From Pods to Policies Your KCSA Prep Starts Now

Take on 25 practice questions across six KCSA domains
Start Free Practice
No Credit Card Required
HOW TO PREPARE

Everything You Need to Know First

Warm-up topics before the test.
  • Kubernetes Fundamentals: Familiarity with Pods, Deployments, Services, and cluster architecture. KCNA-level knowledge helps.
  • Core Security Concepts: General understanding of authentication, authorization, encryption, and least privilege.
  • Linux Command Line Basics: Comfort with shell navigation, file permissions, and processes.
PRACTICE TEST

Put Your Knowledge to the Test

25 multiple-choice questions, including ones built around command output
During threat modeling, a team categorizes threats as spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Which model is it using?
DREAD.
CIS Benchmarks.
STRIDE.
MITRE ATT&CK.
C
STRIDE organizes threats into six categories. It supports structured threat modeling, while configuration benchmarks provide a different kind of security guidance.
Compliance and Security Frameworks
25
Select One
A team wants a published baseline of security configuration recommendations for Kubernetes and plans to assess its cluster against it. Which resource most directly matches this need?
The CIS Kubernetes Benchmark.
An application's software bill of materials.
MITRE ATT&CK techniques alone.
The SLSA provenance specification.
A
CIS Benchmarks provide configuration recommendations that can inform hardening assessments. Passing a benchmark is not equivalent to satisfying every applicable compliance obligation.
Compliance and Security Frameworks
24
Select One
What does verifiable build provenance primarily help establish about an artifact?
That no runtime security controls are needed.
That any image using the same tag has identical content.
That the artifact contains no vulnerabilities of any kind.
How and from which inputs it was built, and which builder produced it.
D
Provenance describes an artifact's production history, including inputs and builder information. Verification and trust in the builder are essential; provenance does not prove the software is vulnerability-free.
Platform Security
23
Select One
A cluster must reject workload creation unless images meet an organization's approved-signature policy. Where should a policy-enforcement component evaluate the creation request before persistence?
Only in the DNS resolver.
Only in a container's readiness endpoint.
In admission control, using a suitable validating policy or webhook integration.
Only in a dashboard after the Pod has already run.
C
Admission controls inspect eligible API requests before persistence and can reject policy violations. Image-signature verification requires an appropriate implementation and trust configuration; it is not automatic for every cluster.
Platform Security
22
Select One
A team requires both client and server workloads to authenticate each other and encrypt traffic between them. Which capability directly supports this?
A public container registry.
Mutual TLS with correctly issued and validated workload certificates.
Base64 encoding request bodies.
A NetworkPolicy alone.
B
mTLS combines encrypted transport with certificate-based authentication of both peers. Network policy and authorization remain separate controls; mTLS alone does not define every allowed business operation.
Platform Security
21
Select One
An approved container image tag can be moved to a different image later. Which deployment reference identifies the exact image content?
An image digest.
Only the container's display name.
A floating latest tag.
Only the registry hostname.
A
A digest identifies content and avoids the mutability of a tag. Digest pinning alone does not verify that the publisher or build process is trusted.
Platform Security
20
Select One
An attacker steals a service-account token that is bound to cluster-admin. What makes this more dangerous than stealing a narrowly scoped token?
The attacker can only read that Pod's local logs.
Cluster-admin makes the token impossible to revoke.
The stolen identity can be used for broad authorized API actions until the credential is invalidated or access is removed.
The token automatically decrypts all external cloud-provider credentials.
C
A credential inherits the permissions of its identity. Excessive RBAC permissions amplify the impact of theft, which is why least privilege and short-lived credentials matter.
Kubernetes Threat Model
19
Select One
One tenant repeatedly creates resource-hungry workloads in its namespace. Which control can limit aggregate requested CPU and memory for that namespace?
A ConfigMap containing a recommended limit.
A Service with type ClusterIP.
A readiness probe alone.
A ResourceQuota covering CPU and memory requests.
D
ResourceQuota constrains namespace-level aggregate resource requests. It complements per-container limits and other controls; it does not eliminate every denial-of-service risk.
