TL;DR: Take KCNA (Kubernetes and Cloud Native Associate) first if you are new to Kubernetes, containers and the cloud native ecosystem. Take KCSA (Kubernetes and Cloud Native Security Associate) if you already know Kubernetes basics and want to prove you understand how to secure a cluster. Both are beginner-level, 90-minute, online proctored, multiple-choice exams from the Linux Foundation and CNCF, both cost USD 250 on their own, and both certifications stay valid for 2 years. Linux Foundation also sells them as a bundle for USD 425, and its bundle page suggests starting with KCNA. For most people, the order is KCNA, then KCSA. The exception is a security or compliance professional who needs only the security vocabulary and not the full Kubernetes picture.
Quick Facts
| Item | KCNA | KCSA |
| Full exam name | Kubernetes and Cloud Native Associate | Kubernetes and Cloud Native Security Associate |
| Issued by | Linux Foundation and CNCF | Linux Foundation and CNCF |
| Level | Beginner (associate) | Beginner (associate) |
| Format | Online, proctored, multiple-choice | Online, proctored, multiple-choice |
| Duration | 90 minutes | 90 minutes |
| Question count | Not listed on the Linux Foundation page | Not listed on the Linux Foundation page |
| Passing score | Not listed on the Linux Foundation page | Not listed on the Linux Foundation page |
| Exam fee (USD) | 250 | 250 |
| Bundle | KCNA + KCSA bundle for USD 425 (includes 12 months of exam eligibility and one retake) | Same bundle |
| Certification validity | 2 years | 2 years |
| Scheduling window | 12 months to schedule and take the exam | 12 months to schedule and take the exam |
| Prerequisites | None | None (KCNA is suggested as a starting point on the bundle page) |
| Biggest domain | Kubernetes Fundamentals, 44% | Cluster Component Security and Security Fundamentals, 22% each |
| Smallest domain | Cloud Native Architecture, 12% | Compliance and Security Frameworks, 10% |
| What it proves | You understand Kubernetes and the cloud native ecosystem | You understand how to secure Kubernetes and cloud native platforms |
| Hands-on tasks | No, multiple-choice only | No, multiple-choice only |
| KCSA launch | Not applicable | February 27, 2024 |
| Best for | Newcomers, developers, support and ops staff | Security staff, platform staff, anyone with Kubernetes basics |
| Typical next step | KCSA, CKAD or CKA | CKS, after CKA |
The Short Answer
The two exams look like twins, because they share the same length, format, price and validity. The difference is the subject.
- KCNA is the map. It asks whether you understand what Kubernetes is, how its parts fit together, how containers and orchestration work, how applications are delivered, and what the wider cloud native ecosystem looks like.
- KCSA is the lock and the alarm. It asks whether you understand how that same platform is attacked and defended: cluster components, security fundamentals, the threat model, platform security and compliance frameworks.
If you cannot explain what a Pod, a Deployment and a Service are, start with KCNA. If you can, and your job touches security, KCSA is a good choice. If you are somewhere in between, start with KCNA, because the security exam assumes you already speak Kubernetes.
Why This Comparison Matters
People searching for a first Kubernetes credential run into two near-identical exam names and cannot tell which suits them. The pages for both look alike: 90 minutes, multiple-choice, online proctored, USD 250, valid for 2 years, no prerequisites, beginner level. The bundle page makes it worse, because it sells both together and invites the question “do I need both?”
The decision also sits in the middle of a wider path:
- Below these two exams is general IT and cloud knowledge.
- Above them are the hands-on Kubernetes exams, CKA, CKAD and CKS, which are practical and much harder. Our guide to CKA vs CKAD vs CKS covers that tier.
KCNA and KCSA are the theory layer. They do not ask you to type commands against a live cluster, which makes them a lower-risk way to test whether Kubernetes and cloud native security are a good fit for you before you invest in the hands-on exams.
One more reason to pay attention now: KCSA is a young exam. The Linux Foundation says it launched on February 27, 2024, which means study material is thinner than for older exams, and the practical advice in this article leans on the official outline instead of years of community notes.
