KCNA Exam Format and Domain Weights

Orientation / Guide 1 of 46 / Beginner

• Kubernetes1.36.4
• kubectlv1.35.2 (one minor behind, deliberately)
• containerdv2.2.6
• OSUbuntu 26.04 LTS
• TimeAbout 12 min
• Reviewed22 August 2026

Written against the versions above. Domain weights come from the published KCNA curriculum. Check the current one before you book - the Linux Foundation revises it.

Before you start

• No prior Kubernetes experience assumed. That is the point of KCNA.
• A cluster is optional for this guide and required for the rest of the path.

1. 1

   Four domains, unevenly weighted

   KCNA is a multiple-choice exam, 90 minutes, and unlike CKA there is no live cluster to operate. That changes what preparation means: you are not drilling speed, you are building a vocabulary broad enough that nothing in the ecosystem is a surprise.

   The published weights, which changed on 24 November 2025 - if you are revising from anything older you will see five domains and a different split:

   | Domain | Weight | Competencies | |---|---|---| | Kubernetes Fundamentals | 44% | Core concepts, administration, scheduling, containerization | | Container Orchestration | 28% | Networking, security, troubleshooting, storage | | Cloud Native Application Delivery | 16% | Application delivery, debugging | | Cloud Native Architecture | 12% | Observability, ecosystem and principles, community and collaboration |

   Nearly half the exam is Kubernetes fundamentals. That is the practical headline: if Pods, Deployments, Services, ConfigMaps and the API model are solid, you are close to halfway there. Container orchestration is the next 28%, and it is where the exam gets specific - networking, storage, security and troubleshooting, each with its own vocabulary.

   Two things about that table are worth noticing. Observability used to be a domain of its own at 8%; it is now one competency inside a 12% domain, so it is worth less than it looks in older study guides. And cluster installation appears nowhere at any weight - that is CKA's territory. You need a cluster to run commands against, not the ability to build one.

   The 44% is not abstract, either. It is very nearly these two API groups: the core group and apps. Every object in the largest domain is in that list.

   $kubectl --context cka1001 api-resources --api-group='' --no-headers | awk '{print $1}' | tr '\n' ' 'bindings componentstatuses configmaps endpoints events limitranges namespaces nodes persistentvolumeclaims persistentvolumes pods podtemplates replicationcontrollers resourcequotas secrets serviceaccounts services$kubectl --context cka1001 api-resources --api-group=apps --no-headers | awk '{print $1}' | tr '\n' ' 'controllerrevisions daemonsets deployments replicasets statefulsets

   Expected resultThe core group - Pods, Services, ConfigMaps, Secrets, Namespaces, Nodes - and the five workload controllers in apps.

   Success conditionYou can read the largest exam domain as a list of API resources.

2. 2

   How much surface area there is

   Two numbers make the scope concrete. This cluster answers for 161 API resource types, of which 71 are CustomResourceDefinitions - added by Calico, the Prometheus Operator, Argo CD and the CSI drivers.

   So more than 40% of what this cluster knows about is not Kubernetes at all. It is the ecosystem, installed on top. That ratio is the best argument for why "Cloud Native" is a separate exam domain from "Kubernetes": in any real cluster, most of the API is other people's software.

   It is also a warning about study material. A tutorial written against a bare cluster describes maybe a third of what you will actually meet.

   $kubectl --context cka1001 api-resources --no-headers | wc -l161$kubectl --context cka1001 get crd --no-headers | wc -l71$kubectl --context cka1001 api-versions | head -8admissionregistration.k8s.io/v1apiextensions.k8s.io/v1apiregistration.k8s.io/v1apps/v1argoproj.io/v1alpha1authentication.k8s.io/v1authorization.k8s.io/v1autoscaling/v1

   Expected resultA resource-type count around 160, a CRD count around 70, and API groups including third-party ones like argoproj.io.

   Success conditionYou can see how much of the API surface came from installed software.

3. 3

   Where KCNA sits among the five

   There are five Kubernetes certifications and they are not a ladder:

   • KCNA - associate, multiple choice. Breadth across the ecosystem.
   • KCSA - associate, multiple choice. Security concepts and threat models.
   • CKA - performance based. Operate and repair a cluster.
   • CKAD - performance based. Build and ship workloads onto one.
   • CKS - performance based, requires CKA. Harden one under attack.

   KCNA before CKA is a reasonable order but not a requirement, and it is not a prerequisite for anything. Its real value is different: it forces you to learn the *names* - what Argo does, what a service mesh is for, what OpenTelemetry collects - which makes every later exam's material land faster because you already know where each piece fits.

   What KCNA will not do is make you able to fix a cluster. That is CKA, and no amount of multiple choice substitutes for having broken and repaired one yourself.

   One last look at where the ecosystem actually comes from: group the 71 CRDs by the top level of their domain and you get 33 under .io, 28 under .org, 10 under .com. Every one is a vendor or project that agreed to extend the same API rather than build a parallel one. That agreement is what "cloud native" names.

   $kubectl --context cka1001 get crd --no-headers | awk '{print $1}' | sed 's/.*\.//' | sort | uniq -c | sort -rn | head -6     33 io     28 org     10 com

   Expected resultCRD counts grouped by domain suffix.

   Success conditionYou can see how many distinct third parties extended this cluster.

Official sources

• KCNA certification page
• CNCF certification overview
• Kubernetes API concepts