Many people who end up securing Kubernetes clusters arrive without any structured grounding in how the control plane, workloads and supply chain fit together, and the hands-on CKS is a hard first step because it requires the CKA first. The Kubernetes and Cloud Native Security Associate (KCSA) is the Cloud Native Computing Foundation (CNCF) and Linux Foundation answer to that gap: a beginner-level, multiple-choice exam on cloud native and Kubernetes security concepts. This guide sets out what the Linux Foundation and CNCF publish about the KCSA: format, the six curriculum domains and their weights, price, validity and renewal, and how it relates to the CKS and the Kubestronaut programme. It adds a study plan built on the curriculum and advice on when the KCSA is worth your time. Facts were checked on the Linux Foundation exam page, the Linux Foundation multiple-choice exam documentation and the CNCF curriculum repository on 8 November 2026. Prices and policies change, so confirm on the linked pages before you book.
This is an independent guide from NHI Mgmt Group, based on the Linux Foundation's public KCSA documentation as of November 2026. It is not sponsored or reviewed by the Linux Foundation or the CNCF. Exam details change, so confirm requirements against the Linux Foundation's current documentation.
Key takeaways
- It is a knowledge exam, not a lab. The KCSA is an online, proctored, multiple-choice exam of 90 minutes, and the Linux Foundation describes it as a beginner-level, pre-professional certification.
- Anyone can sit it. The Linux Foundation states there are no prerequisites, unlike the CKS, which requires a CKA pass first.
- Cluster components and fundamentals carry the weight. Kubernetes Cluster Component Security and Kubernetes Security Fundamentals are 22% each, so 44% of the exam is about the control plane, nodes, Pod Security, authentication, Secrets, audit logging and network policy.
- It costs USD 250 and lasts two years. The list price includes one retake (two attempts), and the certification is valid for two years.
- A CKS pass renews it. Under the Linux Foundation CARE programme, passing the CKS automatically renews the KCSA, which makes the KCSA a natural first rung on the CNCF security ladder.
Who the certification is for
The Linux Foundation pitches the KCSA at people starting a cloud security career and states that years of experience are not required. In practice it suits several groups who need a common vocabulary for Kubernetes security without proving command line speed.
- Good fit: security analysts, GRC and audit staff who review Kubernetes findings and need to understand what an API server flag, a Pod Security level or a NetworkPolicy actually does; developers moving into platform teams; graduates and career changers aiming for cloud or platform security roles.
- Useful for teams: a security team that adopts the KCSA as a baseline gets shared language with the platform team before anyone attempts the CKS. The curriculum lines up closely with the topics a cluster review covers. See the Kubernetes Security Guide.
- Weaker fit: engineers who already administer clusters daily and want to prove hands-on security skill. They are better served by going straight to the CKA and CKS. See the Certified Kubernetes Security Specialist (CKS) Guide.
Exam format and domains
Format
| Item | What the Linux Foundation publishes | Source |
|---|---|---|
| Type | Online, proctored, multiple-choice | LF KCSA page |
| Duration | 90 minutes | LF KCSA page; LF multiple-choice FAQ |
| Number of questions | 60 for standard Linux Foundation multiple-choice exams (the instructions page does not name the KCSA separately) | LF multiple-choice important instructions |
| Passing score | 75% or above for Linux Foundation multiple-choice exams | LF multiple-choice FAQ |
| Level | Beginner; described as a pre-professional certification | LF KCSA page |
| Delivery | Remote proctoring on the PSI Bridge platform in the PSI Secure Browser, with audio, video and screen sharing | LF multiple-choice FAQ |
| Environment rules | Single monitor, no other applications or browser windows, no virtual machines, private and well-lit room, original government-issued photo ID matching the registration name | LF multiple-choice important instructions |
| Results | Scored automatically and emailed within 24 hours, barring exceptions | LF multiple-choice FAQ |
| Attempts | Two exam attempts (one retake) included | LF KCSA page |
| Scheduling window | 12 months from purchase to schedule and take the exam | LF KCSA page |
The question count and pass mark come from the Linux Foundation's general multiple-choice exam documentation, which applies to the KCSA as one of those exams. Check the candidate documentation for your exam when you book in case the KCSA gains its own entry.
