KCSA in the Kubernetes Certification Path
This site teaches KCNA, KCSA and CKS. They overlap, and a reader deciding which to sit deserves numbers rather than adjectives. This guide counts twelve security subjects across all three shipped pools and reads off what each exam actually wants.
Orientation Guide 2 of 42 Beginner
- Kubernetesapiserver v1.36.4, kubelet v1.36.3
- Runtimecontainerd 2.2.6
- CNICilium 1.18.1 - tunnel/VXLAN, with Hubble relay and UI
- Host OSUbuntu 26.04 LTS, kernel 7.0.0-29
- Built withkubeadm v1.36.3 - podSubnet 10.244.0.0/16, serviceSubnet 10.96.0.0/12
- TimeAbout 10 min
- Reviewed25 August 2026
Written against the versions above. Keyword counts across the three shipped pools - KCSA 889, KCNA 712, CKS 871 questions. A keyword count is a blunt instrument: it matches a term anywhere in a question, its options or its explanation. Read the columns as proportions.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA5001 | 192.168.0.41 | Ubuntu 26.04 LTS | Control Plane Node (tainted NoSchedule) | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE01 | 192.168.0.42 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE02 | 192.168.0.43 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE03 | 192.168.0.44 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
Before you start
- guide 1 - the domain weights this builds on.
-
Twelve subjects, three exams
Count them rather than trusting the level names.
bash Example session cd ~/kcsamock && python3 overlap.py topic KCSA KCNA CKS ------------------------------ -------- -------- -------- RBAC / authorization 268 30.1% 35 4.9% 155 17.8% NetworkPolicy 116 13.0% 38 5.3% 99 11.4% Pod Security 235 26.4% 11 1.5% 221 25.4% Secrets 244 27.4% 46 6.5% 144 16.5% etcd 175 19.7% 91 12.8% 79 9.1% admission control 184 20.7% 27 3.8% 166 19.1% image signing / supply chain 71 8.0% 7 1.0% 142 16.3% seccomp / AppArmor 41 4.6% 1 0.1% 75 8.6% audit logging 91 10.2% 2 0.3% 92 10.6% threat model / attacker 285 32.1% 4 0.6% 149 17.1% CIS benchmark 47 5.3% 0 0.0% 59 6.8% service mesh / mTLS 26 2.9% 15 2.1% 34 3.9% pool sizes: KCSA 889, KCNA 712, CKS 871 KCSA is the security half of KCNA taken seriously, and CKS is the same subjectsagain as things you have to DO on a live cluster rather than recognise.Expected resultThreat model 32.1% KCSA / 0.6% KCNA / 17.1% CKS. RBAC 30.1 / 4.9 / 17.8. Pod Security 26.4 / 1.5 / 25.4. Supply chain 8.0 / 1.0 / 16.3. seccomp and AppArmor 4.6 / 0.1 / 8.6.
Success conditionYou can choose between the three on evidence.
Troubleshooting
Unsure whether to sit KCNA first.
Why: The names suggest a ladder.
Fix:KCNA is Kubernetes literacy, not security. Useful first if Kubernetes is new to you.
Planning CKS without a CKA.
Why: CKS requires an active CKA to certify.
Fix:The certificate cannot be issued without it. Sit CKA first.
Studying seccomp and AppArmor hard for KCSA.
Why: They are security topics, so they feel central.
Fix:4.6% of KCSA. They are 8.6% of CKS, where you have to write the profiles.