What KCNA Covers
The Linux Foundation lists four domains. Weights are as published on the current exam page.
| Domain | Weight | Topics listed |
| Kubernetes Fundamentals | 44% | Core concepts, administration, scheduling, containerization |
| Container Orchestration | 28% | Networking, security, troubleshooting, storage |
| Cloud Native Application Delivery | 16% | Application delivery, debugging |
| Cloud Native Architecture | 12% | Observability, cloud native ecosystem and principles, cloud native community and collaboration |
In plain language:
- Kubernetes Fundamentals (44%). This is almost half the exam. You need the core objects and what they do (Pods, ReplicaSets, Deployments, Services, Namespaces, ConfigMaps, Secrets), how the control plane and nodes work together, how the scheduler decides where Pods go, and what containerization means (images, registries, runtimes). It is the vocabulary of the whole ecosystem.
- Container Orchestration (28%). Networking between Pods and Services, storage and volumes, troubleshooting a workload that will not start, and the security basics that sit inside Kubernetes itself. This is where orchestration stops being a definition and becomes a decision.
- Cloud Native Application Delivery (16%). How applications get from code to cluster and how you debug them once they are there. Expect questions about delivery approaches and deployment strategies at a conceptual level.
- Cloud Native Architecture (12%). Observability (metrics, logs and traces), the principles of cloud native design, the CNCF landscape, and the community and its roles. This is the smallest domain, and also the one people skip, which is a mistake because the questions are usually easy marks.
KCNA is a breadth exam. You do not need to be an expert in any single area, but you do need to recognise what everything is called and what it is for.
What KCSA Covers
The Linux Foundation lists six domains.
| Domain | Weight |
| Overview of Cloud Native Security | 14% |
| Kubernetes Cluster Component Security | 22% |
| Kubernetes Security Fundamentals | 22% |
| Kubernetes Threat Model | 16% |
| Platform Security | 16% |
| Compliance and Security Frameworks | 10% |
The exam page gives domain names and weights but not a detailed topic list for each. For the full line-by-line curriculum, use the official KCSA outline linked from the Linux Foundation page. Study guides commonly map the domains to topics like these, so treat the mapping as a revision aid, not as the official list:
- Overview of Cloud Native Security (14%). The idea that security is layered across cloud, cluster, container and code, and the basic responsibilities at each layer.
- Kubernetes Cluster Component Security (22%). Securing the building blocks of a cluster: the API server, the datastore, the kubelet and the other control plane and node components.
- Kubernetes Security Fundamentals (22%). Access control with roles and role bindings, network policies for ingress and egress, and Pod-level controls such as security contexts and Pod Security Standards.
- Kubernetes Threat Model (16%). How to think about attackers: where they enter, what they try, and the reference models people use to describe threats.
- Platform Security (16%). Security around the cluster: supply chain, image and registry hygiene, runtime protection, observability and the surrounding platform.
- Compliance and Security Frameworks (10%). The standards and frameworks used to measure and prove security, and how Kubernetes environments map onto them.
Linux Foundation describes the credential as proof that you understand baseline security configuration for Kubernetes clusters, can work toward compliance objectives, and can assess security threats and vulnerabilities. Its target audience is new IT professionals who want to advance, pre-professionals, and developers interested in security.
Where the Two Overlap
The overlap is mostly in the first half of KCSA.
- Core Kubernetes concepts. KCSA questions assume you know what a Pod, a node and a namespace are. KCNA is where those are taught.
- Security inside orchestration. KCNA’s Container Orchestration domain lists security as a topic. KCSA goes much further into the same ground.
- Observability. KCNA includes it in architecture, and KCSA uses it in the platform security conversation about monitoring and detection.
The exams diverge in depth. KCNA asks “what is this and what is it for”. KCSA asks “how does an attacker abuse this, and what control stops them”. That is why people who skip KCNA can find KCSA harder than the price tag and the word “associate” suggest.
Difficulty: Which Is Harder?
For most people, KCSA is harder if they have no Kubernetes background, and KCNA is harder if they have no cloud background at all. The two statements are not a contradiction: they depend on where you start.
