KCSA Exam Guide 2026: cost, format, passing score and study plan

KCSA exam facts

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation.

KCSA exam domains and weights

How many questions and how long is KCSA?

The KCSA exam has 60 questions and a time limit of 90 minutes, as stated in the Linux Foundation's exam instructions and checked on 23 October 2026. Delivery is: online, proctored, multiple-choice. That leaves roughly 90 seconds per question if you spread the time evenly. The questions are spread over 6 exam domains, and the published domain weights tell you how much of the paper each domain accounts for, so heavier domains deserve proportionally more of your practice time. GoldenKube is an independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation, so confirm every figure on the official page before you book.

KCSA questions often describe a setup and ask which control or threat it relates to, so reading the scenario for the layer involved (cluster component, workload, network or platform) is half of answering.

Pacing matters more than raw speed on a multiple-choice paper. A simple routine is to answer what you know on the first pass, flag anything that needs a second look, and use the remaining minutes on the flagged questions rather than stalling early. With about 90 seconds on average per question, a question that has taken more than twice that is a good candidate for flagging.

Practice should mirror the exam shape: one question at a time, a committed answer, then the explanation. GoldenKube's practice mode works this way and brings missed questions back until you answer them correctly, which is closer to how recall is tested than rereading notes.

What is the passing score for KCSA?

The Linux Foundation lists the KCSA passing score as 75% (checked 23 October 2026). Treat the percentage as the target and aim comfortably above it in practice. The heavier a domain is weighted, the more of the exam it decides, so neglecting a large domain is the costliest way to fall short. The largest KCSA domain, Kubernetes Cluster Component Security, carries 22% of the exam, and the next, Kubernetes Security Fundamentals, carries 22%. Together they make up 44% of the exam, so plan to be reliably above the line in both before you book, and treat every smaller domain as the place to pick up the remaining points.

Use the passing score as a calibration tool. When you practise, track your accuracy per domain instead of one overall number, and treat a domain you keep missing as a gap to close before booking. A single good overall percentage can hide a weak, heavily weighted domain.

The official certification page is the authority for the passing score and can change, so read it again on the week you register. The source links below point to the exact pages this guide was checked against.

How much does KCSA cost and how long is it valid?

The KCSA exam fee is $250 (USD), listed on the official certification page and checked 23 October 2026. The certification is valid for 2 years, so plan for it to lapse unless you renew it; the official page is the place to confirm how renewal works. Prices and bundles can change, so treat the figure here as the list price on the checked date and confirm it at checkout. KCSA is one of the certifications in the Golden Kubestronaut program that GoldenKube helps you prepare for. Budget for the exam fee itself, and remember that a certification only helps while it is current, so decide up front when you would renew it and what that renewal would cost.

Validity is the part people forget when planning a program such as Golden Kubestronaut: with 2 years of validity, the order you take the exams in decides when each one needs renewing, and taking KCSA early in a long sequence can mean renewing it before you finish the rest.

KCSA is the security-focused multiple-choice exam among the Kubestronaut core certifications; the hands-on security exam is CKS, which has its own fee on its own page.

GoldenKube practice itself is free: 10 guest answers, then a free account, no credit card. The exam fee is paid to the Linux Foundation, not to GoldenKube.

How hard is KCSA?

KCSA is hard in a different way from the other associate exams, because no domain dominates. Kubernetes Cluster Component Security and Kubernetes Security Fundamentals are 22% each, Kubernetes Threat Model and Platform Security are 16% each, Overview of Cloud Native Security is 14% and Compliance and Security Frameworks is 10%. A candidate who is strong on RBAC and Pod security but has never studied component hardening or the frameworks domain gives away a large slice of the paper. The questions connect controls to threats, so memorising lists helps less than knowing why each control exists and what it stops. This guide does not quote pass rates; judge readiness by whether your practice accuracy is even across all six domains instead of high in two.

KCSA has six domains with an unusually even spread: Kubernetes Cluster Component Security and Kubernetes Security Fundamentals are 22% each, Kubernetes Threat Model and Platform Security 16% each, Overview of Cloud Native Security 14% and Compliance and Security Frameworks 10%. No single domain dominates, so the exam punishes a lopsided preparation more than most associate exams: skipping one area costs a visible slice of the paper.

The conceptual load comes from connecting layers. Component security asks what to harden on the API server, etcd and the kubelet; fundamentals cover RBAC, Pod Security Standards, network policies and secrets; the threat model asks how an attacker moves between them. Candidates who know each control in isolation but not why it exists tend to miss the scenario-style questions.

Work through the domains in the order of a request: how it is authenticated and authorised, how the workload it creates is constrained, how the network and platform around it are protected, and how compliance frameworks describe all of that. The same order gives you a mental map for the threat model questions.

Registration, scheduling and retakes

Register through the official KCSA certification page on the Linux Foundation site. Delivery is described as: Online, proctored, multiple-choice. Prerequisites: None. Retake policy: One retake per exam purchase if a passing score is not achieved. These statements were checked on 23 October 2026 against the pages listed under Resources. The rules for identification, the testing environment and rescheduling are set by the Linux Foundation, so read its candidate documentation for the current requirements before you book. Book a slot only after your practice results are stable across every domain, leave a buffer between your last study session and the exam, and keep the confirmation details somewhere you can find them quickly.

CKS lists passing CKA as its prerequisite, so KCSA does not substitute for it; the prerequisites row above applies to KCSA only.

A retake is covered by the stated policy, but treat the first attempt as the real one and use the weights above to decide where your remaining study time goes.

A 3-week KCSA study plan

This 3-week plan orders the KCSA domains by how much of the exam they carry and how much each one builds on the others. Each week has one focus, and the table lists the domains it covers. The intent is to read the official material for a domain, then answer practice questions on it, then read the explanations for every miss. Adjust the pace to your background: someone who already works with the technology daily can compress it, and someone new to it should stretch each week. Keep a short list of the questions you missed and reread it on the last day, since repeated misses mark the real gaps.

Spend roughly the same share of time on a domain as it carries in the exam, then add extra time wherever your practice accuracy is lowest. In GoldenKube you can focus on a single domain, or let smart practice pick the domain where you are weakest.

In the last few days, stop learning new material. Run mixed practice, review only the questions you missed, and sleep properly before the exam.

Resources

Start from the official KCSA certification page, which holds the current domain list, the fee and the booking link. The certification page also points to the official curriculum, published as a PDF in the CNCF curriculum repository; read it as the authoritative list of what can be asked. For the subject itself, use the project's own documentation, Kubernetes security documentation (kubernetes.io), which is the best single source for terminology and behaviour. Then use GoldenKube practice questions on the KCSA practice page to test recall, and revisit the documentation for every explanation that surprised you. Official pages are the source for facts that can change, such as the fee and the format, so check them again in the week you book. The links are listed below this section, and each fact in this guide was checked against them on the date shown above.

• Official KCSA certification page and exam details on the Linux Foundation site.
• Official KCSA curriculum PDF in the CNCF curriculum repository.
• Kubernetes security documentation (kubernetes.io).
• GoldenKube KCSA practice questions, free to start with 10 guest answers.

Frequently asked questions