KCSA practice exam: free questions, domains and format
KCSA, the Kubernetes and Cloud Native Security Associate, is the Linux Foundation multiple-choice exam on baseline security for Kubernetes. This page lists its six domains and weights, the verified format and cost, five sample questions with answers, and the way to start free practice.
By Ibrahim Yesilay · Published · Updated
Last updated · Verified against the Linux Foundation certification page
GoldenKube is independent and not affiliated with or endorsed by CNCF or The Linux Foundation. Disclaimer
What is the KCSA exam?
KCSA is the Kubernetes and Cloud Native Security Associate exam from the Linux Foundation and CNCF. It is a proctored, online, multiple-choice exam on the baseline security knowledge a person working with Kubernetes should have: how the cluster components are secured, what the security fundamentals of Kubernetes are, how attackers are modelled, how platforms and workloads are protected, and which compliance and security frameworks apply. It tests understanding rather than command-line skill, so you answer questions about what a control does and why it matters. KCSA is one of the five core certifications of the Kubestronaut tier and a natural companion to KCNA. Officially it is the Kubernetes and Cloud Native Security Associate certification, a multiple-choice exam in the Kubestronaut core tier of the 16-certification Golden Kubestronaut program. The sections below cover its official domains, the verified format and cost, and its place in the path.
Typical topics include authentication and authorization, admission control, Pod security, network policies, secrets handling, supply chain security, runtime threats and the vocabulary of the 4C model and threat frameworks. The exam is the knowledge-level counterpart of the hands-on CKS, which asks you to apply similar controls in a live cluster.
KCSA exam domains and weights
KCSA has six domains. Kubernetes Cluster Component Security and Kubernetes Security Fundamentals each carry 22%, the two largest domains. Kubernetes Threat Model and Platform Security follow at 16% each, Overview of Cloud Native Security at 14%, and Compliance and Security Frameworks at 10%. The spread is fairly even, which means there is no domain you can skip. Study the cluster components and the fundamentals first, then the threat model, and use the framework domain to learn the terms that appear in the scenario questions. The official list has 6 domains: the largest is Kubernetes Cluster Component Security at 22% and the smallest is Compliance and Security Frameworks at 10%, so a sensible plan splits study time roughly in proportion to these weights.
The domains move from the inside of the cluster outwards. Component security covers the API server, etcd, kubelet and friends; fundamentals covers the objects and controls you configure; the threat model explains what an attacker tries; platform security covers the supporting layers such as images, registries and policy; compliance connects it all to standards.
| Domain | Weight |
|---|---|
| Overview of Cloud Native Security | 14% |
| Kubernetes Cluster Component Security | 22% |
| Kubernetes Security Fundamentals | 22% |
| Kubernetes Threat Model | 16% |
| Platform Security | 16% |
| Compliance and Security Frameworks | 10% |
Weights as published on the official certification page, checked 23 Oct 2026.
KCSA exam format and cost
The KCSA exam facts below were read from the official Linux Foundation pages on 2026-10-23, and every row of the table links to the page it came from. Format: Online, proctored, multiple-choice. Questions: 60. Duration: 90 minutes. Passing score: 75%. Price: 250 US dollars. Certification validity: 2 years. Prerequisites: None. Retake policy: One retake per exam purchase if a passing score is not achieved. Curriculum version: not published by the Linux Foundation. Prices and policies change, so confirm them on the official KCSA page before you book. If the Linux Foundation changes a value, this page is updated and shows the date it was last verified.
| Questions | 60 source |
|---|---|
| Duration (minutes) | 90 source |
| Passing score | 75% source |
| Price (USD) | 250 source |
| Validity (years) | 2 source |
| Delivery | Online, proctored, multiple-choice source |
| Prerequisites | None source |
| Retake policy | One retake per exam purchase if a passing score is not achieved source |
| Curriculum version | not published by the Linux Foundation |
With 60 questions in 90 minutes you have about 90 seconds per question on average, which is enough to read a scenario carefully but not to agonise over one item. If every question counts equally, 75% of 60 is 45 correct answers, so one unknown topic does not decide the result. Flag a hard question, move on, and return to it at the end.
Treat the table as the single source for numbers on this page. If a row says the Linux Foundation does not publish a value, we print that instead of guessing, and the official KCSA page remains the final word on registration and policy.
How GoldenKube practice works for KCSA
GoldenKube turns the KCSA bank into a practice loop. You answer one question at a time, see right away whether you were correct, and read an explanation of why. The next question is chosen for you: reviews that are due come first, then the domain where you are weakest, spread across all 6 exam domains so you do not only practise what you already know. A question you miss comes back on a spaced schedule until you answer it correctly, and a mock exam mode lets you test yourself under exam conditions. You can answer 10 questions as a guest with no sign-up; after that a free account saves your progress, with no credit card.
- Adaptive order: due reviews first, then your weakest domain.
- Spaced repetition: missed questions return until you have mastered them.
- Every question carries an explanation, not just a right-or-wrong verdict.