- KCNA has the larger vocabulary. Four domains of concepts and tools, with 44% in Kubernetes fundamentals alone. People new to containers need time to absorb the terms.
- KCSA has the deeper reasoning. You are asked to pick the right control for a threat, which needs understanding and not just recall.
- KCSA has thinner study material. The exam is newer, so there are fewer practice resources and community write-ups.
- Neither has labs. Both are multiple-choice, so you cannot rely on muscle memory from a terminal. You need to understand why, not only how.
The Linux Foundation pages list neither a question count nor a passing score for these exams, so I am not quoting either. Some third-party study guides mention about 60 questions and a pass mark around 75% for KCSA, but I could not confirm that on the official page, so check the current candidate handbook before relying on it.
If you already run workloads on Kubernetes, KCNA will feel like a formality and KCSA will feel like a useful push into a topic you probably neglect. If you are new, expect KCNA to take most of your effort and KCSA to be the more demanding second step.
Which Should You Take First?
Take KCNA first if any of these apply:
- You have never deployed anything to Kubernetes.
- You are a developer, support engineer or tester whose team is moving to containers.
- You work in cloud or DevOps and want the ecosystem overview before specialising.
- You plan to take CKA or CKAD later and want a low-risk warm-up.
Take KCSA first only if all of these apply:
- You already understand Kubernetes basics, even without a certificate.
- Your job is security, compliance or platform engineering with a security focus.
- You want the security credential for a specific reason, such as a role or a client requirement.
The bundle page suggests KCNA as the starting point before KCSA, and that matches how the content builds. Kubernetes knowledge makes the security ideas easier to place, and security questions are harder to answer if you are still learning what the components are.
Who Should Take Which
Take KCNA if:
- You are new to Kubernetes and want a recognised starting credential.
- You work around Kubernetes but do not manage clusters, for example product, QA, sales engineering or technical support.
- You are a student or career changer building a cloud native portfolio.
- You want to compare yourself against the hands-on exams without paying for a lab-based exam yet.
Take KCSA if:
- You work in security, risk or compliance and your organisation runs Kubernetes.
- You are a platform or DevOps engineer who is asked to harden clusters.
- You are a developer who wants to write more secure workloads.
- You want a stepping stone toward CKS, the hands-on security exam.
Take both, in order, if:
- You are building a cloud native security career from scratch. KCNA gives the foundation, and KCSA adds the security layer. The bundle makes this the cheaper route.
Eight Realistic Scenarios
- Graduate with no cloud experience. KCNA. It is the least risky way to learn the vocabulary and prove it.
- DevOps engineer already running clusters. You can probably skip KCNA and choose between KCSA and the hands-on CKA. Pick KCSA if you want to cover the security gap, CKA if you want a practical credential.
- Cybersecurity analyst whose company is moving workloads to Kubernetes. KCNA first for the concepts, then KCSA. Going straight to KCSA is possible but harder.
- Developer who ships containers but does not own the cluster. KCNA. It maps to what you touch daily. Add KCSA if you want to review your own Pod and access settings.
- Compliance manager who needs to talk to platform teams. KCSA, with just enough KCNA study to follow the architecture. The compliance and frameworks domain is only 10%, so the rest still needs Kubernetes understanding.
- IT support technician aiming at cloud jobs. KCNA. It is more widely useful than a security-only credential at that stage.
- Consultant pitching Kubernetes security reviews. Both, then CKS. The theory credentials open the conversation, and the hands-on exam supports the work.
- Team lead choosing for a mixed team. KCNA for the newcomers and KCSA for anyone with security duties. Use the USD 425 bundle for people who need both.
Do These Exams Help Your Career?
Neither the Linux Foundation pages nor the sources I reviewed give a reliable salary figure for KCNA or KCSA holders, so I am not quoting any. These are beginner exams, and any pay number attached to them would really describe the job, the country and the experience level.
What can be said without inventing data:
- They are entry signals, not specialist proof. Employers know they are multiple-choice and beginner-level. They show you have studied the subject, and they help most at the start of a career or a role change.