Kubernetes Threat Model
18
Select One
A workload never calls the Kubernetes API. The team wants to reduce exposure if the container is compromised. Which Pod setting avoids automatic mounting of its service-account API token?
imagePullPolicy: Always
restartPolicy: Always
automountServiceAccountToken: false
hostPID: true
C
Disabling automatic token mounting removes an unnecessary credential from the Pod. It does not delete the service account or revoke other credentials the workload might receive.
Kubernetes Threat Model
17
Select One
A compromised Pod runs privileged and mounts the host root filesystem with write access. Which risk is most directly increased?
Only disclosure of the Pod's labels.
Host compromise and escape from the intended container isolation boundary.
Automatic encryption of host files by Kubernetes.
A guarantee that the attack stays within its namespace.
B
Privileged execution and writable host filesystem access expose host-level capabilities. Namespace membership does not contain these privileges.
Kubernetes Threat Model
16
Select One
An administrator needs a record of who made Kubernetes API requests, what resources they targeted, and when. Which feature should be configured?
Only an image vulnerability scan.
Kubernetes audit logging with an appropriate policy and backend.
Only container standard-output logs.
Only a kube-scheduler CPU metric.
B
Audit records capture API activity according to policy. Container logs and metrics do not replace an API audit trail, and audit policy must avoid unnecessary sensitive payload exposure.
Kubernetes Security Fundamentals
15
Select One
A container must not gain more privileges than its parent process through mechanisms such as set-user-ID binaries. Which securityContext setting directly addresses this?
readOnlyRootFilesystem: false
allowPrivilegeEscalation: false
hostNetwork: true
privileged: true
B
allowPrivilegeEscalation controls whether a process can gain more privileges than its parent. It is distinct from making the root filesystem read-only or assigning a non-root UID.
Kubernetes Security Fundamentals
14
Select One
A namespace has a policy-enforcing network plugin. A NetworkPolicy selects all its Pods, lists only Ingress under policyTypes, and has no ingress allow rules. No other policy allows ingress. What does this policy establish for ordinary Pod-to-Pod traffic?
Encryption of all traffic to the selected Pods.
Default-deny ingress to the selected Pods, without imposing egress isolation.
Permission for all ingress because the rule list is empty.
Default-deny ingress and egress automatically.
B
Ingress and egress isolation are separate. The specified policy denies ordinary incoming Pod traffic but does not itself restrict outgoing traffic. Standard NetworkPolicy has documented special cases, including node-related traffic.
Kubernetes Security Fundamentals
13
Select One
A namespace uses built-in Pod Security Admission with enforce=restricted. A new Pod violates the selected Restricted policy version and no exemption applies. What happens?
The Pod admission request is rejected.
The Pod is admitted and only a warning is shown.
The Pod is admitted but its image is automatically rebuilt.
The scheduler silently grants it elevated privileges.
A
Enforce mode rejects violating Pods. Warn and audit modes serve different purposes, and policy versions and exemptions affect which checks apply.
Kubernetes Security Fundamentals
12
Select One
An engineer says Secret values are secure because the YAML data field is base64-encoded. What is the correct response?
Base64 is reversible encoding; access controls and appropriate encryption are still required.
Base64 encrypts values using an unguessable private key.
Anyone with get access to the Secret can see only a one-way hash.
Changing a ConfigMap's name to Secret enables encryption.
A
A reader can decode base64. Protect Secret access and configure encryption where required; the object type and encoding do not by themselves provide complete protection.
Kubernetes Security Fundamentals
11
Select One
A service account must read ConfigMaps only in namespace team-a. Which RBAC arrangement best matches the requirement?
A Role granting only needed ConfigMap read verbs in team-a, bound to the service account by a RoleBinding there.
A cluster-admin ClusterRoleBinding.
A NetworkPolicy permitting traffic to every Pod.
A ClusterRoleBinding granting all verbs on all resources.
A
A namespaced Role and binding can scope permission to the required resource and verbs. NetworkPolicy controls traffic, not Kubernetes API authorization.
Kubernetes Security Fundamentals
10
Select One
An application Pod is given access to the node's container runtime socket. What is the main security concern?
The socket only permits reading the Pod's own standard output.
It may gain powerful control over the host's containers and undermine workload isolation.
The socket automatically enforces the application's namespace RBAC policy.
