The 10 CNCF multiple-choice exams compared

All the exams at a glance

The table lists every multiple-choice exam in the two programs with its format and its heaviest domain, taken from the official pages and the CNCF curricula. The heaviest domain is the single most useful fact for planning, because it shows where most of the exam’s weight sits.

The shared format

The multiple-choice instructions describe a single online, remotely proctored format. Most exams list 60 questions, 90 minutes and a 75% pass mark, and the list price is $250. The certifications are valid for 2 years. No resources are allowed during the exam. Each purchase gives a 12-month window to schedule and one retake, except single-attempt purchases.

• Same proctoring rules and system check for every exam.
• Scored automatically, so there is no partial credit for reasoning you cannot show.
• Formats can change, so check your exam’s page before booking.

The two broad exams: KCNA and KCSA

KCNA and KCSA are the only multiple-choice exams on the Kubestronaut path, and the only broad ones. KCNA covers Kubernetes and the cloud native ecosystem at an introductory level. KCSA covers Kubernetes security across the cluster components, the threat model, platform security and compliance frameworks. Both reward wide recall rather than deep knowledge of one tool, and both renew automatically under the CARE program when you pass a later hands-on exam: CKA or CKAD renews KCNA, and CKS renews KCSA. Because they are broad, both exams punish gaps more than shallow knowledge: a domain you skipped costs far more than a detail you half remember. Cover every domain once before going deep on any of them.

Observability: PCA and OTCA

PCA is about Prometheus: its data model, PromQL, instrumentation and alerting. OTCA is about OpenTelemetry: the API and SDK, the Collector and debugging telemetry pipelines. They share observability concepts such as signals, metrics and traces, but test different tools. If you use Prometheus daily, PCA first; if you instrument code, OTCA first. The difference shows in the questions. PCA asks you to predict what a query returns or when an alert fires; OTCA asks how telemetry is produced, processed and exported. Taking them close together works well because the concepts domain of each one reinforces the other.

Delivery and platforms: CGOA, CAPA, CBA and CNPA

CGOA is the tool-neutral GitOps exam built on the OpenGitOps principles and glossary. CAPA goes deep on the Argo project: Argo CD, Workflows, Rollouts and Events. CBA tests Backstage, from its catalog to customisation and infrastructure. CNPA is the broad platform engineering exam, from core fundamentals to measuring a platform. CGOA then CAPA, and CBA alongside CNPA, are natural pairs. The four sit at different depths. CGOA and CNPA are about principles and practices that apply to any tool, while CAPA and CBA are about one project each, down to its components and configuration. Taking the broad exam of each pair first gives you the vocabulary the deep one assumes.

Networking and policy: CCA and KCA

CCA tests Cilium: its architecture, network policy, service mesh, observability, installation, cluster mesh, eBPF and BGP. KCA tests Kyverno: policy fundamentals, installation, the CLI and, above all, writing policies. Both assume comfort with Kubernetes objects; KCA also pairs well with KCSA because admission control appears in both. Neither is an introductory exam. Both expect you to read YAML and predict behaviour, so a small local cluster where you install the project and try its main features is close to essential preparation for both.

Who each exam suits

A practical way to choose your next exam is to start from your daily work. The table maps common roles to the exam that is likely to feel most familiar.

A sensible order

There is no required order, but reusing material saves time. Take KCNA first for the vocabulary, then KCSA, which completes the multiple-choice half of Kubestronaut. For Golden, group the rest in pairs that share material and take each pair close together.

GoldenKube practice banks, in questions: KCNA 288, KCSA 378, PCA 539, CCA 300, CAPA 200, CGOA 280, CBA 126, OTCA 364, KCA 414, CNPA 332.

1. 1KCNA, then KCSA: the two Kubestronaut multiple-choice exams.
2. 2KCA right after KCSA, while admission control is fresh.
3. 3PCA and OTCA together for observability.
4. 4CGOA, then CAPA for GitOps and Argo.
5. 5CNPA and CBA together for platform engineering.
6. 6CCA when your networking knowledge from the hands-on exams is strongest.

Preparing for two exams at once

Pairing exams that share material saves time, but only if the second exam gets its own focused practice. The shared part is usually the concepts; the separate part is the project-specific detail, and that is where most questions in the deeper exam come from. A simple rhythm works for any of the pairs above.

1. 1Study the shared concepts once, with the broader exam of the pair: KCSA before KCA, CGOA before CAPA, CNPA before CBA.
2. 2Take the broader exam while the concepts are fresh.
3. 3Spend the next one to three weeks on the project-specific domains of the second exam, using its heaviest domain as the main focus.
4. 4Run a timed mock for the second exam before booking it; recall of the first exam’s material does not prove readiness for the second.

Validity, renewal and the program titles

Every multiple-choice certification in the table is valid for 2 years. Two of them can renew without a retake under the CARE program described in the multiple-choice FAQ: passing CKA or CKAD renews KCNA, and passing CKS renews KCSA. The others renew by passing the exam again. That matters when you plan a long path, because a title such as Kubestronaut or Golden Kubestronaut depends on the right certifications being held, and the oldest ones expire first.

• Take the Kubestronaut multiple-choice exams before the hands-on ones, so the later hands-on passes can renew them.
• Group the Golden-only exams so their expiry dates do not spread across several years.
• Check the official program pages for the current title rules before planning around them.