Preparation for the Kubernetes and Cloud Native Security Associate (KCSA) Exam

Cloud, Cluster, Container, Code: each layer has its own security requirements, and a weakness in an outer layer cannot be compensated by the inner one. You will learn the shared responsibility model between cloud provider and operator, and analyze which infrastructure security controls (network segmentation, IAM, firewalls) matter in practice. By the end of this block, you can map an existing architecture to the four layers and systematically identify security gaps.

Which base image is secure, and how do you detect known vulnerabilities before a container runs in production? You will scan images with Trivy, evaluate CVE results, and define policies for approved base images. Additionally, you will see how image signing with Cosign secures the supply chain and why a private registry is part of any standard infrastructure.

The API Server is the central gateway to your cluster. You will examine its authentication and authorization chains, inspect TLS configurations, and understand why etcd encryption at rest is not optional. You will also see how the Controller Manager and Scheduler are secured and which flags make a real difference in practice.

At the worker node level, the Kubelet configuration determines the security of all running pods. You will check which Kubelet flags prevent anonymous access, how the container runtime (containerd) provides isolation, and what role KubeProxy plays in network security. In practice, you analyze a node configuration and identify hardening measures.

How does traffic flow between Pods, and where do attack surfaces emerge? You will look at the Kubernetes networking model, the role of CNI plugins, and why storage encryption is necessary for persistent data. You will also secure access via kubectl and kubeconfig: separating contexts, managing certificates, and minimizing cluster access.

Kubernetes ships with three Pod Security Standards profiles: Privileged, Baseline, and Restricted. You will configure Pod Security Admissions in the cluster and test how the enforce, audit, and warn modes respond to non-compliant pods. Afterward, you will know which profile fits which workload and how to roll out the standards incrementally.

Who is allowed to do what in the cluster? You will work with the three authentication methods (X.509 certificates, bearer tokens, OIDC) and then build RBAC roles and RoleBindings. Along the way, you will see common misconfigurations: overly broad ClusterRoles, missing namespace separation, and why system:masters is a risk.

Secrets in Kubernetes are only Base64-encoded by default, not encrypted. You will enable encryption at rest with an EncryptionConfiguration, compare alternatives like Sealed Secrets, and learn why namespace-based isolation combined with ResourceQuotas and LimitRanges is the first line of defense. Finally, you set up audit logging to make security-relevant API calls traceable.

Without NetworkPolicies, every pod can communicate with every other pod. You will implement a default-deny strategy and selectively open ingress and egress rules for your workloads. In practice, you write policies for a microservice scenario, test connections with curl and kubectl exec, and verify that only permitted traffic flows.

Where are the trust boundaries in a Kubernetes cluster, and how does an attacker move laterally after initial access? You will analyze real attack scenarios: privilege escalation through overprivileged service accounts, persistence via tampered container images, and lateral movement in the cluster network. Then you map countermeasures (RBAC, network policies, pod security) to each attack vector.

Falco detects suspicious behavior at runtime by monitoring system calls via eBPF. You will deploy Falco using a Helm chart in your cluster, write custom rules (e.g., detecting shell access in containers), and configure alerts. You will understand the difference between signature-based and behavior-based detection and when each approach applies.

Admission controllers validate every request to the API server before it is persisted. You will install OPA Gatekeeper, write ConstraintTemplates in Rego, and enforce policies (e.g., no containers running as root, only approved registries). You will also compare this approach with Kyverno, which uses YAML instead of Rego.

Secure software starts before deployment: you trace the path from code through the build system into the cluster and identify attack points in the supply chain. You will learn about SBOM concepts and image signing with Cosign. In parallel, you understand how PKI and TLS/mTLS encrypt communication in the cluster and what role a service mesh plays.

Which compliance requirements apply to Kubernetes clusters, and how do you prove adherence? You will work with the NIST, PCI DSS, and GDPR frameworks and map their requirements to specific Kubernetes configurations. In practice, you run kube-bench against the CIS Kubernetes Benchmarks and learn how STRIDE and OCTAVE support structured threat analysis.

The KCSA exam consists of 60 multiple-choice questions in 90 minutes with a passing score of 75%. You will review the domain weightings, identify your strengths and weaknesses, and work through sample questions from all six domains. Additionally, you will discuss time management strategies and learn how the exam process (online proctoring, PSI Bridge) works.