- The hands-on exams carry more weight with technical hiring managers. CKA, CKAD and CKS require commands against live clusters. KCNA and KCSA are best seen as the route to them.
- KCSA has a sharper niche. Security knowledge on Kubernetes is something many teams lack, and a security credential on top of Kubernetes basics is a clear signal for platform security and DevSecOps roles.
- Pay follows the role, not the certificate. Job titles such as DevOps engineer, platform engineer, cloud security engineer and site reliability engineer determine the range far more than a beginner credential does.
To get a number for your market, search for the job titles above, read the requirements, and count how often Kubernetes, security and the exam names appear. Our best cloud computing certifications guide and best cybersecurity certifications guide can help you place these exams in a wider plan.
Cost, Bundle and Retakes
- Exam fee: USD 250 each on the Linux Foundation pages. Two exams bought separately come to USD 500.
- Bundle: the KCNA + KCSA bundle is listed at USD 425, which saves USD 75 compared with buying both. It includes 12 months of exam eligibility, one retake, a PDF certificate and a digital badge.
- Validity: the Linux Foundation pages say the certification is valid for 2 years.
- Scheduling window: you have 12 months from purchase to schedule and take the exam.
- Retakes: the individual exam pages are unclear. One section lists two exam attempts and another lists one retake. The bundle page says one retake is included. Read the retake terms at checkout before you plan around a second attempt.
- Prices change: confirm the current fee on the Linux Foundation page before booking.
If you are certain you want both, the bundle is the cheaper option. If you are unsure about KCSA, buy KCNA alone, and decide after you have seen how you did.
How to Prepare for KCNA
A sensible plan is four to six weeks for most newcomers, shorter if you already use Kubernetes.
- Week 1: containers and Kubernetes basics. Learn what an image, a container and a registry are. Install a local cluster and deploy a simple application.
- Week 2: core objects. Pods, ReplicaSets, Deployments, Services, Namespaces, ConfigMaps and Secrets. Draw how they relate.
- Week 3: orchestration. Networking, storage, scheduling and troubleshooting. Break something on purpose and fix it.
- Week 4: delivery and architecture. Deployment strategies, observability and the CNCF ecosystem. Read the names of the main projects and what each one does.
- Week 5 and 6: practice. Take timed multiple-choice sets, review every wrong answer, and go back to the topic behind it.
Our KCNA exam page shows the question style. Focus extra time on the 44% fundamentals domain, and do not skip the 12% architecture domain.
How to Prepare for KCSA
Plan on four to six weeks if you already know Kubernetes basics, and longer if you are still learning them.
- Confirm your base. If you cannot explain a Pod, a Service and a Namespace without notes, revisit KCNA material first.
- Learn the security layers. Understand how security responsibility changes across cloud, cluster, container and code.
- Study cluster components. For each control plane and node component, ask what it exposes and how you would restrict it.
- Practise the fundamentals. Write a Role and RoleBinding, a NetworkPolicy and a Pod with a security context, so the words become concrete.
- Learn the threat vocabulary. Know the common ways attackers target clusters and the reference models used to describe them.
- Revise platform and compliance topics. Supply chain, runtime security and observability, then the frameworks and standards used for compliance.
- Finish with timed practice. Review every wrong answer. Our KCSA exam page and free KCSA practice questions cover the format.
Because KCSA is newer and has fewer resources, lean on the official Linux Foundation outline and the Kubernetes security documentation. Use it as the checklist, and tick every line off.
Common Mistakes to Avoid
- Treating KCNA as too easy to study for. The 44% fundamentals domain is broad, and the questions test precise definitions.
- Skipping the architecture domain. At 12% it is small, but it is also the most predictable.
- Going into KCSA without Kubernetes basics. The security questions assume you already know what the components do.
- Memorising lists without understanding threats. KCSA tends to ask which control addresses which problem, which needs reasoning.
- Assuming the exams are hands-on. They are not. You will not get a terminal, so practise explaining concepts, not only running commands.
- Ignoring the validity window. Both certifications last 2 years, and the 12-month scheduling window starts when you buy.
