Skip to content

KCA vs KCSA: which certification should you take first?

By Ibrahim Yesilay · Published · Updated

KCA tests one tool in depth: Kyverno, the policy engine that admits, changes or rejects Kubernetes resources. KCSA tests the broad baseline of Kubernetes and cloud native security. Both are multiple-choice, and the Linux Foundation lists no prerequisite for either. KCSA first gives the security vocabulary; KCA then shows one way to enforce it.

KCA and KCSA side by side

KCA and KCSA side by side
AttributeKCAKCSA
Exam formatMultiple-choiceMultiple-choice
Hands-on?NoNo
Questions60 source60 source
Duration (minutes)90 source90 source
Passing score75% source75% source
Price (USD)250 source250 source
Validity (years)2 source2 source
PrerequisitesNone sourceNone source
Exam domains66
Program tierGolden requirementKubestronaut core
GoldenKube supportPractice questions availablePractice questions available

Values are read from official Linux Foundation pages; each has a source link and the check date. Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation.

How KCA and KCSA differ

KCA (Kyverno Certified Associate) is a multiple-choice exam in the Golden requirement group of the Golden Kubestronaut program, and KCSA (Kubernetes and Cloud Native Security Associate) is a multiple-choice exam in the Kubestronaut core group. Both use the same exam style, so the real difference is subject matter rather than how you are tested. KCA: Multiple-choice exam on Kyverno: installation, the CLI, applying and writing policies, and policy management. KCSA: Multiple-choice exam on the baseline security knowledge for Kubernetes and cloud native environments: cluster components, threat model, platform security and compliance. The table above sets format, questions, duration, passing score, price, validity, prerequisites and the number of domains side by side, each value read from the official Linux Foundation pages and dated.

Because both are multiple-choice, the study method is the same for either one: learn the concepts, then check yourself with questions that explain why each answer is right or wrong.

What KCA and KCSA cover

KCA is organised into 6 domains and KCSA into 6. The heaviest KCA domain is Writing Policies (32%), while the heaviest KCSA domain is Kubernetes Cluster Component Security (22%). Domain weights come straight from each official certification page and show where the Linux Foundation expects most of your preparation time to go. If your own work sits mainly in one heavy domain of an exam, that exam will feel closer to your daily job; if the heavy domains are unfamiliar, plan more study time for that exam. The lists below give every domain with its weight, checked against the official pages on the date shown at the top of this page.

  • KCA: Fundamentals of Kyverno, 18% of the exam
  • KCA: Installation, Configuration, and Upgrades, 18% of the exam
  • KCA: Kyverno CLI, 12% of the exam
  • KCA: Applying Policies, 10% of the exam
  • KCA: Writing Policies, 32% of the exam
  • KCA: Policy Management, 10% of the exam
  • KCSA: Overview of Cloud Native Security, 14% of the exam
  • KCSA: Kubernetes Cluster Component Security, 22% of the exam
  • KCSA: Kubernetes Security Fundamentals, 22% of the exam
  • KCSA: Kubernetes Threat Model, 16% of the exam
  • KCSA: Platform Security, 16% of the exam
  • KCSA: Compliance and Security Frameworks, 10% of the exam

Who should take KCA

KCA suits people who write or review cluster policy. Kyverno describes itself as a cloud native policy engine, and its documentation says it can enforce policies as a Kubernetes admission controller. The exam therefore rewards knowing how policies and rules are structured, how they are installed and applied, and how to write validation, mutation and generation rules. It fits platform engineers who run Kyverno or are choosing a policy tool. KCA is a multiple-choice exam with 6 domains, led by Writing Policies (32%), and it sits in the Golden requirement group of the program. The table above gives its questions, duration, passing score, price and validity with their sources. Choosing is easier when you compare the domain list with the work you actually did in the last month, and the official certification page remains the place to confirm the current curriculum before you book.

  • You write or maintain admission policies for a shared cluster.
  • Kyverno is in your platform or you are evaluating it.
  • You want a Golden Kubestronaut requirement that builds directly on security knowledge.
  • You prefer a tool-specific exam to a broad one.

