Linux Foundation KCSA exam guide covering cloud native security, policy, and controls decisions.
This Kubernetes and Cloud Native Security Associate guide helps KCSA candidates focus on what the exam tests, where close answers usually split, and which review page to use next.
Use the study plan to group Kubernetes, Linux, and platform choices, the cheat sheet for scenario decisions, the sample questions for mixed practice, the FAQ for scope checks, the resources page for Linux Foundation exam references, and the glossary when cluster terms blur together.
| Item | Guide value |
|---|---|
| Vendor | Linux Foundation / CNCF |
| Exam or credential | Kubernetes and Cloud Native Security Associate |
| Code or shorthand | KCSA |
| Study level | Associate cloud native security |
| IT Mastery page | KCSA exam page |
| Guide shape | Start-here page, study plan, cheat sheet, FAQ, resources, and glossary. |
| Lane | What to master | Common weak answer |
|---|---|---|
| Cluster security model | Understand API server, etcd, control plane, node, runtime, and workload security responsibilities. | Protecting workloads while leaving cluster access or secrets exposed. |
| Identity and RBAC | Use service accounts, roles, bindings, admission, and least privilege. | Granting cluster-admin because an app needs one resource permission. |
| Workload and image security | Apply pod security, admission controls, image scanning, signatures, secrets, and runtime restrictions. | Trusting images or privileged pods by default. |
| Network and policy | Use network policies, ingress control, service mesh options, and traffic isolation. | Assuming service names imply isolation. |
| Monitoring and incident response | Use audit logs, runtime signals, findings, containment, and forensic preservation. | Deleting compromised resources before collecting evidence and scope. |
Cloud native security answers start with identity, policy, workload hardening, network isolation, audit evidence, and containment.
Use the current Linux Foundation exam page for live exam details, including name, status, pricing, duration, delivery method, languages, retirement or beta changes, and domain weights where applicable.