KCSA — Cloud Native Security Overview
Welcome to Chapter 2 — Cloud Native Security Overview
If Chapter 1 gave you the why behind Kubernetes security, this chapter gets into the what — the foundational models, frameworks, and practices that define how we secure cloud native workloads from the ground up.
This is one of the highest-weighted domains on the KCSA exam, so pay close attention.
What This Chapter Covers
Cloud native security isn’t a single tool or configuration — it’s a layered approach that spans your entire stack. In this chapter, you’ll learn:
- The 4Cs of Cloud Native Security — Cloud, Cluster, Container, Code — and why each layer matters
- How cloud providers and infrastructure fit into the security picture
- Why container image security is a critical first line of defense
- The growing importance of software supply chain security in modern environments
- How to secure artifact repositories and registries so that only trusted images run in your clusters
Think of it this way: securing Kubernetes isn’t just about configuring RBAC or network policies inside the cluster. It starts way before a Pod is created — at the code you write, the dependencies you pull in, the images you build, and the infrastructure you deploy on.
Chapter Topics
| # | Topic | Description |
|---|---|---|
| 1 | The 4Cs of Cloud Native Security | Cloud, Cluster, Container, Code — the layered defense model |
| 2 | Cloud Provider & Infrastructure Security | Shared responsibility, IAM, network isolation |
| 3 | Container Image Security | Base images, scanning, registries, signing |
| 4 | Software Supply Chain Security | SBOM, provenance, dependency scanning |
| 5 | Artifact Repository & Registry Security | Private registries, image policies, content trust |
After covering all five topics, test yourself with the Practice Questions.
KCSA Exam Relevance
| Detail | Info |
|---|---|
| Exam Domain | Overview of Cloud Native Security |
| Weight | 14% |
| Question Types | Multiple-choice, conceptual |
14% makes this one of the biggest domains on the KCSA exam. You can expect questions about:
- Identifying which layer of the 4Cs a given security control belongs to
- Understanding the shared responsibility model for managed Kubernetes
- Knowing what an SBOM is and why it matters
- Recognizing supply chain security frameworks like SLSA
- Choosing the right image scanning or signing tool for a scenario
Don’t just memorize the names — understand the purpose behind each concept. The exam tests whether you can apply these ideas to realistic scenarios.
Prerequisites
Before diving in, make sure you’re comfortable with:
- Chapter 1 — Kubernetes Security Fundamentals (threat landscape, attack surfaces, security principles)
- Basic familiarity with containers, images, and Kubernetes architecture
- High-level understanding of how CI/CD pipelines work
How to Use This Chapter
- Read each topic in order — the 4Cs model in Topic 1 provides the framework for everything that follows
- Focus on the tables and key takeaways — these map directly to what you’ll see on the exam
- Take the practice quiz at the end to check your understanding
- Revisit weak areas — if any topic feels unfamiliar, re-read it before moving on
Ready?
Let’s start with the most important framework in cloud native security — the 4Cs model.