Who should take KCSA

KCSA suits people who need the security picture of a Kubernetes platform rather than one tool. It covers the overview of cloud native security, cluster component security, Kubernetes security fundamentals, the threat model, platform security and compliance frameworks. It fits security analysts, auditors, platform engineers and developers who must reason about risk, and it is a core Kubestronaut certification. KCSA is a multiple-choice exam with 6 domains, led by Kubernetes Cluster Component Security (22%), and it sits in the Kubestronaut core group of the program. The table above gives its questions, duration, passing score, price and validity with their sources. Choosing is easier when you compare the domain list with the work you actually did in the last month, and the official certification page remains the place to confirm the current curriculum before you book.

  • You work in security, risk or compliance around Kubernetes.
  • You want the threat model before choosing any enforcement tool.
  • You need a core Kubestronaut exam that is conceptual, not tool-specific.
  • You are new to Kubernetes security and want an outline to follow.

Can you take both, and in which order?

KCSA first is the natural order for most people, because admission control is easier to place once you know the Kubernetes threat model and the security building blocks that policies try to enforce. Neither exam blocks the other, and a Kyverno user can start with KCA. Kubernetes also has a built-in alternative: its documentation describes validating admission policies as a declarative, in-process alternative to validating admission webhooks that uses the Common Expression Language, stable since Kubernetes v1.30. Seeing both helps put Kyverno in context. Prerequisites as published by the Linux Foundation: KCA: None. KCSA: None. Each is listed as its own certification in the program, so passing one never counts toward the other. Whichever you choose first, book the exam only when you can answer questions across every domain, not just the heaviest one.

Time to plan, from the bank sizes alone: KCSA has 353 questions and KCA has 399. At 20 new answers a day, one pass through each bank takes about 18 days for KCSA and 20 days for KCA, before reviews of missed questions. This is arithmetic on the bank sizes, not a promise about how long you personally need.

The two overlap where policy meets security: admission control, who may run what in a cluster, and how violations are reported. KCSA asks what should be protected and why; KCA asks how a Kyverno rule makes that happen.

How GoldenKube helps with KCA and KCSA

GoldenKube is a free practice app for the multiple-choice certifications in the Golden Kubestronaut program. KCA has a live GoldenKube question bank: you get instant feedback, and questions you miss come back for review until you have mastered them. Every KCA question has a written explanation. KCSA has a live GoldenKube question bank: you get instant feedback, and questions you miss come back for review until you have mastered them. Every KCSA question has a written explanation. You get 10 free guest answers, then a free account; no credit card is needed. Practice does not replace the official curriculum, and passing practice questions does not guarantee a pass on the real exam.

Both banks are live, so you can practise them in the same weeks. A simple pattern is to learn a KCSA security area, then see how the matching Kyverno rule type appears in KCA. Domain-focused practice keeps you on one area until it clicks, and missed questions come back in review.

Verdict: KCA or KCSA first?

Take KCSA first unless you already run Kyverno; its security concepts explain why policies exist. Take KCA next, or first if policy enforcement is already your daily work. Both are multiple-choice, neither is a prerequisite of the other, and KCSA is a core Kubestronaut exam while KCA is a Golden Kubestronaut requirement.

Next steps

Frequently asked questions

Is KCSA a prerequisite for KCA?

No. The Linux Foundation certification pages list no prerequisite for either exam. KCSA first is a recommendation because policy enforcement is easier to place after the security concepts, not a rule of the program.

Which is more technical, KCA or KCSA?

KCA goes deeper on one tool, Kyverno, including rule types and policy structure. KCSA is broader and more conceptual across Kubernetes security. Both are multiple-choice; neither asks you to work in a terminal.

Can I take KCA before KCSA?

Yes. If you already work with Kubernetes admission control and Kyverno policies, starting with KCA is reasonable. If the Kubernetes threat model and security building blocks are new, take KCSA first.

Can I practise both on GoldenKube?

Yes. Both KCA and KCSA have live question banks on GoldenKube. Every KCA and KCSA question has a written explanation. You get 10 free guest answers, then a free account; no credit card is needed.

Do both count toward Golden Kubestronaut?

Yes. Golden Kubestronaut requires every certification in the program. KCSA is also one of the five core Kubestronaut certifications, while KCA belongs to the Golden group only.

Is Kyverno the only way to enforce policy in Kubernetes?

No. Kubernetes has a built-in validating admission policy feature that uses the Common Expression Language and has been stable since v1.30, and other policy tools exist. KCA tests Kyverno specifically, so study its documentation for the exam.

Sources

Last updated