Skip to content

KCSA Study Strategy

Study Approach

Phase 1: Security Foundations (Weeks 1-2)

  1. Cloud Native Security Model
  2. Learn the 4C's of cloud native security (Cloud, Cluster, Container, Code)
  3. Understand defense in depth and layered security
  4. Study the shared responsibility model

  5. Learn security principles: least privilege, zero trust, shift left

  6. Kubernetes Cluster Component Security

  7. API server authentication methods (certs, tokens, OIDC)
  8. Authorization modes (RBAC, Node, Webhook)
  9. Admission control pipeline (mutating, validating webhooks)
  10. etcd security (encryption at rest, TLS, access control)
  11. kubelet security configuration
  12. CIS Kubernetes Benchmark and kube-bench

Phase 2: Security Mechanisms (Weeks 2-3)

  1. RBAC Deep Dive
  2. Roles, ClusterRoles, RoleBindings, ClusterRoleBindings
  3. Subjects: users, groups, service accounts
  4. Least privilege principles and audit practices

  5. Common misconfigurations and their consequences

  6. Pod Security and Network Policies

  7. Pod Security Standards levels (Privileged, Baseline, Restricted)
  8. Pod Security Admission modes (enforce, audit, warn)
  9. Security context fields and their effects
  10. Network Policy default-deny patterns

  11. Label-based traffic selection

  12. Secrets and Service Accounts

  13. Kubernetes Secrets management and encryption at rest
  14. Service account token security
  15. automountServiceAccountToken settings
  16. External secret management concepts

Phase 3: Threats, Platform, and Compliance (Weeks 3-4)

  1. Threat Modeling
  2. STRIDE threat model for Kubernetes
  3. Common attack vectors and lateral movement
  4. Container escape techniques and mitigations
  5. Supply chain attack patterns

  6. Trust boundaries in Kubernetes

  7. Platform Security

  8. Image security and vulnerability scanning
  9. Runtime security tools (Falco)
  10. Container runtime sandboxes (gVisor, Kata)
  11. Admission controllers for policy enforcement

  12. Image signing and verification (cosign)

  13. Compliance Frameworks

  14. CIS Kubernetes Benchmark categories
  15. NIST Cybersecurity Framework functions
  16. Audit logging for compliance evidence

  17. Policy as code concepts

  18. Practice Exams

  19. Take practice tests and review wrong answers
  20. Focus on highest-weighted domains (22% each for Domains 2 and 3)
  21. Review terminology and definitions

Study Resources

Primary Resources

Supplementary Resources

Community and Forums

  • r/kubernetes - Reddit community for discussions
  • CNCF Slack - Community channels
  • Kubernetes Security SIG - Security Special Interest Group

Video Courses

  1. KodeKloud KCSA - Comprehensive with practice tests
  2. Udemy KCSA Courses - Multiple options available
  3. CNCF YouTube - Security-focused talks and webinars

Exam Tactics

Time Management (90 minutes, 60 questions)

  • Average 1.5 minutes per question
  • Answer confident questions first (under 1 minute each)
  • Flag uncertain questions for review
  • Reserve 10-15 minutes for flagged questions
  • Do not spend more than 2 minutes on any question in the first pass

Question Strategy

  1. Read the full question before looking at answers
  2. Eliminate wrong answers - remove obviously incorrect options
  3. Look for security principle violations - answers that violate least privilege, defense in depth, or zero trust are usually wrong
  4. Choose the most secure option - when in doubt, pick the answer that follows security best practices
  5. Watch for absolutes - "always" and "never" statements are often incorrect
  6. Consider the 4C's - identify which security layer the question is about

Domain Prioritization

  • Cluster Component Security (22%) and Security Fundamentals (22%) together are 44% of the exam - make these your primary focus
  • Threat Model (16%) and Platform Security (16%) are 32% combined
  • Cloud Native Security Overview (14%) and Compliance (10%) are 24% combined

Common Pitfalls

Study Mistakes

  • Focusing on hands-on only - This is a knowledge exam. Hands-on helps understanding but the exam tests conceptual knowledge
  • Ignoring compliance frameworks - 10% of the exam covers CIS, NIST, and other frameworks
  • Not studying threat modeling - Understanding attack vectors is critical for 16% of the exam
  • Memorizing without understanding - Focus on why security controls exist, not just what they are

Content Mistakes

  • Confusing authentication (who are you?) with authorization (what can you do?)
  • Not understanding the admission control pipeline order (mutating then validating)
  • Mixing up Pod Security Standards levels (Baseline blocks known escalations, Restricted is full hardening)
  • Confusing RBAC scope (Role/RoleBinding for namespace, ClusterRole/ClusterRoleBinding for cluster)
  • Not knowing which 4C layer a security control belongs to

Progress Tracking

Self-Assessment Questions

After each study phase, verify you can answer these without references:

Phase 1: - Can I describe the 4C's model and give examples of controls at each layer? - Do I know all API server authentication and authorization methods? - Can I explain what the CIS Kubernetes Benchmark covers? - Do I understand etcd security requirements?

Phase 2: - Can I explain all RBAC components and their relationships? - Do I know the three PSA levels and three PSA modes? - Can I describe Network Policy default-deny patterns? - Do I understand service account security best practices?

Phase 3: - Can I apply STRIDE to Kubernetes attack scenarios? - Do I know common Kubernetes attack vectors and mitigations? - Can I explain CIS Benchmark categories and NIST Framework functions? - Am I scoring 80%+ on practice exams?

Readiness Indicators

You are ready for the exam when: - [ ] You can explain the 4C's model and place controls in the correct layer - [ ] You understand RBAC, PSA, and Network Policies deeply - [ ] You can describe Kubernetes threat vectors and mitigations - [ ] You know CIS Benchmark and NIST Framework basics - [ ] You score 80%+ consistently on practice exams