A comprehensive study guide for the Kubernetes and Cloud Native Security Associate (KCSA) certification exam, offered by the Cloud Native Computing Foundation (CNCF) and the Linux Foundation.
The KCSA certification demonstrates a candidate's foundational knowledge and skills in security technologies and practices within the Kubernetes and cloud native ecosystem. It covers a broad range of topics including cluster component security, threat modeling, platform security, and compliance frameworks.
| Detail | Info |
|---|---|
| Exam Format | Multiple Choice |
| Questions | 60 |
| Duration | 90 minutes |
| Passing Score | 75% |
| K8s Version | v1.30.x (2025/2026 cycle) |
| Certification | Valid for 2 years |
- Cloud engineers and DevOps practitioners looking to validate their Kubernetes security knowledge
- Security professionals expanding into cloud native environments
- Developers who build and deploy applications on Kubernetes and want to understand security best practices
- Anyone preparing for more advanced certifications such as the CKS (Certified Kubernetes Security Specialist)
This repository is structured to align directly with the six domains of the official KCSA exam curriculum. Each domain has its own directory containing detailed notes on every topic, along with practical labs and mock exam questions to reinforce learning. The goal is to provide a single, well-organized resource that covers everything you need to pass the KCSA exam.
| Resource | Description |
|---|---|
| KCSA_CHEATSHEET.md | Quick-reference cheatsheet with key commands, concepts, and definitions |
| domains/ | In-depth notes organized by exam domain and topic |
| labs/ | Hands-on lab exercises mapped to each domain |
| mock-questions/ | Practice exam sets in the style of the real KCSA exam |
- The 4Cs of Cloud Native Security
- Cloud Provider and Infrastructure Security
- Controls and Frameworks
- Isolation Techniques
- Artifact Repository and Image Security
- Workload and Application Code Security
- API Server
- Controller Manager
- Scheduler
- Kubelet
- Container Runtime
- KubeProxy
- Pod
- Etcd
- Container Networking
- Client Security
- Storage
- Pod Security Standards
- Pod Security Admissions
- Authentication
- Authorization
- Secrets
- Isolation and Segmentation
- Audit Logging
- Network Policy
- Kubernetes Trust Boundaries and Data Flow
- Persistence
- Denial of Service
- Malicious Code Execution and Compromised Applications in Containers
- Attacker on the Network
- Access to Sensitive Data
- Privilege Escalation
- Supply Chain Security
- Image Repository
- Observability
- Service Mesh
- PKI
- Connectivity
- Admission Control
- Basic understanding of Kubernetes concepts (Pods, Deployments, Services, Namespaces)
- Familiarity with Linux command-line operations
- A working knowledge of containers and container runtimes (Docker or containerd)
- General understanding of networking fundamentals (TCP/IP, DNS, TLS)
- Read the KCSA Cheatsheet for a high-level overview of all domains.
- Work through each domain in order, starting with Domain 1.
- Complete the labs in labs/ to get hands-on practice.
- Test yourself with the mock exams in mock-questions/.
- Week 1-2: Domains 1 and 6 -- these are the lighter-weight domains (14% + 10%) and provide important foundational context.
- Week 3-4: Domains 2 and 3 -- these are the heaviest domains (22% each) and cover cluster component security and security fundamentals.
- Week 5: Domains 4 and 5 -- threat modeling and platform security (16% each).
- Week 6: Review, labs, and mock exams. Focus on areas where you scored lowest.
You will need a local Kubernetes cluster to work through the labs. Any of the following options will work:
Option 1: kind (recommended)
kind (Kubernetes IN Docker) is lightweight and fast. It runs Kubernetes clusters inside Docker containers.
# Install kubectl
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/$(uname -s | tr '[:upper:]' '[:lower:]')/$(uname -m)/kubectl"
chmod +x kubectl
sudo mv kubectl /usr/local/bin/
# Install kind
# On macOS:
brew install kind
# On Linux:
curl -Lo ./kind https://kind.sigs.k8s.io/dl/latest/kind-linux-amd64
chmod +x ./kind
sudo mv ./kind /usr/local/bin/kind
# Create a cluster
kind create cluster --name kcsa-lab
# Verify the cluster is running
kubectl cluster-info --context kind-kcsa-lab
kubectl get nodesOption 2: minikube
# Install minikube
# On macOS:
brew install minikube
# On Linux:
curl -LO https://storage.googleapis.com/minikube/releases/latest/minikube-linux-amd64
sudo install minikube-linux-amd64 /usr/local/bin/minikube
# Start a cluster
minikube start --kubernetes-version=v1.30.0
# Verify
kubectl get nodesOption 3: Cloud provider free tier
- Google Cloud (GKE): Free tier includes a small GKE Autopilot cluster.
- AWS (EKS): Use the AWS free tier with a small EKS cluster.
- Azure (AKS): Azure free account provides credits to run an AKS cluster.
Note: For the KCSA exam, a local kind or minikube cluster is sufficient for all labs in this guide.
Practice exams designed to simulate the real KCSA exam experience: