KCNA vs KCSA: which certification should you take first?

KCNA and KCSA side by side

Values are read from official Linux Foundation pages; each has a source link and the check date. Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation.

How KCNA and KCSA differ

KCNA (Kubernetes and Cloud Native Associate) is a multiple-choice exam in the Kubestronaut core group of the Golden Kubestronaut program, and KCSA (Kubernetes and Cloud Native Security Associate) is a multiple-choice exam in the Kubestronaut core group. Both use the same exam style, so the real difference is subject matter rather than how you are tested. KCNA: Multiple-choice exam on foundational knowledge of Kubernetes and the wider cloud native ecosystem. KCSA: Multiple-choice exam on the baseline security knowledge for Kubernetes and cloud native environments: cluster components, threat model, platform security and compliance. The table above sets format, questions, duration, passing score, price, validity, prerequisites and the number of domains side by side, each value read from the official Linux Foundation pages and dated.

Because both are multiple-choice, the study method is the same for either one: learn the concepts, then check yourself with questions that explain why each answer is right or wrong.

What KCNA and KCSA cover

KCNA is organised into 4 domains and KCSA into 6. The heaviest KCNA domain is Kubernetes Fundamentals (44%), while the heaviest KCSA domain is Kubernetes Cluster Component Security (22%). Domain weights come straight from each official certification page and show where the Linux Foundation expects most of your preparation time to go. If your own work sits mainly in one heavy domain of an exam, that exam will feel closer to your daily job; if the heavy domains are unfamiliar, plan more study time for that exam. The lists below give every domain with its weight, checked against the official pages on the date shown at the top of this page.

• KCNA: Kubernetes Fundamentals, 44% of the exam
• KCNA: Container Orchestration, 28% of the exam
• KCNA: Cloud Native Application Delivery, 16% of the exam
• KCNA: Cloud Native Architecture, 12% of the exam
• KCSA: Overview of Cloud Native Security, 14% of the exam
• KCSA: Kubernetes Cluster Component Security, 22% of the exam
• KCSA: Kubernetes Security Fundamentals, 22% of the exam
• KCSA: Kubernetes Threat Model, 16% of the exam
• KCSA: Platform Security, 16% of the exam
• KCSA: Compliance and Security Frameworks, 10% of the exam

Who should take KCNA

KCNA is the broad starting point. It covers Kubernetes itself, container orchestration, application delivery and cloud native architecture, so it suits anyone who wants a map of the ecosystem. If you are earlier in your cloud native journey, or you come from development, operations or management and need a shared vocabulary, KCNA gives you a structured outline and a certification to aim for. KCNA is a multiple-choice exam with 4 domains, led by Kubernetes Fundamentals (44%), and it sits in the Kubestronaut core group of the program. The table above gives its questions, duration, passing score, price and validity with their sources. Choosing is easier when you compare the domain list with the work you actually did in the last month, and the official certification page remains the place to confirm the current curriculum before you book.

• You are starting out and want the full picture of Kubernetes and its ecosystem.
• You want one foundation exam before specialising.
• Your work touches delivery pipelines or architecture decisions.
• You want a multiple-choice exam as your first step.

Who should take KCSA

KCSA is the security-focused associate exam. It covers how cluster components are secured, the Kubernetes threat model, platform security and compliance frameworks. It suits people whose role involves risk, platform hardening, audits or security review of cloud native systems, and it works as a conceptual base before the hands-on CKS exam, which is a separate and practical certification. KCSA is a multiple-choice exam with 6 domains, led by Kubernetes Cluster Component Security (22%), and it sits in the Kubestronaut core group of the program. The table above gives its questions, duration, passing score, price and validity with their sources. Choosing is easier when you compare the domain list with the work you actually did in the last month, and the official certification page remains the place to confirm the current curriculum before you book.

• You are in security, compliance or risk and work with Kubernetes platforms.
• You want to understand the threat model before hardening anything.
• You plan to move toward CKS later and want the concepts first.
• You already know Kubernetes basics and want a focused second exam.

Can you take both, and in which order?

You can take both, and you should for the Kubestronaut title, since both are core certifications. The Linux Foundation lists no prerequisite for either. KCNA first is the usual order because KCSA questions assume you already know what a pod, a namespace, an admission step or a service account is. If you are already comfortable with Kubernetes basics, nothing stops you from starting with KCSA. Prerequisites as published by the Linux Foundation: KCNA: None. KCSA: None. Each is listed as its own certification in the program, so passing one never counts toward the other. Whichever you choose first, book the exam only when you can answer questions across every domain, not just the heaviest one.

Both exams are multiple-choice and both have a live GoldenKube question bank, so you can prepare for them in the same weeks. A simple plan is to alternate: learn a KCNA area, then see how the same area appears from the security side in KCSA.

How GoldenKube helps with KCNA and KCSA

GoldenKube is a free practice app for the multiple-choice certifications in the Golden Kubestronaut program. KCNA has a live GoldenKube question bank: every question comes with an explanation, you get instant feedback, and questions you miss come back for review until you have mastered them. KCSA has a live GoldenKube question bank: every question comes with an explanation, you get instant feedback, and questions you miss come back for review until you have mastered them. You get 10 free guest answers, then a free account; no credit card is needed. Practice does not replace the official curriculum, and passing practice questions does not guarantee a pass on the real exam.

Both banks are available now, so you can practise them back to back. Domain-focused practice lets you stay on one area until it clicks, and missed questions come back in review.

Verdict: KCNA or KCSA first?

Take KCNA first unless you already know Kubernetes well; it supplies the concepts KCSA builds on. Take KCSA next if security is part of your work or your route to CKS. Both are multiple-choice, both are on the Kubestronaut path, and neither blocks the other, so the order is a preference rather than a rule.

Next steps

• KCNA

  Practice questions available

  Practice KCNAKCNA certification page

• KCSA

  Practice questions available

  Practice KCSAKCSA certification page

Frequently asked questions

Sources

• KCNA certification page (Linux Foundation), checked 23 Oct 2026
• KCSA certification page (Linux Foundation), checked 23 Oct 2026