Domains and weights
The CNCF publishes the curriculum as a PDF in the cncf/curriculum repository on GitHub. The six domains and their weights on the Linux Foundation page match it.
| Domain | Weight | Topics in the curriculum | Related NHI Mgmt Group guide |
|---|---|---|---|
| Overview of Cloud Native Security | 14% | The 4Cs of cloud native security; cloud provider and infrastructure security; controls and frameworks; isolation techniques; artifact repository and image security; workload and application code security | Kubernetes Security Guide |
| Kubernetes Cluster Component Security | 22% | API server, controller manager, scheduler, kubelet, container runtime, kube-proxy, Pod, etcd, container networking, client security, storage | Kubernetes Security Checklist |
| Kubernetes Security Fundamentals | 22% | Pod Security Standards, Pod Security Admission, authentication, Secrets, isolation and segmentation, audit logging, network policy | Kubernetes Secrets Security Guide |
| Kubernetes Threat Model | 16% | Trust boundaries and data flow, persistence, denial of service, malicious code execution and compromised applications in containers, attacker on the network, access to sensitive data, privilege escalation | Top 10 Kubernetes Security Risks |
| Platform Security | 16% | Supply chain security, image repository, observability, service mesh, PKI, connectivity, admission control | Kubernetes Admission Control Guide |
| Compliance and Security Frameworks | 10% | Compliance frameworks, threat modelling frameworks, supply chain compliance, automation and tooling | Container and Kubernetes Security Policy Template |
The curriculum names topics, not depth, and it does not list specific tools or Kubernetes versions. Expect questions that test whether you understand what a control does and which threat it addresses, for example why audit logging matters for detecting persistence, or which Pod Security Standard level blocks privileged containers.
Prerequisites and experience
The Linux Foundation states there are no prerequisites. Candidates under 18 can sit Linux Foundation exams from age 16 subject to the conditions in the multiple-choice FAQ. Even without a formal requirement, the exam assumes you can read Kubernetes YAML and know what the main objects are. Our recommended baseline before booking (an NHI Mgmt Group view, not a Linux Foundation rule):
- Kubernetes objects: you can explain Pods, Deployments, Services, Namespaces, ServiceAccounts, Roles and RoleBindings, and Secrets, and you have applied manifests to a local cluster.
- Container basics: images, registries, tags versus digests, and why a container running as root matters.
- Security basics: least privilege, TLS and certificates, authentication versus authorisation, and the idea of a threat model.
- Where to get it: the CNCF Kubernetes and Cloud Native Associate (KCNA) covers general Kubernetes and cloud native knowledge and is a reasonable precursor for people with no Kubernetes background, but it is not required.
Preparation plan
A six-week plan for someone with basic Kubernetes familiarity who studies five to eight hours a week. This is our suggested approach; adjust it to your starting point.
- Week 1, map the curriculum. Download the KCSA curriculum PDF from the cncf/curriculum repository and turn each bullet into a question you must be able to answer. Build a local cluster (kind, minikube or kubeadm) so you can look at real component flags and objects.
- Week 2, cluster components. For each component in the 22% domain, learn what it does, how it authenticates to the others, and the common hardening settings: anonymous access and authorisation mode on the API server, kubelet authentication and authorisation, etcd encryption and client certificates. See the Kubernetes Security Checklist.
- Week 3, security fundamentals. Apply Pod Security Admission labels at the privileged, baseline and restricted levels and see what each rejects. Write a default-deny NetworkPolicy. Read an audit policy and understand its levels. Learn how Secrets are stored and why encryption at rest and RBAC on Secrets matter. See the Kubernetes RBAC Guide.
- Week 4, threat model. Walk each threat in the curriculum (persistence, denial of service, privilege escalation, attacker on the network, access to sensitive data) and name the controls that prevent or detect it. The Kubernetes documentation on security concepts and the Kubernetes Audit Log Detection Guide help here.
- Week 5, platform and compliance. Cover supply chain topics (image signing, SBOMs, trusted registries), admission control, service mesh mutual TLS, PKI and observability. Read the CIS Kubernetes Benchmark structure and the NIST and CNCF guidance the compliance domain refers to at a high level.
- Week 6, review and book. Revisit every curriculum bullet you cannot answer confidently. Use practice questions only to find weak areas: they are not the authoritative scope. Book within the 12-month window, and plan the retake for one to two weeks later if needed.
The Linux Foundation sells a bundle of the exam with its THRIVE-ONE annual subscription, which includes its course catalogue. Third-party courses exist too. Whatever you choose, the curriculum PDF and the Kubernetes documentation define the scope.
