Kubernetes and Cloud Security Associate (KCSA)
Demonstrate foundational understanding of cloud-native security, risk frameworks, threat models, supply chain integrity, cluster architecture hardening, and regulatory compliance standards.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
The KCSA is a foundational, multiple-choice certification from the CNCF and Linux Foundation assessing core knowledge of cloud-native security, attack surfaces, and defensive architectures.
The KCSA is a 90-minute multiple-choice examination consisting of 60 questions administered online with remote proctoring.
A passing scaled score of 75% is required. Results are displayed immediately upon submission.
Domains include: (1) Overview of Cloud Native Security (14%), (2) Threat Modeling and Threat Vectors (16%), (3) Security Principles (20%), (4) Platform and OS Security (16%), (5) Workload Security (18%), and (6) Governance, Risk, and Compliance (16%).
The 4C's security model represents defense in depth across four concentric layers: Cloud (infrastructure, IAM), Cluster (Kubernetes control plane, RBAC), Container (image scanning, signatures), and Code (application vulnerabilities, SAST).
Maintained by Microsoft and MITRE ATT&CK, it categorizes threat tactics: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, and Impact.
RBAC binds roles with specific API groups, resources, and verbs to identities, preventing unauthorized read or write access to cluster components.
Supply chain security safeguards the software lifecycle from source code to production deployment through code signing, vulnerability scanning, SBOMs, and admission policy gates.
Kubernetes built-in Pod Security Admission evaluates pods against three standardized profiles: Privileged (unrestricted), Baseline (prevents known privilege escalations), and Restricted (hardened best practices).
Zero Trust assumes the network is hostile, mandating strict identity verification, mutual TLS encryption, micro-segmentation, and continuous authorization for every request.
Falco captures Linux kernel system calls using eBPF to detect unexpected container activities, such as shell spawns, privilege escalations, or unauthorized file access in real time.
Security engineers, DevSecOps practitioners, compliance auditors, platform operators, and software developers building secure cloud-native environments.