The socket guarantees the application cannot create additional containers.
B
A runtime socket exposes a privileged control interface. API-server RBAC is not a substitute for restricting direct access to node-level runtime interfaces.
Kubernetes Cluster Component Security
9
Select One
An attacker can directly read an unprotected etcd backup. Why is this serious even if ordinary users have restrictive Kubernetes RBAC permissions?
A namespace boundary blocks operating-system access to backup files.
etcd backups contain only public container image names.
RBAC automatically encrypts every backup file.
The backup can contain sensitive cluster data, and direct backup access bypasses API-server RBAC checks.
D
RBAC governs Kubernetes API requests, not direct access to backup bytes. Secure etcd data, backups, and any associated encryption keys as sensitive assets.
Kubernetes Cluster Component Security
8
Select One
A team wants Kubernetes Secret data encrypted when the API server writes it to etcd. Which control directly provides this?
Base64-encode values before submitting the Secret.
Set imagePullPolicy: Always on the consuming Pod.
Rename the Secret to include encrypted.
Configure API-server encryption at rest for Secrets with an appropriate encryption provider.
D
API-server encryption configuration controls encryption of selected stored API data. Base64 is encoding, not encryption. Existing data must be rewritten as required to receive the new at-rest protection.
Kubernetes Cluster Component Security
7
Select One
Administrators discover that the kubelet HTTPS API permits unauthenticated requests. Which change directly addresses that exposure?
Change every Deployment to a StatefulSet.
Enable a namespace ResourceQuota only.
Add a Service annotation containing the word private.
Disable anonymous authentication and configure appropriate kubelet authentication and authorization.
D
The kubelet exposes sensitive node operations. Its own authentication, authorization, and network access must be secured; workload objects do not repair an exposed kubelet API.
Kubernetes Cluster Component Security
6
Select One
A user presents valid credentials to the API server but is not allowed to delete a Deployment. Which stage decides whether that authenticated user may perform the requested action?
Authentication only.
Pod scheduling.
Authorization.
Container image download.
C
Authentication establishes identity. Authorization decides whether that identity may perform an action on the resource. Admission checks can additionally assess an otherwise authorized request.
Kubernetes Cluster Component Security
5
Select One
Why should a team avoid treating ordinary containers as having the same isolation boundary as separate virtual machines?
Container image tags enforce hardware isolation.
Namespaces eliminate every possible container escape.
Ordinary containers share the host kernel, so kernel and runtime weaknesses can affect the isolation boundary.
Every container has a separate physical CPU.
C
Ordinary Linux containers share a kernel. Isolation controls reduce risk but do not make kernel vulnerabilities or runtime misconfiguration irrelevant.
Overview of Cloud Native Security
4
Select One
A CI pipeline scans container image packages for known vulnerabilities. What is an accurate interpretation of a clean result?
The image contains no malicious behavior.
The image's publisher identity has been cryptographically verified.
The image cannot be exploited at runtime.
No matching known vulnerabilities were found by that scan; the image is not thereby proven free of all security risks.
D
Vulnerability scans depend on coverage and vulnerability knowledge. They do not prove absence of malicious code or establish trusted provenance or signatures.
Overview of Cloud Native Security
3
Select One
A team scans images but leaves the Kubernetes API publicly accessible with excessive permissions. Which principle best explains why image scanning is insufficient?
Defense in depth requires controls across infrastructure, cluster, workload, and code layers.
One security control always protects every trust boundary.
Application security makes cluster authorization unnecessary.
A clean image scan replaces API authentication.
A
Different controls address different attack paths. Image vulnerability scanning cannot substitute for identity, authorization, and infrastructure protections.
Overview of Cloud Native Security
2
Select One
In the 4Cs model of cloud native security, which sequence moves from the outer infrastructure layer toward application internals?
Cloud → Cluster → Container → Code.
Cluster → Cloud → Code → Container.
Code → Container → Cluster → Cloud.
Cloud → Container → Code → Cluster.
A
The 4Cs describe nested security layers. Securing application code does not remove the need to secure its container, cluster, and underlying infrastructure.
Overview of Cloud Native Security
1
Select One
DOMAIN Question 01/00

