparation Handbook, and a curriculum overview. Free introductory Kubernetes and cloud native essentials courses are also listed. Combine those with hands-on inspection of a test cluster and independent practice questions covering each domain.
How long is the certification valid, and what happens if I fail?
Certification is valid for 2 years and KCSA is part of the CARE program, which the source says simplifies certification maintenance. Your purchase includes two exam attempts, so a first failure does not mean paying again. You have 12 months to schedule and take the exam, which gives room to study further before using your second attempt.