A Simple Decision Framework
Answer these four questions:
- Can I explain Pods, Deployments and Services without looking them up? No points to KCNA first. Yes keeps KCSA open.
- Is my job or target job about security or compliance? Yes raises the value of KCSA. No makes KCNA the better pick.
- Do I want both? Yes means buying the bundle at USD 425 and taking KCNA first. Not sure means buying KCNA alone.
- Am I heading toward the hands-on exams? If so, KCNA then CKA, and KCSA before CKS, is a natural order.
If you are unsure, start with KCNA. It is the broader exam, it prepares you for KCSA, and it is the safer first step.
Where to Go After KCNA and KCSA
- CKA (Certified Kubernetes Administrator): the practical exam for people who run clusters. See our KCNA vs CKA comparison for how the theory exam differs from the practical one.
- CKAD: the practical exam for developers who deploy applications.
- CKS: the practical security exam, which fits naturally after KCSA and CKA. The CKA vs CKAD vs CKS guide explains the order.
- Platform comparison: if your company also runs a vendor Kubernetes platform, our OpenShift vs Kubernetes guide helps with the context.
For a broader map of cloud and security credentials, see our cybersecurity career path guide.
FAQS
Which is better, KCNA or KCSA?
Neither is better for everyone. KCNA is better if you are new to Kubernetes and want a broad foundation. KCSA is better if you already know Kubernetes basics and want to prove security knowledge. Most beginners take KCNA first.
Should I take KCNA before KCSA?
Usually yes. The Linux Foundation bundle page suggests KCNA as the starting point, and Kubernetes knowledge makes the security topics easier to understand. There is no official prerequisite, so you can go straight to KCSA if you already know the basics.
Is KCSA harder than KCNA?
It depends on your background. KCSA is harder if you have little Kubernetes experience, because it assumes you know the components and asks you to reason about threats and controls. KCNA is harder if you have no container or cloud background, because it has the larger vocabulary.
How long are the KCNA and KCSA exams?
Both are 90 minutes. Both are online, proctored and multiple-choice.
How much do KCNA and KCSA cost?
USD 250 each on the Linux Foundation pages. The KCNA + KCSA bundle is listed at USD 425, which is USD 75 less than buying both separately. Confirm the current price at checkout.
How many questions are on KCNA and KCSA?
The Linux Foundation pages do not list a question count for either exam. Some third-party guides mention about 60 questions for KCSA, but that is not confirmed on the official page, so check the current candidate handbook.
What is the passing score for KCNA and KCSA?
The Linux Foundation pages do not list a passing score for either exam. Check the candidate handbook for the current figure before you test.
How long are KCNA and KCSA valid?
The Linux Foundation pages say both certifications are valid for 2 years. Some third-party pages state a different period, so rely on the official page.
Do KCNA and KCSA have prerequisites?
No. The Linux Foundation lists no prerequisites for either exam. Both are rated beginner level, and the bundle page suggests KCNA as the starting point.
Are KCNA and KCSA hands-on exams?
No. Both are multiple-choice. The hands-on Kubernetes exams are CKA, CKAD and CKS.
Is KCNA worth it in 2026?
It is worth it if you are new to Kubernetes and want a recognised starting credential or a low-risk step toward CKA or CKAD. It matters less if you already hold a hands-on Kubernetes certificate.
Is KCSA worth it?
It is worth it if your work involves securing Kubernetes or if you are heading toward platform security roles. It also works as a stepping stone to CKS. If you only need the general Kubernetes picture, KCNA alone may be enough.
Should I buy the KCNA and KCSA bundle?
Buy the bundle if you are sure you want both, since it costs USD 425 against USD 500 for two separate exams and includes 12 months of eligibility and one retake. If you are unsure about KCSA, buy KCNA alone and decide later.
Final Thoughts
KCNA is the broad, friendly starting point, and it is the right first exam for most people. KCSA is the better second step, or a direct choice for those with Kubernetes basics and a security job. Both are beginner-level, both are multiple-choice, and both cost USD 250 on their own, so the real decision is about the subject you want to prove. Read the current exam page on the Linux Foundation’s KCSA certification page before you book, since fees, retake terms and outlines can change.
