KCSA Study Plan

How to prepare for the Kubernetes and Cloud Native Security Associate exam — a structured study plan covering all domains in priority order.

Prerequisites before you start

KCNA or equivalent Kubernetes knowledge. Familiarity with basic security concepts (TLS, RBAC, network policies).

4-week KCSA study schedule

This schedule works whether you have 4 weeks or 4 months — compress or expand each week based on your available time. Engineers with relevant background can often move faster through early weeks.

• Week 1
  Cluster Component Security & Security Fundamentals

  Kubernetes Cluster Component Security (22%): API server security, etcd encryption, kubelet auth, network policies, audit logging. Kubernetes Security Fundamentals (22%): Pod security (PSA/PSP), RBAC deep dive, Secrets management, admission controllers.

• Week 2
  Threat Model & Platform Security

  Kubernetes Threat Model (16%): attack surfaces, persistence techniques, lateral movement in clusters, 4C security model (Cloud, Cluster, Container, Code). Platform Security (16%): supply chain security, image scanning, signing (Sigstore/Cosign), runtime security tools.

• Week 3
  Cloud Native Security Overview & Compliance

  Overview of Cloud Native Security (14%): the 4C model in depth, security principles. Compliance and Security Frameworks (10%): CIS Benchmarks, NIST, PCI-DSS relevance to Kubernetes, compliance tooling overview.

• Week 4
  Mock Exams & Targeted Review

  Run timed mocks targeting 85%+. KCSA questions tend to be scenario-based — practice explaining "which control prevents X attack". Review cluster component security and the threat model sections, which carry the highest combined weight.

Study tips for KCSA

• Kubernetes Cluster Component Security and Kubernetes Security Fundamentals together make up 44% of the exam — master RBAC, admission controllers, and Pod security standards.
• The 4C security model (Cloud, Cluster, Container, Code) is a recurring framework — understand what controls apply at each layer.
• Know the difference between authentication, authorization, and admission control, and where each plugs into the API server request flow.
• Supply chain security (image scanning, signing, SBOMs) is a growing exam topic — don't skip it.

Mock exam strategy

Mock exams are the most important study tool for associate-level CNCF certs. Here is how to use them effectively:

• Take your first mock without studying — use the results as a diagnostic to see your baseline and find your weakest domains.
• Study the domains you missed most, not the ones you already know.
• Always do mocks under real conditions: no notes, 90-minute timer, no pausing.
• Review every wrong answer after each mock. Understanding why wrong answers are wrong is as valuable as knowing the right answer.
• Target 85%+ consistently before booking the real exam. The extra buffer protects against nerves on exam day.

Recommended KCSA resources

• Official CNCF KCSA curriculum — the authoritative list of topics. Use it as your checklist.
• The KCSA exam is closed-book — read official documentation now, not on exam day.
• Community Slack channels (CNCF Slack #certifications) have real candidates discussing recent exam experiences.