LINUX FOUNDATIONKubernetes and Cloud Native Security Associate (KCSA)
The Kubernetes and Cloud Native Security Associate (KCSA) certification validates your foundational knowledge of security in the cloud native ecosystem. Designed for beginners, it covers everything from the 4Cs of cloud native security to Kubernetes cluster component security, threat modeling, and compliance frameworks. Earning the KCSA is the perfect first step toward a career in cloud security, demonstrating your readiness to advance to professional-level certifications.
825 practice questions · Updated 2026-07-30
6Domains
34Objectives
214Concepts
825Questions
KCSA Curriculum
Every domain, objective, and concept the KCSA exam measures.
- Identify the 4Cs
- Explain the security role of each C
- Understand the layered defense approach
- Apply the 4Cs to real-world scenarios
- Cloud Provider Shared Responsibility Model
- Cloud Provider Security Controls
- Cloud Infrastructure Security Best Practices
- Cloud Compliance and Governance
- Security Controls
- Types of Security Controls
- Security Frameworks
- Applying Frameworks
- Isolation Techniques Overview
- Kernel Namespaces
- Control Groups (cgroups)
- Container Isolation
- Virtual Machines and Hypervisors
- Sandboxing and MicroVMs
- Network Isolation
- Storage and Data Isolation
- Secrets and Identity Isolation
- Multi-tenancy Models
- Choosing Isolation Levels
- Artifact Repository Fundamentals
- Image Security Threats
- Image Scanning and Vulnerability Management
- Image Signing and Trust
- Secure Image Configuration
- Repository Access Control
- Supply Chain Security for Artifacts
- Supply Chain Security
- Secure Development Lifecycle
- Code Analysis and Scanning
- Runtime Security
- Workload Isolation
- Secrets Management
- Immutable Infrastructure
- Image Security
- API Server Role in Kubernetes Security
- Authentication Mechanisms
- Authorization Modes
- Admission Controllers
- TLS and Secure Communication
- API Server Hardening
- Audit Logging
- Service Account Management
- API Request Flow and Security Controls
- Controller Manager Role
- Controller Manager Components
- Controller Manager Security Risks
- Controller Manager Hardening
- Controller Manager Authentication and Authorization
- Controller Manager Audit and Monitoring
- Scheduler Role
- Scheduling Process
- Scheduler Security
- Kubelet Role and Responsibilities
- Kubelet API and Communication
- Kubelet Security Configuration
- Kubelet Admission Control
- Kubelet Container Runtime Security
- Kubelet Node Authentication and Authorization
- Kubelet Logging and Auditing
- Kubelet Hardening Best Practices
- Container Runtime Interface (CRI)
- Container Runtime Responsibilities
- Runtime Isolation Mechanisms
- Runtime Security Features
- Runtime Configuration and Hardening
- Runtime Monitoring and Auditing
- Runtime Vulnerabilities and Mitigations
- Runtime Alternatives and Trade-offs
- KubeProxy Role
- KubeProxy Modes
- KubeProxy Security Considerations
- KubeProxy Configuration and Hardening
- Pod Security
- Etcd Security
- Container Networking Security
- Storage Security
- Persistence Security
- Client Security Fundamentals
- Authentication Mechanisms
- Service Account Authentication
- Authentication Flow
- Pod Security Standards
- Pod Security Admissions
- Secrets overview
- Creating Secrets
- Using Secrets in Pods
- Secret types
- Secret security best practices
- Isolation and Segmentation Fundamentals
- Kubernetes Network Model
- Network Segmentation Strategies
- Network Policy Basics
- NetworkPolicy Selectors
- NetworkPolicy Ingress and Egress Rules
- NetworkPolicy Default Deny
- NetworkPolicy Enforcement and Limitations
- Audit Logging Fundamentals
- Audit Policy Configuration
- Audit Log Backends
- Audit Log Analysis
- Kubernetes Trust Boundaries
- Data Flow in Kubernetes
- Securing Data in Transit and at Rest
- Supply Chain Security Fundamentals
- Secure Software Development Lifecycle (SSDLC)
- Secure Code Development
- Code Repositories and Version Control Security
- Continuous Integration/Continuous Delivery (CI/CD) Security
- Artifact Integrity and Provenance
- Image Scanning and Vulnerability Management
- Signing and Verification of Images
- Software Bill of Materials (SBOM)
- Secure Base Images and Minimalism
- Dependency Management and Pinning
- Supply Chain Attacks and Mitigations
- Policy and Governance for Supply Chain
- Image Repository Security Fundamentals
- Secure Image Storage
- Image Signing and Verification
- Image Scanning and Vulnerability Management
- Access Control for Image Repositories
- Supply Chain Security for Images
- Observability fundamentals
- Kubernetes logging architecture
- Monitoring cluster components
- Audit logging
- Threat detection with observability data
- Observability tools and integration
- Service Mesh Fundamentals
- Traffic Management
- Security Policies in Service Mesh
- Observability in Service Mesh
- Service Mesh Implementation Considerations
- PKI Fundamentals
- Certificate Lifecycle
- Kubernetes PKI Components
- Certificate Management in Kubernetes
- Secure Certificate Storage
- Certificate Rotation and Renewal
- Revocation and Compromise Response
- Network Policies
- Ingress and Egress Controls
- Service Mesh Security
- CNI Security Considerations
- Encryption in Transit
- DNS Security
- Network Segmentation
- Admission Control Overview
- Built-in Admission Controllers
- Mutating vs Validating Admission Controllers
- Dynamic Admission Controllers
- Admission Webhook Configuration
- Webhook Security Considerations
- Admission Controller Ordering and Management
- Impact on Platform Security
- Compliance Frameworks Overview
- Key Compliance Frameworks
- Mapping Controls to Kubernetes
- Audit Logging and Evidence
- Continuous Compliance Monitoring
- Threat Modeling Fundamentals
- Threat Modeling Methodologies
- Threat Modeling Process Steps
- Cloud-Native Threat Modeling
- Threat Modeling Tools and Techniques
- Integrating Threat Modeling into SDLC
- Supply Chain Security Fundamentals
- Threats and Risks in the Supply Chain
- Secure Software Development Lifecycle (SSDLC)
- Dependency and Artifact Management
- Supply Chain Compliance Frameworks
- Verification and Provenance
- Continuous Monitoring and Incident Response
- Automation in Security Frameworks
- Tooling for Compliance
- Policy-as-Code
- Automated Compliance Checks
- Integration of Automation with Kubernetes
- Resource exhaustion attack vectors
- Kubernetes resource limits and quotas
- Network policies for DoS mitigation
- API server rate limiting and admission control
- Node and pod isolation strategies
- Monitoring and detection of DoS
- Incident response and resilience
- Identify container escape vectors
- Assess risks of malicious code in images
- Detect compromised applications
- Apply runtime security measures
- Mitigate container breakout impacts
- Network Attack Vectors
- Network Segmentation and Isolation
- Service Exposure Risks
- Encryption in Transit
- DNS and Service Discovery Attacks
- Network Policy Enforcement
- Monitoring and Detection of Network Threats
- Identify sensitive data types
- Map data access paths
- Analyze threat actors
- Evaluate attack vectors
- Assess impact of data exposure
- Apply mitigation strategies
- Privilege Escalation in Kubernetes
- Container Breakout Techniques
- Pod Security Context Misconfigurations
- RBAC Privilege Escalation
- Service Account Token Abuse
- Node-Level Privilege Escalation
- Mitigation Strategies
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for KCSA, so none is invented.