KCSA question bank coverage by exam domain

What the table measures

Each row is one official KCSA exam domain, in the order and with the weight the Linux Foundation publishes. The question count is read from the GoldenKube KCSA bank when the page is served, so it always matches what you can practise today. Share is that count divided by the whole bank, and the gap column is the share minus the official weight, in percentage points: a positive gap means the bank has more questions on that domain than the exam weight alone would suggest, a negative gap means fewer. Explained counts the questions that come with a written explanation, and topic pages counts the public topic pages built from that domain.

Some bank sets use their own domain names; those are mapped to the official domain they cover. Mixed practice sets that span several domains are not forced into one row and are listed separately, which is why the official rows can add up to less than the whole bank.

The weights describe the exam, not this bank. A gap is not an error in the exam or in your preparation, it only tells you where practising here gives you more or less material than the exam is likely to ask about.

Where the KCSA bank leans

Kubernetes Security Fundamentals and Kubernetes Cluster Component Security are both over-represented: together they make up a clearly larger part of the bank than of the exam. Kubernetes Threat Model is the most under-covered domain, and Platform Security is also below its weight. Overview of Cloud Native Security sits a little under its weight and Compliance and Security Frameworks is close to it. In practice this means a KCSA learner who only answers bank questions in order will see plenty of RBAC, admission, API server and kubelet material, and comparatively little on threat modelling, supply chain and platform controls.

The bank labels the overview domain as Cloud Native Security; it is mapped to the official Overview of Cloud Native Security row. KCSA has the finest subdomain split of the practice certs, so most domains have several topic pages.

How to use this when you practise KCSA

Use focus mode to give the under-covered domains extra rounds. Kubernetes Threat Model questions run out first, so once you have worked through them, go back to the official curriculum and the threat areas it lists, such as trust boundaries, privilege escalation and denial of service, rather than waiting for more questions. For the over-covered Kubernetes domains, treat a mastered status as a sign you are ready rather than a reason to keep grinding them: the exam gives them less room than the bank does.

Sources

• KCSA certification page and domain weights, Linux Foundation, checked 2026-10-23