KCSA study plan

Map the four layers of the cloud native security model (cloud/infrastructure, cluster, container, code) to concrete controls you can name for each layer.

Enumerate the control plane components (kube-apiserver, etcd, kube-scheduler, kube-controller-manager) and state one security-relevant configuration or exposure risk for each.

Enumerate the node components (kubelet, kube-proxy, container runtime) and state one security-relevant configuration or exposure risk for each.

Install a local single-node cluster and record the exact versions of the control plane, kubelet, and runtime so later weeks have a baseline.

Trace the request path from kubectl to etcd and identify at least four points where authentication, authorization, or admission can reject a request.

Compare client certificate, bearer token, and service account authentication and decide which you would enable for human vs workload identities.

Configure at least two admission controllers and demonstrate a rejected request caused by each.

Harden kubelet exposure by disabling anonymous auth and enforcing authorization, then verify the change from an unauthenticated client.

Enable encryption at rest for secrets and prove that the raw etcd value is no longer plaintext.

Restrict etcd to trusted clients with TLS and peer authentication, and document the certificate chain you used.

Audit control plane flags against a known benchmark section and list every failing item with its remediation.

Explain the trust boundary between the control plane and nodes and name the credentials that cross it.

Write RBAC Roles and RoleBindings that grant least privilege for a namespace-scoped workload, then prove over-broad access is denied.

Distinguish Role from ClusterRole and RoleBinding from ClusterRoleBinding by constructing a case where the wrong pairing escalates privilege.

Enforce Pod Security Admission at restricted level on a namespace and remediate a pod that fails it.

Apply a NetworkPolicy default-deny and verify allowed and denied traffic paths with live tests.

Configure securityContext fields (runAsNonRoot, readOnlyRootFilesystem, drop ALL capabilities) and verify each takes effect inside the running pod.

Create and mount a Secret, then explain why base64 is not protection and how encryption at rest plus RBAC change the risk.

Compare Service Account token behavior (audience, expiry, automount) and disable automount where it is not needed.

Identify at least three risks of privileged or hostPath pods and write the policy that blocks them.

Walk the STRIDE-style threat categories across the cluster and assign at least one concrete attack scenario to each.

Model a container escape chain from a vulnerable workload to node access and list the exact chokepoints that break it.

Describe supply chain risks from image build to admission and name the control that mitigates each stage.

Map a persistence technique (for example a privileged DaemonSet or a mutated admission webhook) to the detection signal that would reveal it.

Harden the host and runtime layer by comparing a CIS-style checklist against your node and recording gaps.

Enable audit logging with a policy that captures metadata and request bodies for sensitive resources, then read the resulting log.

Configure image admission control so an unsigned or unscanned image is rejected, and show the rejection.

Separate workload trust levels with namespaces, node pools, or taints and justify the isolation choice.

Map the exam domains to recognized frameworks (CIS Benchmarks, NIST, PCI DSS, SOC 2) and state which control each domain supports.

Perform a full cluster review and produce a prioritized findings register with severity and owner.

Re-run your week 1 through week 7 checks end to end and confirm each remediation still holds.

Build a 20-question self-test across all six domains and score yourself, reviewing every miss.