0 of 0 answered

A Course Built Around Your Needs

Kubernetes and Cloud Native Security Associate (KCSA)

Beginner
Associate
Professional
06.48
Hours
Play icon
Prepare for KCSA certification: 4Cs security, cluster components, fundamentals, threat model, platform, compliance, and more.
Mumshad Mannambeth
Details
WHY HANDS-ON PRACTICE

Knowledge, Earned by Doing

The KCSA rewards security fluency, not memorized syntax.

Build Real Exam Speed

KCSA gives you about 90 seconds per question on average. Repeated practice trains you to recognize threat patterns fast, so you're not re-reading scenarios under time pressure.

Know Your Weak Domains

‍Review every question you missed and spot the topics that need more work. Better to find them here than on exam day.

Realistic Scenario Questions

‍Exam-style questions, in the multiple-choice format you'll see on the real test.

‍

Reduce Exam-Day Anxiety  

Familiarity with multiple-choice format removes surprises, so nerves don't cost you marks.

Reinforce Through Repetition

Spaced repetition on frequently tested concepts, like RBAC, NetworkPolicies, and Pod Security Standards, moves them from look it up to just know it.

‍

Benchmark Against a Passing Score‍

Compare your score with the KCSA’s 75% passing threshold and identify topics to review before exam-day.

HEAR FROM OUR LEARNERS

Real Learners. Real Results

Alhamdulillah 🙏! Thrilled to announce that I am now officially a Certified Kubernetes Administrator (CKA)! While Kubernetes, cluster orchestration, and container security are already central to my daily DevSecOps work, earning this certification is a great validation of those hands-on skills.Thanks to Mumshad Mannambeth and the KodeKloud team—their course and hands-on labs helped me a lot in preparing for this exam.The learning never stops! 🚀

Read Full Post
Imtiaz Ali
DevOps | SRE | Multi-Cloud | DevSecOps

Freshly certified: Certified Kubernetes Administrator (CKA)! 🚀Passing this hands-on, live-terminal exam was a great challenge. Paired with my AWS Certified DevOps Engineer – Professional, it reinforces my focus on bridging enterprise multi-account cloud governance with production-grade Kubernetes runtime operations.A special shoutout and big thank you to Mumshad Mannambeth, the KodeKloud team, and the Cloud Native Computing Foundation (CNCF) and Kubernetes (Official) community. The Certified Kubernetes Administrator (CKA) course was hands-down the best preparation for the live terminal environment! 🛠️Next stop: continuing to build resilient, developer-first platform foundations!

Read Full Post
Gaurav Dubey
Cloud Architect | Platform Engineer | AWS DevOps Pro | CKA

Cherishing one of my dreams - CKS Certified! ✨Last year, in October, when I cracked my CKA, my colleagues asked, “When is CKS?” 😂And I was like… bro. 😅Because it felt so much bigger. I also knew it wasn’t just Kubernetes anymore, but Kubernetes with a special layer of security - yeah, tightened Kubernetes.Back then, I used to look up to CKS like a child gazing at one of the stars in the sky.⭐Now, fast forward to today - I cleared it last week and officially became a Certified Kubernetes Security Specialist (CKS), thanks to the Cloud Native Computing Foundation (CNCF), The Linux Foundation and my company Aivar Innovations. 🎉That moment felt so special, and I’m incredibly grateful to all my colleagues, friends, and family for all the support. ❤️A mention of the resources I used: KodeKloud by Mumshad Mannambeth and Kim Wüstkamp’s CKS courses. I also had my colleagues supporting me with my doubts and anxieties before the exam. 😂Looking forward to applying everything I’ve learned in my work and continuing to grow in the Cloud Native and Kubernetes space. 🚀So, cheers to everyone who dreams, aspires, and inspires. Keep going and keep up the good work! 🥂And as I always say - God, keep it coming!! ✨

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast

I've successfully passed CKA certification. Shout-out to Mumshad Mannambeth for his great CKA course and labs and to Omkar Shelke Killercoda CKA scenarios. Links: - https://lnkd.in/eZPVHJeR- https://lnkd.in/eEVyZdaZ

Read Full Post
Gabriel Rodríguez
DevSecOps Engineer

🎉 The Kubernetes journey continues… and this time, happy to say I’m officially a Kubestronaut! 🧑🚀🚀🎖️ 1 out of 242 in France and 1 out of 4217 worldwide!⏳✈️ It’s been quite a journey. From my early days working with Kubernetes, thanks to the opportunity Prof. Timur Friedman gave me to contribute to the EdgeNet project, to securing my internship as a DevOps Engineer at Sonos, Inc. — and fast-forward five years, here I am today, a Senior DevOps Engineer at Sonos, Inc. working extensively with Kubernetes everyday.💌 A special thank you to Jose Alfredo Alvarez Aldana for your support, guidance, and for everything you taught me along the way. I was really lucky to have the opportunity to work alongside you early in my journey. 🙏💯 A big thank you to Mumshad Mannambeth for building KodeKloud! The platform has been incredibly helpful throughout this journey, both for learning and preparing for the exams.And of course, shout out to all the people who supported, challenged, and inspired me along the way. ❤️Never give up 💪Keep smiling 😃

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast

Alhamdulillah 🙏! Thrilled to announce that I am now officially a Certified Kubernetes Administrator (CKA)! While Kubernetes, cluster orchestration, and container security are already central to my daily DevSecOps work, earning this certification is a great validation of those hands-on skills.Thanks to Mumshad Mannambeth and the KodeKloud team—their course and hands-on labs helped me a lot in preparing for this exam.The learning never stops! 🚀

