I85PREP
⌘ K
KCSA study materials
KCSA study resources

KCSA: Overview of Cloud Native Security

KCSA · Work through your exam, one topic at a time.

All guide sections

Overview of Cloud Native Security

The Overview of Cloud Native Security domain tests whether you can place a control at the right layer instead of reflexively reaching for a Pod spec. Expect questions on the 4Cs model, shared responsibility, and defence in depth.

The 4Cs, from the outside in

  • Cloud - the provider's infrastructure plus the identity and network primitives you configure on it: IAM roles, VPCs and subnets, security groups, managed control plane endpoints, key management.
  • Cluster - control plane and nodes: API server authentication and authorization, admission control, etcd encryption, kubelet configuration, RBAC, network policy enforcement.
  • Container - the image and its runtime: base image provenance, vulnerability scanning, signing, non-root user, dropped capabilities, seccomp/AppArmor profiles, read-only root filesystem.
  • Code - application logic and dependencies: input validation, library CVEs, secrets never baked into images or plain environment variables.

The layers are not a priority ranking. Each is assumed breachable, which is what defence in depth means in practice: a container escape should still hit node hardening, and a stolen workload identity should still hit narrowly scoped cloud IAM.

Shared responsibility

Managed services move control plane patching to the provider; they never move workload configuration, RBAC content, image hygiene, or data classification. The boundary sits differently for EKS, AKS or GKE than for kubeadm, and the exam likes that distinction.

Worked example

A pod on a managed cluster reads an S3 bucket it should not. Tightening securityContext does nothing - the credential is a cloud IAM role attached through the workload identity mechanism. The fix lives at the Cloud layer: scope the role policy to specific prefixes and remove wildcard actions. The Cluster layer contributes by disabling automounted service account tokens the pod does not need. Reasoning across layers gives the complete answer.

Traps

Assuming a managed control plane makes workloads the provider's problem; treating the 4Cs as an ordered priority; forgetting that the Cloud layer includes identity, not just networking.