20 Free KCSA Sample Questions with Answers

How to use these KCSA practice questions

Work through the 20 KCSA sample questions in one sitting without looking anything up. For each question, decide on an answer first, then open the answer and read the explanation, including when you were right, because a correct guess and a correct line of reasoning look identical until the exam rewords the question. Mark every question as right, wrong or guessed, and count a guess as wrong when you score yourself. Give the set about 30 minutes, which is the average time per question on the real exam multiplied by twenty. The aim is to find out which exam domains are already solid and which ones need study before you buy the exam.

The official exam format is 60 questions in 90 minutes, with a passing score of 75%, according to the Linux Foundation documentation checked on 2026-10-23.

With JavaScript enabled, each answer starts collapsed behind a Show answer button so you can test yourself. Without JavaScript, and for any crawler or screen reader that reads the raw page, every answer and explanation is already visible below its question.

These questions were written for GoldenKube practice. They are not copied from the real exam, and nothing on this page tells you what the real exam will ask.

• Read the question twice and underline the constraint words: "most", "least", "first", "only", "not".
• Eliminate options you can prove wrong before you pick between the rest.
• Where a question says to select all that apply, every correct option must be chosen and none of the wrong ones.
• Read the explanation even for questions you got right; it often names the nearby concept the exam likes to swap in.

Overview of Cloud Native Security (3 questions)

Kubernetes Cluster Component Security (4 questions)

Kubernetes Security Fundamentals (5 questions)

Kubernetes Threat Model (3 questions)

Platform Security (3 questions)

Compliance and Security Frameworks (2 questions)

Score yourself

The Linux Foundation lists a passing score of 75% for KCSA. On a set of 20 questions that is 15 correct. Reaching 15 here is a useful signal and not a prediction: 20 questions is a small sample, and the real exam covers every domain in its published weights. Use the table below to decide what to do next. Count only the questions you answered correctly without help, and be strict about it: a question you got right for the wrong reason belongs in the missed pile. Then repeat the exercise a few days later with a different set from the full bank so that you are measuring understanding and not memory of these specific questions.

Count your misses per domain, using the headings above. One missed question in a domain is noise; three misses in one domain is a study plan. The practice mode on GoldenKube does this sorting for you by sending you back to the domains where you are weakest.

Overview of Cloud Native Security: what it tests

Overview of Cloud Native Security sets the frame for the rest of KCSA. Expect the 4Cs model of cloud, cluster, container and code, the idea of defence in depth, the shared responsibility between a cloud provider and its customer, and the basics of securing the software supply chain, artifacts, secrets and workloads. Questions often ask which layer a given control belongs to or which layer is compromised when a given attack succeeds. The trap is treating the layers as independent: a weakness in an outer layer, such as an exposed node, undermines every control inside it, which is why the model is drawn as nested circles and not as a list.

Practise placing ten controls you already know, such as image scanning, network policy and disk encryption, into the correct C. The skill transfers directly to the layer-identification questions.

Kubernetes Cluster Component Security: what it tests

Kubernetes Cluster Component Security asks how to harden each part of the cluster. Expect the API server with its authentication, authorisation and admission stages and TLS, the kubelet with anonymous access, authorisation mode and its open ports, etcd with encryption at rest, client certificate authentication and network isolation, plus the scheduler, controller manager, kube-proxy and the container runtime. Questions frequently ask which setting closes a described exposure. A common trap is assuming a component is protected by default, when several of them rely on flags that an administrator must set deliberately, so know the secure value for the flags you recognise.

Make a small table with one row per component, a column for how it is reached, and a column for the control that protects that access. Questions in this domain are almost always a lookup in that table.

Kubernetes Security Fundamentals: what it tests

Kubernetes Security Fundamentals covers the controls that an application team uses every day. Expect the Pod Security Standards and their profiles (privileged, baseline and restricted), Pod Security Admission, RBAC with Roles, ClusterRoles and bindings, ServiceAccounts and token handling, Secrets and their storage, network policies, namespaces as a boundary, and audit logging. Traps are specific: RBAC only adds permissions and never denies them, a NetworkPolicy has no effect unless the network plugin enforces it, and a Secret is encoded, not encrypted, unless encryption at rest is configured. Reading a short manifest and spotting the risky field is a typical question shape.

Read three or four sample manifests and name the single riskiest line in each, such as privileged mode, a host path mount or a wildcard verb. That habit is faster than rereading the documentation.

