Certification guide
KCSAKubernetes and Cloud Native Security Associate: the honest guide
KCSA is the security counterpart to KCNA: 90 minutes, multiple choice, no prerequisites, and a curriculum built around the Kubernetes threat model rather than around configuring controls. Registration includes one retake.
It sits below CKS deliberately. CKS asks you to implement hardening on a live cluster and requires CKA first; KCSA asks whether you understand what the components expose, how an attacker moves through a cluster, and which control answers which threat.
Who KCSA is for
A good fit if
- You work in security and need Kubernetes to stop being a black box on your own architecture diagrams.
- You are heading for CKS and want the threat model straight before adding the operational layer.
- You review, audit or govern platforms somebody else runs, and need the vocabulary to ask the right questions.
- You are a developer or platform engineer who wants the security concepts without a hands-on sitting.
Probably not, if
- You need to prove you can harden a cluster. That is CKS, and it is a different kind of exam with a CKA prerequisite in front of it.
- You have never met Kubernetes at all. The curriculum assumes the components and what they do; KCNA is the exam that teaches those.
- You want a long-lived credential. It is valid for two years and it is designed as a step toward CKS rather than an endpoint.
Is KCSA worth it?
For a security professional whose organization runs Kubernetes, this is unusually good value. The threat model domain alone is worth the money if your current mental model of a cluster stops at the API server, and it makes design review conversations with a platform team specific rather than general.
As a standalone hiring signal it is modest. It says you understand cluster security concepts, not that you have implemented them, and an employer hiring for Kubernetes security work will ask for CKS. Treated as the first half of a plan that ends at CKS, it earns its place.
It is a poor purchase for somebody who already holds CKA and intends to sit CKS soon. The overlap is real, the CKS curriculum covers this ground with the implementation attached, and $250 spent here is $250 not spent on the exam that carries weight.
What the exam actually asks you to do
Multiple choice and multiple response only. No simulations, no labs, and nothing to configure.
Item formats
- Multiple choice
- Multiple response
Nothing here needs a lab. Reading carefully and eliminating options is the whole skill. Linux Foundation, KCSA exam details ↗
Domain breakdown and official weightings
From the official published CNCF curriculum. Kubernetes Cluster Component Security is the heaviest domain at 22 percent, followed by Kubernetes Security Fundamentals at 22 percent.
- Overview of Cloud Native Security14%
- Kubernetes Cluster Component Security22%
- Kubernetes Security Fundamentals22%
- Kubernetes Threat Model16%
- Platform Security16%
- Compliance and Security Frameworks10%
Study plans by experience level
Security background, new to Kubernetes
8 to 10 weeksat 5 hours
- 1Weeks 1 to 2: the cluster components and what each one exposes. API server, etcd, kubelet, controller manager and scheduler, on a local cluster you built yourself.
- 2Weeks 3 to 5: cluster component security and security fundamentals, 22 percent each and the heaviest pair on the exam.
- 3Weeks 6 to 7: the Kubernetes threat model at 16 percent. Persistence, privilege escalation, lateral movement, and what each looks like in a cluster rather than on a host.
- 4Weeks 8 to 10: platform security and compliance frameworks, then timed practice against the full curriculum.
Kubernetes user, new to security
5 to 6 weeksat 5 hours
- 1Week 1: read the curriculum and mark every threat you could not describe an attack path for. That list is the plan.
- 2Weeks 2 to 3: security fundamentals and cluster component security, which are 44 percent of the exam between them.
- 3Week 4: the threat model and platform security, 16 percent each, working from real advisories rather than abstractions.
- 4Weeks 5 to 6: compliance and frameworks at 10 percent, then timed practice, because 60 questions in 90 minutes rewards pace.
Heading for CKS
3 to 4 weeksat 6 hours
- 1Week 1: the threat model domain, which is the part of KCSA that CKS assumes rather than teaches.
- 2Week 2: cluster component security, mapped onto the CKA operational knowledge you already have.
- 3Week 3: compliance frameworks and platform security, the two areas a hands-on engineer is most likely to have skipped.
- 4Week 4: timed practice, then book CKS while the material is current rather than treating KCSA as a resting point.
Common mistakes
- Preparing for it like CKS
- Candidates build hardened clusters for a month and then meet 60 multiple choice questions about threat models and frameworks. Practical work makes the concepts concrete and it is not what the exam measures, so curriculum coverage has to come first.
- Ignoring the compliance domain
- Compliance and Security Frameworks is only 10 percent, and it is the domain engineers skip entirely because it feels like paperwork. Ten percent of 60 questions is enough to matter at a 75 percent pass mark.
- Learning controls without threats
- The curriculum is organized around what an attacker does and which control interrupts it. Somebody who memorizes the controls in isolation can still fail a question that describes an attack path and asks which mitigation applies, because the exam tests the mapping rather than the list.
- Assuming it leads directly to CKS
- KCSA is not a prerequisite for CKS and does not shorten its requirements. CKS gates on an active CKA, so a security specialist who takes KCSA and then tries to book CKS still has an operational exam in front of them.
- Treating the two-year validity as three
- Every Linux Foundation certification here runs a two-year cycle with no credit route. Somebody planning a certification calendar around CompTIA's three-year renewals will be a year out on this one.
What comes after passing
CKS is the destination this exam points at, and the route runs through CKA because CKS requires it. Plan the pair rather than the single exam.
KCSA is valid for two years, and renewal means sitting the current exam again, since the Linux Foundation offers no continuing education route.
The threat model is the durable part. Being able to describe how an attacker moves from a compromised pod to cluster-wide access outlives any certificate, and it is the thing that changes how you review a platform design.
If your work is governance rather than engineering, this may be the right place to stop. CKS asks for terminal fluency that an auditor or architect may never need, and there is no shame in holding the credential that matches the job.
Where people go next
Costs across the full renewal cycle are on the KCSA cost page.
Frequently asked questions
Is KCSA a prerequisite for CKS?
No. CKS requires that you have taken and passed CKA, not KCSA. KCSA is a useful conceptual step toward CKS and it does not replace any part of its requirements, so a security specialist heading for CKS still has the operational exam ahead of them.
Is the KCSA retake free?
One retake is included with registration, so a first failure costs the waiting period and the preparation rather than another $250. A third sitting is a new registration at full price.
How does KCSA differ from CKS?
KCSA is 90 minutes of multiple choice about the threat model, the cluster components and the frameworks around them, with no prerequisites. CKS is two hours of hands-on tasks on live clusters, requires CKA first, and asks you to implement the controls rather than identify them.
Is $250 worth it for a multiple choice exam?
It depends entirely on your starting point. For a security professional whose organization runs Kubernetes and whose mental model of a cluster is currently thin, the curriculum is worth the fee on its own. For somebody already holding CKA and heading to CKS within a few months, the overlap makes it hard to justify.
How long is KCSA valid?
Two years, renewed by passing the current version of the exam. There is no continuing education or credit scheme, and most candidates move on to CKS inside that window rather than renewing an associate credential.
Keep reading
- KCSA practice questions
Free sample questions with the full explanation on every answer.
- Free KCSA practice test
10 original questions, playable now. No account, no card.
- KCSA exam format
How many questions, how long, what the items look like, and how long it stays valid.
- KCSA passing score
The exact cut score, what kind of number it is, and the retake terms.
- How hard is KCSA?
An honest difficulty read from the format, the clock and the weights.
- What KCSA costs
The voucher price, the retake, and what renewal costs across the cycle.
Practice KCSA for free while you decide
Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.
Start free KCSA questions