KCNA Exam Format and Domain Weights

Orientation / Guide 1 of 46 / Beginner

• Kubernetes1.36.4
• Cluster4 nodes
• Runtimecontainerd 2.2.6
• CNICalico v3.32.1
• TimeAbout 12 min

Curriculum note: Domain weights come from the published KCNA curriculum. Check the current Linux Foundation outline before booking, because exam domains can change.

• kubectlv1.35.2

This guide includes

Use this before booking KCNA, while you are deciding how much Kubernetes to learn and in what order. This matters because KCNA is deliberately broad and shallow - one domain is nearly half the exam and there is no live cluster to fix, so preparing for it is building vocabulary rather than drilling speed.

• reading the current KCNA domain weights and seeing why Kubernetes fundamentals matter most
• listing the core Kubernetes API resources and the five apps workload controllers
• counting the API surface this cluster answers for, including CRDs from installed software
• finding third-party API groups such as argoproj.io
• seeing where KCNA fits beside KCSA, CKA, CKAD, and CKS

Before you start

• No prior Kubernetes experience assumed. That is the point of KCNA.
• A cluster is optional for this guide and required for the rest of the path.

1. 1

   Four domains, unevenly weighted

   KCNA is a multiple-choice exam, 90 minutes, and unlike CKA there is no live cluster to operate. That changes what preparation means: you are not drilling speed, you are building a vocabulary broad enough that nothing in the ecosystem is a surprise.

   The published weights, which changed on 24 November 2025 - if you are revising from anything older you will see five domains and a different split:

   Domain	Weight	Competencies
   Kubernetes Fundamentals	44%	Core concepts, administration, scheduling, containerization
   Container Orchestration	28%	Networking, security, troubleshooting, storage
   Cloud Native Application Delivery	16%	Application delivery, debugging
   Cloud Native Architecture	12%	Observability, ecosystem and principles, community and collaboration

   Nearly half the exam is Kubernetes fundamentals. That is the practical headline: if Pods, Deployments, Services, ConfigMaps and the API model are solid, you are close to halfway there. Container orchestration is the next 28%, and it is where the exam gets specific - networking, storage, security and troubleshooting, each with its own vocabulary.

   Two things about that table are worth noticing. Observability used to be a domain of its own at 8%; it is now one competency inside a 12% domain, so it is worth less than it looks in older study guides. And cluster installation appears nowhere at any weight - that is CKA's territory. You need a cluster to run commands against, not the ability to build one.

   The 44% is not abstract, either. It is very nearly these two API groups: the core group and apps. Every object in the largest domain is in that list.

   $kubectl --context cka1001 api-resources --api-group='' --no-headers | awk '{print $1}' | tr '\n' ' 'bindings componentstatuses configmaps endpoints events limitranges namespaces nodes persistentvolumeclaims persistentvolumes pods podtemplates replicationcontrollers resourcequotas secrets serviceaccounts services$kubectl --context cka1001 api-resources --api-group=apps --no-headers | awk '{print $1}' | tr '\n' ' 'controllerrevisions daemonsets deployments replicasets statefulsets

   Expected resultThe core group - Pods, Services, ConfigMaps, Secrets, Namespaces, Nodes - and the five workload controllers in apps.

   Success conditionYou can read the largest exam domain as a list of API resources.

2. 2

   How much surface area there is

   Two numbers make the scope concrete. This cluster answers for 161 API resource types, of which 71 are CustomResourceDefinitions - added by Calico, the Prometheus Operator, Argo CD and the CSI drivers.

   So more than 40% of what this cluster knows about is not Kubernetes at all. It is the ecosystem, installed on top. That ratio is the best argument for why "Cloud Native" is a separate exam domain from "Kubernetes": in any real cluster, most of the API is other people's software.

   It is also a warning about study material. A tutorial written against a bare cluster describes maybe a third of what you will actually meet.

   $kubectl --context cka1001 api-resources --no-headers | wc -l161$kubectl --context cka1001 get crd --no-headers | wc -l71$kubectl --context cka1001 api-versions | head -8admissionregistration.k8s.io/v1apiextensions.k8s.io/v1apiregistration.k8s.io/v1apps/v1argoproj.io/v1alpha1authentication.k8s.io/v1authorization.k8s.io/v1autoscaling/v1

   Expected resultA resource-type count around 160, a CRD count around 70, and API groups including third-party ones like argoproj.io.

   Success conditionYou can see how much of the API surface came from installed software.

3. 3

   Where KCNA sits among the five

   There are five Kubernetes certifications and they are not a ladder:

   • KCNA - associate, multiple choice. Breadth across the ecosystem.
   • KCSA - associate, multiple choice. Security concepts and threat models.
   • CKA - performance based. Operate and repair a cluster.
   • CKAD - performance based. Build and ship workloads onto one.
   • CKS - performance based, requires CKA. Harden one under attack.

   KCNA before CKA is a reasonable order but not a requirement, and it is not a prerequisite for anything. Its real value is different: it forces you to learn the *names* - what Argo does, what a service mesh is for, what OpenTelemetry collects - which makes every later exam's material land faster because you already know where each piece fits.

   What KCNA will not do is make you able to fix a cluster. That is CKA, and no amount of multiple choice substitutes for having broken and repaired one yourself.

   One last look at where the ecosystem actually comes from: group the 71 CRDs by the top level of their domain and you get 33 under .io, 28 under .org, 10 under .com. Every one is a vendor or project that agreed to extend the same API rather than build a parallel one. That agreement is what "cloud native" names.

   $kubectl --context cka1001 get crd --no-headers | awk '{print $1}' | sed 's/.*\.//' | sort | uniq -c | sort -rn | head -6     33 io     28 org     10 com

   Expected resultCRD counts grouped by domain suffix.

   Success conditionYou can see how many distinct third parties extended this cluster.

Troubleshooting

• Assuming KCNA has to be passed before CKA.

  Why: The associate and professional naming makes the five certifications look like a ladder.

  Fix:It is not a prerequisite for anything. Step 3 lists all five and only CKS has a requirement - it needs CKA. KCNA before CKA is a reasonable order, not a required one.

• Preparing by drilling kubectl against a live cluster.

  Why: Every other Kubernetes certification is performance based, so people assume this one is too.

  Fix:KCNA is multiple choice, 90 minutes, with no cluster to operate. Step 1 says so directly: you are building a vocabulary broad enough that nothing in the ecosystem is a surprise, not drilling speed.

• Revision material showing five domains, or a different weighting.

  Why: The published weights changed on 24 November 2025, and older material was never updated.

  Fix:Anything older shows five domains and a different split. The table in step 1 is the post-change version - check the current Linux Foundation outline before booking, because it can move again.

Official sources

• KCNA certification page
• CNCF certification overview
• Kubernetes API concepts