I85PREP
⌘ K
CCAS study materials
CCAS study resources

CCAS: Cloud Application Deployment, Runtime, and Container Security

CCAS · Work through your exam, one topic at a time.

All guide sections

Cloud Application Deployment, Runtime, and Container Security

This domain covers the layer between code and infrastructure: images, orchestrators, serverless functions, and the runtime controls that must hold after deployment. Items often show an insecure workload manifest and ask which control removes the greatest risk.

Core rules

  • Images: minimal base, pinned digests rather than floating tags, non-root user, read-only root filesystem, no build secrets in layers, scanning in the registry and at admission, and signature verification before deploy.
  • Kubernetes: least-privilege RBAC scoped per workload, disable service account token automount where the API is not needed, default-deny network policies, Pod Security Standards (baseline, restricted), and admission control (OPA Gatekeeper, Kyverno) rejecting privileged pods and latest tags.
  • Runtime: detect drift and anomalous behavior with eBPF-based or agent tooling, harden and patch node pools, benchmark hosts against CIS, and keep the orchestrator itself patched - it is a high-value target.
  • Serverless: per-function least-privilege roles, validation of event payloads against event injection, pinned and scanned dependencies, plus bounded timeouts and concurrency.
  • Deployment: immutable infrastructure, signed artifacts, and canary or blue-green rollout with automated rollback keyed to security and error signals.

Worked example

A pod runs as root, mounts the default service account token, and is bound to cluster-admin because the application needed to list pods. Reasoning: compromise of the app yields cluster-wide control. Fix by creating a dedicated service account bound to a namespaced Role limited to the specific verbs and resources, setting automountServiceAccountToken: false, running as non-root with a fixed UID, mounting the filesystem read-only, and enforcing restricted Pod Security admission. If cluster-wide read is genuinely required, document and monitor it.

Traps

Treating containers as a security boundary equivalent to virtual machines; assuming admission control replaces runtime detection; forgetting the orchestrator and node OS are attack surface; and leaving default service account tokens mounted as a temporary measure that never gets removed.