KCSA case studies
KCSA · Put your knowledge to work in context.
The Kubernetes and Cloud Native Security Associate (KCSA) is a pre-professional, vendor-neutral certification from CNCF and the Linux Foundation for people starting a cloud native security career. The source describes it as designed for candidates who want to advance to the professional level by demonstrating foundational knowledge and skills in cloud native security technologies, and notes there are no prerequisites and the experience level is beginner. It suits platform, DevOps, and security practitioners who need to evaluate a cluster's security configuration against requirements, harden controls, test and monitor security, and help identify and assess risks and vulnerabilities. The exam is online, proctored, and multiple-choice, lasts 90 minutes, and costs $250 including one free retake. The KCSA case studies are 5 cases and about 2,984 words.
1Shared Cluster, PCI Scope, and a New Internet-Facing Tenant
PaymentsCo runs a single 60-node managed Kubernetes cluster on a public cloud. Six teams share it through namespaces: payments, checkout, identity, marketing, staging, and platform.
638 words, about 3 min2Public API Server, cluster-admin Binding, and Disabled Audit Logs
A self-managed Kubernetes 1.28 cluster has three control-plane nodes and 150 workers. The API server sits behind an L4 load balancer with a public IP so remote engineers can use kubectl.
590 words, about 3 min3CI Service Account with cluster-admin and No Default Deny
At 220 namespaces, a platform team uses one CI service account, deploy-bot , bound to cluster-admin because the pipeline creates namespaces and applies manifests. Its token is stored as a long-lived Secret and mounted into every build pod.
593 words, about 3 min4Crypto Mining on 14 Nodes After a Leaked CI Token
At 02:14, monitoring alerts that CPU on 14 of 80 nodes is above 95%. Investigators find pod web-cache-7f9 in namespace frontend running an xmrig binary.
579 words, about 3 min5Six Weeks to PCI Assessment with Three Clusters
A payment processor must pass a PCI DSS assessment in six weeks. It runs three Kubernetes clusters: prod (120 nodes), staging (30), and dev (20).
584 words, about 3 min