Read Full Post
Imtiaz Ali
DevOps | SRE | Multi-Cloud | DevSecOps

Freshly certified: Certified Kubernetes Administrator (CKA)! 🚀Passing this hands-on, live-terminal exam was a great challenge. Paired with my AWS Certified DevOps Engineer – Professional, it reinforces my focus on bridging enterprise multi-account cloud governance with production-grade Kubernetes runtime operations.A special shoutout and big thank you to Mumshad Mannambeth, the KodeKloud team, and the Cloud Native Computing Foundation (CNCF) and Kubernetes (Official) community. The Certified Kubernetes Administrator (CKA) course was hands-down the best preparation for the live terminal environment! 🛠️Next stop: continuing to build resilient, developer-first platform foundations!

Read Full Post
Gaurav Dubey
Cloud Architect | Platform Engineer | AWS DevOps Pro | CKA

Cherishing one of my dreams - CKS Certified! ✨Last year, in October, when I cracked my CKA, my colleagues asked, “When is CKS?” 😂And I was like… bro. 😅Because it felt so much bigger. I also knew it wasn’t just Kubernetes anymore, but Kubernetes with a special layer of security - yeah, tightened Kubernetes.Back then, I used to look up to CKS like a child gazing at one of the stars in the sky.⭐Now, fast forward to today - I cleared it last week and officially became a Certified Kubernetes Security Specialist (CKS), thanks to the Cloud Native Computing Foundation (CNCF), The Linux Foundation and my company Aivar Innovations. 🎉That moment felt so special, and I’m incredibly grateful to all my colleagues, friends, and family for all the support. ❤️A mention of the resources I used: KodeKloud by Mumshad Mannambeth and Kim Wüstkamp’s CKS courses. I also had my colleagues supporting me with my doubts and anxieties before the exam. 😂Looking forward to applying everything I’ve learned in my work and continuing to grow in the Cloud Native and Kubernetes space. 🚀So, cheers to everyone who dreams, aspires, and inspires. Keep going and keep up the good work! 🥂And as I always say - God, keep it coming!! ✨

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast

I've successfully passed CKA certification. Shout-out to Mumshad Mannambeth for his great CKA course and labs and to Omkar Shelke Killercoda CKA scenarios. Links: - https://lnkd.in/eZPVHJeR- https://lnkd.in/eEVyZdaZ

Read Full Post
Gabriel Rodríguez
DevSecOps Engineer

🎉 The Kubernetes journey continues… and this time, happy to say I’m officially a Kubestronaut! 🧑🚀🚀🎖️ 1 out of 242 in France and 1 out of 4217 worldwide!⏳✈️ It’s been quite a journey. From my early days working with Kubernetes, thanks to the opportunity Prof. Timur Friedman gave me to contribute to the EdgeNet project, to securing my internship as a DevOps Engineer at Sonos, Inc. — and fast-forward five years, here I am today, a Senior DevOps Engineer at Sonos, Inc. working extensively with Kubernetes everyday.💌 A special thank you to Jose Alfredo Alvarez Aldana for your support, guidance, and for everything you taught me along the way. I was really lucky to have the opportunity to work alongside you early in my journey. 🙏💯 A big thank you to Mumshad Mannambeth for building KodeKloud! The platform has been incredibly helpful throughout this journey, both for learning and preparing for the exams.And of course, shout out to all the people who supported, challenged, and inspired me along the way. ❤️Never give up 💪Keep smiling 😃

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast
FAQs

Frequently Asked Questions

Is this practice test free ? 

Yes! This practice test is completely free. You can take it as many times as you like to practice and assess your knowledge.

Do I need to install anything ? 

No. You don’t need to install anything. The practice test is completely browser-based, so you can start practicing directly online. 

What if I'm new to this domain?

That's completely fine , mock tests aren't just for the final week before your exam. Taking one early gives you a baseline: you'll see which topics you already grasp, which ones you've never encountered, and how the real exam frames its questions. Every attempt comes with detailed explanations for each answer, so even the questions you get wrong become a study guide. We'd suggest starting with one full mock test, reviewing the explanations carefully, then working through the linked learning material before attempting the next one. 

How closely does this mock test match the real exam?

The question style and pattern closely mirror the real certification exam, the way scenarios are framed, the answer options, and the level of reasoning required are all modelled on it. The main difference is length: this mock has 25 sample questions, while the actual exam typically presents 50-60 questions of this type. So treat this as a representative sample rather than a full-length simulation. The style will feel familiar on exam day; the stamina and time pressure of a longer paper is something you'll want to prepare for separately.