Cost, renewal and continuing education
| Item | Published detail |
|---|---|
| Exam only | USD 250, including one retake |
| Exam with THRIVE-ONE annual subscription | USD 495 |
| Eligibility window | 12 months to schedule and take the exam |
| Validity | 2 years |
| Renewal | Retake and pass the exam before the certification expires; the renewed certification is valid for 2 years from the pass date |
| CARE programme | Passing the CKS automatically renews the KCSA |
| Continuing education | No CPE scheme or annual maintenance fee is described |
Prices are the list prices on the Linux Foundation page on 8 November 2026. The Linux Foundation runs frequent promotions, so check before buying. Because renewal means passing the current exam, the curriculum you renew against may have changed. Check the cncf/curriculum repository for an updated PDF a month before you renew.
Kubestronaut
The CNCF Kubestronaut title goes to people who hold all five CNCF Kubernetes certifications: CKA, CKAD, CKS, KCNA and KCSA. The CNCF states that none of the certifications may have expired for the title to be recognised. Listed benefits include a Credly badge, a private Slack channel and mailing list, and five 50% certification discount coupons a year. If you plan to collect all five, the KCSA is the cheapest of the five to keep current, and the CARE rule means a current CKS keeps it renewed.
Where it fits on the career path
| Credential | Focus | Relation to the KCSA |
|---|---|---|
| KCNA | Kubernetes and cloud native fundamentals, multiple choice | Optional general precursor; not required |
| KCSA | Cloud native and Kubernetes security concepts, multiple choice | The associate-level security exam in the CNCF line |
| CKA | Hands-on cluster administration | Suggested next step on the Linux Foundation page; required before the CKS |
| LFCS | Hands-on Linux system administration | Also suggested as a next step on the Linux Foundation page |
| CKS | Hands-on securing of clusters and workloads | The specialist security exam; a pass renews the KCSA |
The KCSA shows understanding, not ability: it tells an employer that you know the vocabulary and the reasons behind Kubernetes controls. On its own it suits entry-level cloud security, security analyst and GRC roles that touch Kubernetes. For platform security or DevSecOps engineering roles, treat it as a stepping stone to the CKA and CKS. See the Cloud Security Engineer Career Guide and the DevSecOps Engineer Career Guide.
Where identity fits
Much of the curriculum is about non-human identity: service accounts and their tokens, kubelet and component certificates, client credentials in kubeconfig files, RBAC bindings and Secrets. Candidates who learn to see each of these as an identity with an owner, a scope and a lifetime will find the threat model domain easier, and will bring a more useful habit to real reviews. See the Kubernetes NHI Security Guide and the Kubernetes Service Account Token Guide.
Common preparation mistakes
- Treating it as a CKS lite: drilling commands instead of understanding why each control exists. The exam asks about purpose and threat, not syntax.
- Studying removed features: older material that still teaches PodSecurityPolicy, which Kubernetes replaced with Pod Security Admission.
- Skipping the smaller domains: Compliance and Security Frameworks is only 10%, but at a 75% pass mark the margin is thin.
- Ignoring the room rules: a second monitor, a cluttered desk or an ID that does not match your registration name can stop the exam before it starts.
Practitioner checklist
- Download the current KCSA curriculum PDF from the cncf/curriculum repository and map every bullet to a study note.
- Build a local cluster and inspect real API server, kubelet and etcd settings rather than only reading about them.
- Apply Pod Security Admission at all three levels and a default-deny NetworkPolicy at least once.
- Link each threat in the Kubernetes Threat Model domain to a preventive and a detective control.
- Confirm price, the 75% pass mark and the 60-question format on the Linux Foundation pages on the day you buy.
- Check your room, ID and single-monitor setup against the Linux Foundation multiple-choice instructions before exam day.
- Record your expiry date and decide whether you will renew by retaking the KCSA or by passing the CKS.
- If you are aiming for Kubestronaut, plan the order of the five exams so none expires before the last is passed.
Standards and references
- Linux Foundation: Kubernetes and Cloud Native Security Associate (KCSA)
- CNCF: Certification curriculum repository (KCSA Curriculum)
- Linux Foundation: Frequently Asked Questions, Multiple Choice Exams
- Linux Foundation: Important Instructions, Multiple Choice Exams
- CNCF: Kubestronaut programme
- Kubernetes: Security concepts documentation
Related NHI Mgmt Group resources: Certified Kubernetes Security Specialist (CKS) Guide, Kubernetes Security Guide, Kubernetes NHI Security Guide, Cybersecurity Certifications Guide.