Kubernetes and Cloud Native Security Associate

KCSA is conceptual, not hands-on. You will not run kubectl in this exam - questions test that you understand what a control does, when it applies, and what attack it mitigates. Studying for KCSA the way you would for CKS (drilling Falco rules and AppArmor profiles on a live cluster) is overkill - read the docs and the curriculum bullets thoroughly instead.

Cluster Component Security and Security Fundamentals together are 44% of the exam. If your background is non-Kubernetes (or KCNA-only), bias your study time toward how the API server / etcd / kubelet are hardened and how RBAC + Pod Security Admission + Secrets actually work. Everything else builds on those primitives.

Pod Security Admission has fully replaced PodSecurityPolicy - PSP was deprecated in 1.21 and removed in 1.25 (per the Kubernetes deprecation guide). Older study material may still mention PSP, so be ready to recognize it as obsolete rather than current. Three PSA levels (Privileged / Baseline / Restricted), three modes (enforce / audit / warn), set via namespace labels.

Secrets are base64 encoded, not encrypted. This is the highest-yield trick question in the bank. Without an EncryptionConfiguration on kube-apiserver, anyone with etcd access reads them in plain text. Know how to enable encryption-at-rest (aescbc / secretbox / KMS provider) and the difference between encryption-at-rest and external secret stores (Vault / cloud KMS / CSI Secret Store).

NetworkPolicy is enforced by the CNI plugin, NOT by Kubernetes itself. If your cluster's CNI doesn't implement NetworkPolicy (e.g. plain Flannel), the policy resource exists but does nothing. Calico, Cilium, and Weave do enforce it. This is a classic misconception the exam likes to test.

The 4Cs (Cloud, Cluster, Container, Code) is the framing the exam uses for the Cloud Native Security domain. Each layer inherits the security posture of the one beneath it - a misconfigured cloud account compromises everything above. Memorize which controls live at each layer (e.g. IAM at Cloud, RBAC at Cluster, image scanning at Container, SAST at Code).

Supply chain security has grown from a checkbox to a substantial topic post-SolarWinds and post-Log4Shell. Know image signing (Cosign / Sigstore), SBOM (Syft, sigs.k8s.io/bom), the SLSA framework (Build track levels L0-L3; current spec is v1.2 - older material may still describe the retired 'SLSA 1-4' framing), admission-time verification via OPA Gatekeeper / Kyverno / Connaisseur. The exam expects you to know what each tool does, not how to write its config.

Threat-model questions are scenario-based: 'an attacker has compromised a pod - which Kubernetes control limits blast radius?' Know the standard answers cold - PodSecurityContext (runAsNonRoot, allowPrivilegeEscalation=false, capabilities drop ALL), NetworkPolicy default-deny, ServiceAccount token automount=false, namespace isolation. Read MITRE ATT&CK for Containers once.

Compliance and Security Frameworks (10%) is the smallest domain but tests recognition: CIS Benchmark (kube-bench tool), STRIDE (threat-modelling framework), SLSA (supply-chain integrity). Don't memorize control numbers - just know which framework solves which class of problem.

Multiple-choice format means distractors matter. Read every option before answering - expect plausible distractors built around adjacent or obsolete controls (e.g. 'PodSecurityPolicy' offered alongside 'Pod Security Admission'). CNCF / Linux Foundation does not publish the exam's question count, but community reports point to roughly 60 questions in 90 minutes - that works out to ~90 seconds per question, generous for a conceptual exam. Flag and come back rather than agonizing.

The free retake bundled with KCSA is a real safety net. If you fail by a small margin on attempt 1, treat the gap analysis as the study plan for attempt 2. CNCF positions KCSA as a learning credential rather than a gatekeeper, and the bundled retake reflects that posture.