KCNA changed shape in November 2025, and a good share of the study guides that rank for it still teach the old version. CNCF folded the separate observability domain into Cloud Native Architecture and cut the outline from five domains to four. It also rewrote the competency list, and nine of the thirteen competencies are new names, Troubleshooting and Debugging among them, so a candidate working from a 2024 checklist is planning against a test that no longer exists. If you are preparing for the Kubernetes and Cloud Native Associate now, the four-domain outline is the only one that matters.
This KCNA study guide covers the format, cost and passing score, all four KCNA exam topics with their weights, what each domain tests, and a four-week plan. The study path links twelve of the thirteen competencies to hands-on guides on this site, and the flashcards and practice questions cover all thirteen. We wrote the flashcards and the KCNA practice questions against the official curriculum PDF, and we checked the kubectl answers on a three-node kind cluster running Kubernetes v1.37 in October 2026.
1. Know the KCNA exam format, cost and passing score
KCNA is a 90-minute, 60-question multiple-choice exam with a 75% pass mark, and it costs $250 with one free retake included. KCSA shares the question count, time limit, pass mark, price and retake rule. The full picture for KCNA:
- 60 questions in 90 minutes
- 75% to pass, results by email within 24 hours
- $250, including one retake
- 12 months from registration to schedule and sit both attempts
- Online, proctored through PSI Bridge and the PSI Secure Browser
- No notes, docs or other resources while you sit it
- English, or Japanese and Simplified Chinese as separate registrations
- Valid for 2 years, with no prerequisites
We would plan around two of those details. Nothing is allowed on screen during KCNA, so the kubectl questions test recall, and you need to know which command and flag answers a situation without checking kubectl --help. Multiple-choice results also cannot be rescored, which means there is no appeal on a close fail. Book KCNA when your practice scores sit well above 75%, not right on it.
Renewal got easier in 2026 as well. Passing or recertifying CKA, CKAD or CKS now renews an existing KCNA automatically under the Linux Foundation’s CARE program, and we cover how that changes the order of the five Kubestronaut certifications in our KCNA vs KCSA vs CKA comparison.
2. Learn the four KCNA exam topics and their weights
The current KCNA curriculum has four domains and thirteen competencies, and Kubernetes Fundamentals alone is 44% of the score. The official PDF lists only the competency names, with no sub-bullets, so the last column in this table is the whole official outline:
| Domain | Weight | About this many of 60 | Competencies |
|---|---|---|---|
| Kubernetes Fundamentals | 44% | 26 | Kubernetes Core Concepts, Administration, Scheduling, Containerization |
| Container Orchestration | 28% | 17 | Networking, Security, Troubleshooting, Storage |
| Cloud Native Application Delivery | 16% | 10 | Application Delivery, Debugging |
| Cloud Native Architecture | 12% | 7 | Observability, Cloud Native Ecosystem and Principles, Cloud Native Community and Collaboration |
CNCF does not publish a per-domain question count, so the third column is our own arithmetic, the weights applied straight to 60. Read that way, the first two domains account for about 43 of your 60 questions, and that is where most of your study time belongs. The old outline gave 46% to fundamentals, 22% to orchestration, 16% to architecture and 8% each to observability and application delivery. So the real shifts are that application delivery doubled, orchestration grew, and the architecture and observability material that used to carry 24% between them now shares a single 12% domain.
Watch one source in particular. The official LFS250 course outline still lists Cloud Native Observability as its own chapter, which matches the old version of KCNA rather than the new one. The material is still useful, so we would map that chapter to the Observability competency in Domain 4 and keep going. When two sources disagree, the curriculum PDF wins, typos and all, since its heading reads “KNCA Curriculum”.
3. Understand what each KCNA domain tests
KCNA questions are about choosing, not typing. A typical stem describes a situation and asks which object, component, project or command fits it, so what gets measured is whether you can tell apart things that sound alike. The PDF lists only competency names, so the descriptions below are our reading of each one, built from the questions in our bank, and each domain lists the comparisons that bank spends the most time on because they are the pairs people mix up.
Kubernetes Fundamentals (44%)
Core Concepts is the broadest competency in the biggest domain. It covers what each control plane and node component does, the declarative object model, and which workload object fits a job. Administration is kubectl object management, rollouts, kubeconfig contexts, upgrades and version skew, node drains and namespace quotas. Scheduling covers the fields that steer placement, from requests and QoS classes to taints, tolerations and affinity. Containerization rounds the domain off with OCI images, the CRI between the kubelet and the runtime, and how images get pulled.