- Mock exam mode for a timed run once you are close to ready.
5 sample KCSA questions
The five questions below come from the GoldenKube KCSA bank, and each one shows its correct answer and a written explanation. They are practice questions written for learning, not questions from the real exam, and they were picked once so the page stays stable. Use them as a quick check of your level: if you can explain why each wrong option is wrong, you are in good shape for this part of the syllabus, and if not, the explanation shows what to revise. The sample questions page holds a larger set, and the practice app holds the full bank with adaptive ordering and review.
Question 1
- A.ConfigMaps cannot be mounted as volumes in pods
- B.ConfigMaps do not support key-value pairs
- C.Data stored in ConfigMaps is kept in plain text and not encrypted
- D.ConfigMaps are deprecated in recent Kubernetes versions
- E.ConfigMaps have strict size limitations that prevent storing secrets
Correct answer: C
Sources: Kubernetes Official Documentation - ConfigMaps, Kubernetes Official Documentation - Secrets
Question 2
- A.Financial transaction records across global markets
- B.Network latency metrics in high-availability clusters
- C.Entry points, exit points, data flows, and potential threat vectors within the system
- D.Container orchestration for microservices deployment
- E.Source code management for Git-based repositories
Correct answer: C
Sources: Threat Modeling Using Data Flow Diagrams - OWASP, Data Flow Diagrams for Threat Modeling - Microsoft Docs
Question 3
- A.They manage multi-cluster ingress controllers
- B.They automate vulnerability detection in container images, typically before deployment
- C.They provide a database of open-source container licenses
- D.They specialize in high-availability cluster provisioning
- E.They replace Kubernetes’ default scheduler
Correct answer: B
Sources: Aqua Security Container Security, Clair GitHub Repository
Question 4
- A.kubectl create namespace dev
- B.kubectl apply namespace dev
- C.kubectl generate namespace dev
- D.kubectl make namespace dev
- E.kubectl new namespace dev
Correct answer: A
Sources: Kubernetes Namespaces, Kubernetes CLI Commands
Question 5
- A.Monitor network traffic
- B.Secure workloads across various environments
- C.Manage cloud costs
- D.Provide identity and access management
- E.Automate infrastructure provisioning
Correct answer: B
Where KCSA sits in the Golden Kubestronaut path
KCSA is one of the 5 core Kubestronaut certifications, and Golden Kubestronaut requires all 16 certifications in the program, so KCSA is a required step. Its own prerequisites, per the Linux Foundation: None. The program page lists all 16 certifications side by side and marks which ones GoldenKube can practice today. A sensible order places it right after KCNA: KCNA gives the general Kubernetes vocabulary, KCSA adds the security view, and both prepare the ground for the hands-on CKS. Several of the Golden certifications, such as KCA for Kyverno policy and CCA for Cilium network policy, return to the same security ideas in a specific tool.
If you plan the whole path, KCSA is a compact way to build security vocabulary that the later exams assume. The program page shows the complete list of sixteen certifications and which ones GoldenKube covers with practice questions.
Frequently asked questions
What is the KCSA exam?
KCSA stands for Kubernetes and Cloud Native Security Associate. Multiple-choice exam on the baseline security knowledge for Kubernetes and cloud native environments: cluster components, threat model, platform security and compliance. It is one of the 16 certifications in the Golden Kubestronaut program, in the Kubestronaut core tier.
How many questions are on the KCSA exam?
60 questions, according to the Linux Foundation pages checked on 2026-10-23. Every question is multiple-choice. The exact count and format can change, so confirm it on the official page before booking.
What is the KCSA passing score?
75% is the passing score published by the Linux Foundation, as checked on 2026-10-23. Aim to score clearly above it in practice, because the real exam will contain topics you have not seen.
How much does the KCSA exam cost?
The exam price is 250 US dollars, with a certification validity of 2 years. Retake policy: One retake per exam purchase if a passing score is not achieved. Prices change, so check the official KCSA page before you pay.
How long is the KCSA exam?
90 minutes, per the Linux Foundation pages checked on 2026-10-23. Plan your pacing before the exam day: know roughly how long you can afford to spend on one question.
How hard is the KCSA exam?
KCSA is an associate-level, multiple-choice exam. The wide security vocabulary is the usual hurdle: the questions use terms from the Kubernetes threat model, the 4C model and compliance frameworks, and a candidate who has only used Kubernetes without studying its security model can find them unfamiliar. GoldenKube has no pass-rate data and does not claim one. Reading explanations for every question you miss is the most efficient way to close those gaps.
Is KCSA required for Golden Kubestronaut?
Yes. KCSA is one of the five core Kubestronaut certifications, and Golden Kubestronaut requires all 16 certifications in the program.
How do I start free KCSA practice?
Open the KCSA practice page and answer your first question. You get 10 free guest answers with no sign-up, then a free account keeps your progress, with no credit card. Every answer has an explanation, weak domains come up more often, and missed questions return on a spaced schedule.
Exam facts verified 23 Oct 2026 on the official KCSA certification page.