Is using Kali Linux legal?

Yes, owning and learning Kali is legal; but running its tools against systems you don't own without permission is a crime.

How much RAM do I need for penetration testing?

For learning, 2 to 4 GB of RAM is enough for Kali; if you have several target machines at once, 8 GB or more is better.

Should I install Kali as the main OS or virtualized?

For learning, a virtual machine is best: safer, resettable and with no changes to the host system.

Which Kali image should I use?

The official image from kali.org. For a virtual environment, the standard 64-bit version is enough.

Installing Kali Linux: Starting Penetration Testing in a Virtual Machine

Kali Linux (Kali) is a Debian-based distribution that comes with hundreds of penetration testing tools preinstalled. Before anything else, one important rule: run this system only on your own systems or with written permission from the owner; unauthorized use is both unethical and a crime.

Why a Virtual Machine Is the Best Start

Installing in a virtual machine (VirtualBox or VMware) is the simplest and safest method:

You make no changes to your host operating system
You can build or wipe the environment from scratch in a few minutes
You can bring up several target machines alongside Kali at the same time

Recommended minimum resources: two gigabytes of RAM, twenty gigabytes of disk and two processor cores.

Step-by-Step Installation

Download the official Kali release from the project website
Create a new virtual machine with the recommended settings
Attach the ISO file to the virtual drive and boot the machine
In the graphical menu select install and go through the steps (regular user + password)
After reboot, sign in

First Things to Do After Installation

Create a regular sudo user: Kali is root by default; make a separate user for everyday work
Update: run sudo apt update and then sudo apt full-upgrade
Set up your workspace: a terminal, a few target machines, and keep installed software lean

The First Four Tools You Should Learn

nmap: discovery and port scanning — full tutorial in Port Scanning with Nmap
wireshark: network traffic analysis
burpsuite: web testing and request manipulation
msfconsole: exploitation and running modules — introduction in Metasploit Tutorial

Start with these four and learn each one well at a basic level; modest depth in four tools beats a superficial familiarity with fifty.

Building a Test Network

Practice targets with intentional vulnerabilities:

Metasploitable: a deliberately weakened Linux for exploitation practice
DVWA / Juice Shop: vulnerable web apps for practicing web testing
Several machines on a virtual NAT network: an environment simulating a real network

This is the only right way to practice: build skills without harming real infrastructure. For a professional start on understanding security, read CIA Principles.