- Deployment vs StatefulSet vs DaemonSet vs Job
- kube-scheduler vs kubelet vs kube-controller-manager
- requests vs limits, and the QoS class each pair produces
- image tag vs digest, and the default pull policy for each
Container Orchestration (28%)
Networking covers Service types, cluster DNS names, kube-proxy, CNI, NetworkPolicy and the move from Ingress to Gateway API. Security is the API request path (authentication, authorization, admission), RBAC, ServiceAccounts, Pod Security Admission and why a Secret is not encrypted by default. Troubleshooting is new in this version of the curriculum, and it asks you to map a symptom such as CrashLoopBackOff, or a Service with no endpoints, to its cause. Storage covers PersistentVolumes, claims, StorageClasses, access modes and reclaim policies.
Cloud Native Application Delivery (16%)
Application delivery doubled in the 2025 update, and the domain splits cleanly in two. Application Delivery is the tooling around a release: CI versus CD, rollout strategies, GitOps and its four principles, Argo CD and Flux, Helm charts and releases, and Kustomize overlays. Debugging is the kubectl side. You are expected to know kubectl logs --previous for a crashed container, kubectl debug for a shell in an image that has none, and kubectl describe for the events behind a Pending Pod.
Cloud Native Architecture (12%)
Only about seven questions come from this domain, but they spread across three competencies, so it rewards breadth over depth. Observability is the signals and the projects that handle them, such as Prometheus, OpenTelemetry, Jaeger and Fluent Bit. Ecosystem and Principles covers the CNCF definition of cloud native, the open standards, and which project solves an autoscaling, serverless or service mesh need. Community and Collaboration is how CNCF and Kubernetes are governed, from the TOC and project maturity levels to SIGs and KEPs.
4. Follow the KCNA study guide by competency
We put the whole curriculum in one place below. Twelve of the thirteen competencies link to guides on this site that cover them in practice (Community and Collaboration has its practice set but no guide yet), and when you tick a guide off, your progress is saved in your browser so you can pick up where you left off:
Most of those guides are hands-on tutorials rather than KCNA-specific notes, and we chose them on purpose. KCNA only asks you to pick the right tool, but you pick faster and more reliably once you have run it. A session spent installing Kubernetes with kubeadm teaches Core Concepts and Administration better than another page of definitions.
5. Drill the facts with KCNA flashcards
The flashcards are grouped by domain and cover the facts that are easiest to confuse. Tap a card to flip it, then mark whether you knew it, and the deck remembers which cards you have already learned.
Kubernetes Fundamentals flashcards
Container Orchestration flashcards
Cloud Native Application Delivery flashcards
Cloud Native Architecture flashcards
Once a domain’s cards feel easy, move on to its question set on the KCNA practice test page. Every answer there explains why the other options are wrong, which is where most of the learning happens.
6. Use a four-week KCNA study plan
How long does KCNA take to prepare for? Four weeks at about five hours a week is realistic if you have used containers before, and you can stretch each week into two if Kubernetes is new to you. The plan follows the weights, so the first two weeks go to the domains that carry 72% of the score:
- Week 1: Kubernetes Fundamentals, with a small cluster to try every object on
- Week 2: Container Orchestration, especially Services, RBAC and storage
- Week 3: Application Delivery and Debugging, plus the Architecture domain
- Week 4: full practice tests, then targeted review of your weakest domain
The free Introduction to Kubernetes course (LFS158) from the Linux Foundation fits week 1 well. If you want the official KCNA course too, LFS250 is $99 on its own, or $49 more than KCNA alone when you buy the $299 bundle. In week 4 we would hold off booking until your practice scores reach 85% or more, because that margin covers the questions worded differently from anything you practised.
Exam day checklist for KCNA
You can lose a KCNA attempt before the first question if the PSI check-in fails, so we would run through these the day before:
- One monitor only, since dual monitors are not supported
- A physical machine, not a virtual machine
- The PSI Remote Testing Tutorial run 1 to 3 days before, which tests the Secure Browser
- An original, unexpired government ID with your photo and signature
- The name on that ID matching your verified name exactly
- Any reschedule done more than 24 hours before the start
- A plan to launch on time, since starting more than 30 minutes late is a no-show
The ID rule is the strictest of the seven. The first and last name on the ID must exactly match the name you verified with the Linux Foundation, and a missed booking forfeits both the fee and the retake. Candidates aged 16 to 18 can sit KCNA with a student ID, but a parent or guardian must submit the Parental Release for Testing of Minors form to Linux Foundation support at least two weeks before the booked date, and that guardian must show ID and give verbal consent at the PSI check-in, so read that section of the candidate handbook before you book rather than on the morning itself.
