KCSA study guide
KCSA · Work through your exam, one topic at a time.
The Kubernetes and Cloud Native Security Associate (KCSA) is a pre-professional, vendor-neutral certification from CNCF and the Linux Foundation for people starting a cloud native security career. The source describes it as designed for candidates who want to advance to the professional level by demonstrating foundational knowledge and skills in cloud native security technologies, and notes there are no prerequisites and the experience level is beginner. The KCSA study guide has 6 sections and about 2,219 words.
01Overview of Cloud Native Security
The Overview of Cloud Native Security domain tests whether you can place a control at the right layer instead of reflexively reaching for a Pod spec. Expect questions on the 4Cs model, shared responsibility, and defence in depth.
379 words, about 2 min02Kubernetes Cluster Component Security
The Kubernetes Cluster Component Security domain is the largest on the exam and tests whether you know the default posture and the hardening flags of everything that makes a cluster run. kube-apiserver - serve TLS only (the insecure HTTP port is gone in current releases), set --anonymous-auth=false and --authorization-mode=Node,RBAC , enable admission plugins deliberately, turn on audit logging, and configure --kubelet-client-certificate / --kubelet-certificate-authority so API-to-kubelet traffic is mutually authenticated.
351 words, about 2 min03Kubernetes Security Fundamentals
The Kubernetes Security Fundamentals domain tests the request pipeline - who you are, what you may do, and what the cluster refuses to run - plus the workload fields that decide blast radius. Kubernetes has no User objects: identities come from X.509 client certificates ( CN = user, O = group), OIDC, webhook token authentication, and ServiceAccount tokens.
365 words, about 2 min04Kubernetes Threat Model
The Threat Model domain tests whether you can reason like an attacker about a Kubernetes environment: what a foothold converts into, and which control breaks the chain. STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) structures enumeration; MITRE ATT&CK for Containers maps techniques; kill-chain and attack-tree reasoning connects initial access to an objective.
383 words, about 2 min05Platform Security
Platform Security covers the controls built around workloads: the supply chain that produces images, the runtime that executes them, and the platform services that isolate tenants. Scan images in CI and continuously in the registry; prefer minimal or distroless bases to shrink CVE surface.
375 words, about 2 min06Compliance and Security Frameworks
Compliance and Security Frameworks tests whether you can map Kubernetes controls to recognised standards and produce evidence, not just configure things. CIS Kubernetes Benchmark - prescriptive controls for control plane, nodes and policies; kube-bench runs the checks and reports pass/fail per control ID and level.
366 words, about 2 min