KCNA (Kubernetes and Cloud Native Associate) is the entry-level Kubernetes certification from the CNCF and the Linux Foundation. It is a 90-minute multiple-choice exam with no prerequisites, so freshers can take it before the hands-on CKAD or CKA. It checks that you understand containers, Kubernetes objects, orchestration, observability and how cloud-native applications are delivered.
This guide follows the official KCNA curriculum: four domains with weights, the concepts you must explain, a 4-week plan and 15 original practice questions.
Quick facts (Linux Foundation, November 2026)
| Item | Detail |
|---|---|
| Format | Online, proctored, multiple choice |
| Duration | 90 minutes |
| Price | USD 250 exam only; USD 299 with the LFS250 course |
| Retake | One free retake included |
| Prerequisites | None |
| Validity | 2 years |
Read the official KCNA page and the CNCF curriculum. The Linux Foundation runs frequent discounts, so check the price before you pay.
Is KCNA worth it for freshers?
- Yes, as a first step: it shows recruiters that you understand Kubernetes and cloud-native basics, and the multiple-choice format suits people without daily cluster access.
- Not a replacement for hands-on skills: DevOps interviews still ask you to write a Deployment or debug a CrashLoopBackOff. Do labs alongside KCNA.
- Typical path: Linux and Docker, then KCNA, then CKAD, then CKA (see our CKA and CKS roadmap).
Domains and weights
| Domain | Weight | Topics |
|---|---|---|
| Kubernetes Fundamentals | 44% | Core concepts, administration, scheduling, containerisation |
| Container Orchestration | 28% | Networking, security, troubleshooting, storage |
| Cloud Native Application Delivery | 16% | Application delivery, debugging |
| Cloud Native Architecture | 12% | Observability, ecosystem and principles, community and collaboration |
Kubernetes fundamentals (44%)
This domain is almost half the exam. You should be able to explain each object below in one sentence:
| Object or component | What it does |
|---|---|
| Pod | Smallest deployable unit: one or more containers sharing network and storage |
| Deployment / ReplicaSet | Keeps the desired number of Pods running; handles rolling updates |
| StatefulSet | Pods with stable names and storage (databases) |
| DaemonSet | One Pod on every node (log agents, monitoring) |
| Job / CronJob | Run-to-completion tasks, once or on a schedule |
| Service | Stable virtual IP and DNS name in front of Pods |
| Namespace | Logical separation of resources inside a cluster |
| kube-apiserver | Front door of the control plane; every request goes through it |
| etcd | Key-value store holding all cluster state |
| kube-scheduler | Chooses a node for each new Pod |
| kube-controller-manager | Runs controllers that drive actual state towards desired state |
| kubelet | Agent on each node that runs Pods through the container runtime |
| kube-proxy | Programs node networking rules for Services |
Scheduling topics include resource requests and limits, node selectors, affinity, and taints and tolerations. Containerisation covers images, registries, container runtimes (containerd, CRI-O) and the Open Container Initiative (OCI) standards.
Container orchestration (28%)
- Networking: every Pod gets its own IP; CNI plugins; Service types (ClusterIP, NodePort, LoadBalancer); Ingress and the Gateway API; CoreDNS; NetworkPolicies; service meshes.
- Security: RBAC (Roles, ClusterRoles, bindings); ServiceAccounts; Secrets; Pod security standards; image scanning; the 4C model (cloud, cluster, container, code).
- Troubleshooting:
kubectl get,describe,logsandevents; common states such as Pending, CrashLoopBackOff and ImagePullBackOff. - Storage: volumes, PersistentVolumes and PersistentVolumeClaims, StorageClasses and dynamic provisioning, CSI drivers.
Application delivery (16%) and architecture (12%)
- Delivery: CI/CD, GitOps (Argo CD, Flux), Helm charts, Kustomize, rolling, blue/green and canary deployments; debugging failed rollouts.
- Observability: metrics (Prometheus), logs, traces (OpenTelemetry, Jaeger), dashboards (Grafana); SLOs.
- Cloud-native principles: microservices, immutable infrastructure, declarative APIs, autoscaling (HPA, VPA, Cluster Autoscaler), serverless.
- Community: CNCF project maturity levels (sandbox, incubating, graduated); SIGs; how Kubernetes releases and enhancements (KEPs) work.
4-week study plan
| Week | Focus | Practice |
|---|---|---|
| 1 | Containers, images, Docker basics, OCI, runtimes | Build and run an image; push it to a registry |
| 2 | Kubernetes architecture, Pods, Deployments, Services, namespaces, scheduling | Run a local cluster (kind or minikube); deploy and scale an app |
| 3 | Networking, RBAC, Secrets, storage, troubleshooting | Break and fix three Pods; add a PVC |
| 4 | Helm, GitOps, observability, autoscaling, CNCF landscape; practice tests | Install Prometheus with Helm; book the exam |
15 practice questions with answers
These are original practice questions written for this guide, not exam questions.
1. Which component stores all Kubernetes cluster state?
etcd.
2. Which component decides which node a new Pod runs on?
kube-scheduler.
3. Which agent on each node starts and monitors Pods?
kubelet.
4. A log collector must run on every node. Which workload?
DaemonSet.
5. A database needs stable Pod names and its own disk per replica. Which workload?
StatefulSet.
6. Which Service type is reachable only inside the cluster?
ClusterIP.
7. A Pod shows ImagePullBackOff. What is the likely cause?
A wrong image name or tag, or missing registry credentials.
8. Which command shows recent events and the reason a Pod is Pending?kubectl describe pod <name>.
9. Which object lets a Pod claim storage without knowing the disk details?
A PersistentVolumeClaim.
10. Which Kubernetes feature limits which Pods can talk to each other?
NetworkPolicy.
11. A user should only read Pods in one namespace. What do you create?
A Role with get/list/watch on Pods and a RoleBinding in that namespace.
12. Git is the single source of truth and a controller syncs the cluster to it. What is this practice?
GitOps (for example Argo CD or Flux).
13. Which tool packages Kubernetes manifests into versioned charts?
Helm.
14. Which autoscaler adds Pods when CPU usage rises?
The Horizontal Pod Autoscaler (HPA).
15. Which CNCF project is the standard for collecting metrics?
Prometheus.
After KCNA
- Get hands-on with the CKAD guide.
- Practise Kubernetes interview questions and Docker interview questions.
- See live jobs for freshers.
Cloud Soft Solutions in Ameerpet, Hyderabad teaches Linux, Docker, Kubernetes and multi-cloud DevOps for freshers with real-time projects. See the APEX program and all courses.
📞 Call +91 96660 19191 · WhatsApp · Flat No. 513, 5th Floor, Nilagiri Block, Aditya Enclave, Ameerpet, Hyderabad
Frequently Asked Questions
What is the KCNA exam format?
An online, proctored, multiple-choice exam lasting 90 minutes.
How much does KCNA cost?
USD 250 for the exam only, with one free retake included.
Does KCNA have prerequisites?
No. It is the entry-level CNCF Kubernetes certification.
Which KCNA domain has the most weight?
Kubernetes Fundamentals, at 44%.
How long is KCNA valid?
2 years.
Should I take KCNA or CKAD first?
Freshers often start with KCNA to learn the concepts, then take the hands-on CKAD.