Kubernetes Threat Model: what it tests

Kubernetes Threat Model looks at the cluster from the attacker's side. Expect trust boundaries, the ways an attacker gains a foothold and persists, privilege escalation from a container to a node, lateral movement across the network, access to sensitive data, denial of service by exhausting resources, and the idea that a threat model lists what can go wrong before choosing controls. Questions describe an attack step and ask what it is called or which control would have prevented it. The trap is answering with a control that is real but does not address the stated step, so match the control to the exact action in the scenario.

For each attack you meet, finish the sentence: this is stopped by, and detected by. Having both halves ready covers the two ways the question can be phrased.

Platform Security: what it tests

Platform Security covers the services built around the cluster. Expect the security of the container image supply chain, image registries and signing, the role of a service mesh in encrypting and authenticating traffic, certificates and public key infrastructure, network connectivity between workloads, admission control and policy enforcement, and observability for security signals. Questions often ask what a given platform component gives you and what it does not. A frequent trap is expecting one tool to cover everything: a service mesh authenticates workloads but does not scan images, and an admission controller blocks bad configuration but does not detect runtime behaviour.

List the platform components you know and write the one threat each one addresses and the one it leaves open. Knowing the gap is what lets you reject a tempting wrong option.

Compliance and Security Frameworks: what it tests

Compliance and Security Frameworks is the smallest KCSA domain and mostly asks you to recognise names and purposes. Expect compliance frameworks and how they apply to cloud native systems, threat-modelling frameworks, supply chain compliance and attestations, and the tooling that automates audits and policy checks. The trap is confusion between frameworks that sound alike: a configuration benchmark, an attack knowledge base and a threat-modelling method answer different questions. A small domain still decides borderline results, because its questions are mostly recall and can be answered quickly once the vocabulary is in place. Expect short recall questions that you can answer quickly once the names are familiar.

Make flashcards with the framework name on one side and the question it answers on the other, for example what to harden, what attackers do, or how to enumerate threats. Ten minutes of review is usually enough.

What a 20-question KCSA sample can and cannot tell you

A set of 20 questions is a screening test, not a measurement. With only a few questions per domain, one lucky guess or one unlucky wording moves your result by five percentage points, and a domain with only two questions behind it says almost nothing about that domain's true strength. The set is also fixed, so after one read-through it measures your memory of these items and not your command of KCSA. Use it to choose where to start studying, not to decide whether you are ready, and then rely on the larger bank, where questions repeat only after a gap and the app tracks which domains stay weak.

A second limit is style. Written practice questions share one author voice, while a real exam draws on many writers and reads differently. Treat any practice score, here or elsewhere, as one input next to the official curriculum, hands-on experience with the technology, and the documentation of the project itself.

A one-week plan after the KCSA sample set

After the sample set, spend a week turning the result into a plan. Start with the domains where you missed questions and read the matching part of the official curriculum before you try more questions, because practice is far more useful once you can explain the topic. Return to practice in short daily sessions, review every missed question the next day, and leave the last day for a fresh mixed set. Keep a simple note of which concepts caused misses; the same three or four ideas usually explain most of them, and naming them is what turns practice into progress.

The largest KCSA domain is Kubernetes Cluster Component Security, at 22% of the published weights. If two domains tie for weakest in your tally, start with the heavier one, and keep the other 5 domains ticking over with short reviews.

Adjust the pace to your calendar. If you have more time, spread the same steps over two or three weeks and add a second mixed session at the end of each week. If you have less, keep days 1 to 3 and day 6 and accept a rougher picture. What matters is that every study session starts from a specific weak domain and ends with a check, not that the plan is followed to the letter.

Practice the full KCSA bank

These 20 questions are a small slice of the GoldenKube KCSA bank, which holds more than 300 questions. In practice mode the app serves the questions you are due to review first, then the domain where you are weakest, and it brings missed questions back after a gap until you answer them correctly. You can answer 10 questions as a guest without an account; after that a free account keeps your progress, and no credit card is asked for at any point. Each answer comes with the same kind of written explanation you saw on this page, so a wrong answer is always followed by the reasoning that fixes it.

Practice mode shows one question at a time and gives the verdict and explanation as soon as you answer. A focus option lets you stay inside a single domain until it feels solid, which is the natural next step after finding your weakest domain on this page. There is no timer and no exam simulation in practice mode; the goal is learning, not performance under pressure.

Frequently asked questions