KCSA — Final Checklist
Final Checklist
This is the last page of the entire KCSA tutorial. If you can confidently answer every question on this checklist, you are ready to pass the exam.
Go through each domain below. For every checkbox, ask yourself: “Can I explain this clearly without looking at notes?” If the answer is no, go back to the relevant chapter and review before scheduling your exam.
Be honest with yourself. A checkbox you mark without true understanding is a potential wrong answer on exam day.
Domain 1: Overview of Cloud Native Security (14%)
~8–9 questions on the exam
- Can you explain the 4Cs of Cloud Native Security (Cloud → Cluster → Container → Code) and what each layer protects?
- Can you describe the shared responsibility model and identify what the cloud provider vs. customer is responsible for in managed Kubernetes?
- Can you list at least three container image security best practices (minimal base images, non-root user, vulnerability scanning, signed images)?
- Can you explain what an SBOM (Software Bill of Materials) is and name two formats (SPDX and CycloneDX)?
- Can you describe the SLSA framework levels and what each level ensures for supply chain integrity?
- Can you explain defense in depth and how it applies to cloud native environments?
- Can you distinguish between shift-left security (early in the pipeline) and runtime security (in production)?
Quick Reference — 4Cs
| Layer | Scope | Examples |
|---|---|---|
| Cloud | Infrastructure | IAM, network ACLs, encryption, physical security |
| Cluster | Kubernetes | RBAC, Network Policies, admission control, audit |
| Container | Runtime | Image scanning, non-root, read-only filesystem, sandboxing |
| Code | Application | Input validation, dependency scanning, secret management |
Domain 2: Kubernetes Cluster Security (22%)
~13–14 questions on the exam — HIGHEST WEIGHT
- Can you describe the API server request flow: Authentication → Authorization → Admission Control → Persist to etcd?
- Can you list at least 4 authentication methods (X.509 certificates, bearer tokens, OIDC tokens, service account tokens)?
- Can you explain RBAC resources — Role, ClusterRole, RoleBinding, ClusterRoleBinding — and when to use each?
- Can you compare legacy service account tokens (long-lived, no expiry) vs projected tokens (time-bound, audience-bound, object-bound)?
- Can you name at least 3 authorization modes (RBAC, Node, ABAC, Webhook) and explain the authorization chain?
- Can you explain OIDC authentication — who issues the token, who validates it, and how it integrates with Kubernetes?
- Can you describe the principle of least privilege in the context of RBAC (narrowest permissions, namespace-scoped where possible)?
- Can you explain why system:masters group is dangerous and when it should (never) be used for regular access?
Quick Reference — RBAC
| Resource | Scope | Purpose |
|---|---|---|
| Role | Namespace | Define permissions within a namespace |
| ClusterRole | Cluster | Define permissions cluster-wide or for non-namespaced resources |
| RoleBinding | Namespace | Bind a Role or ClusterRole to subjects within a namespace |
| ClusterRoleBinding | Cluster | Bind a ClusterRole to subjects cluster-wide |
Domain 3: Kubernetes Cluster Component Security (22%)
~13–14 questions on the exam — HIGHEST WEIGHT
- Can you explain etcd encryption at rest — what it is, why it matters, and name at least 3 encryption providers (aescbc, aesgcm, secretbox, identity)?
- Can you describe kubelet authentication options (anonymous auth, TLS client certificates, bearer tokens) and why anonymous auth should be disabled?
- Can you explain why Kubernetes Secrets are not encrypted by default (base64 encoding ≠ encryption)?
- Can you list the 4 Kubernetes audit levels (None, Metadata, Request, RequestResponse) and what each captures?
- Can you describe container runtime sandboxing options (gVisor: user-space kernel, Kata Containers: lightweight VMs)?
- Can you explain the kubelet read-only port (10255) risk and why the CIS Benchmark recommends disabling it?
- Can you name critical API server security flags (
--anonymous-auth=false,--insecure-port=0,--encryption-provider-config)? - Can you explain the EncryptionConfiguration resource and how encryption providers are ordered (first provider is used for writing, all are tried for reading)?
Quick Reference — Audit Levels
| Level | What Is Captured |
|---|---|
| None | Nothing logged |
| Metadata | Request metadata only (user, timestamp, resource, verb) |
| Request | Metadata + request body |
| RequestResponse | Metadata + request body + response body |
Domain 4: Kubernetes Security Fundamentals (16%)
~9–10 questions on the exam
- Can you name the 3 Pod Security Standards levels (Privileged, Baseline, Restricted) and what each allows?
- Can you explain PSA enforcement modes (enforce: block, audit: log, warn: warn user) and how they work together?
- Can you list at least 5 security context fields (
runAsNonRoot,readOnlyRootFilesystem,allowPrivilegeEscalation,capabilities,seccompProfile)? - Can you explain Network Policy AND vs OR logic (same array item = AND, separate array items = OR)?
- Can you describe resource limits vs requests and how they prevent DoS attacks?
- Can you explain what the Restricted PSS level requires (non-root, drop ALL capabilities, seccomp profile set, no privilege escalation)?
- Can you distinguish between Seccomp, AppArmor, and SELinux — what each does and how they are configured in Kubernetes?
Quick Reference — Pod Security Standards
| Level | Purpose | Allows Privileged? | Allows Root? | Requires Seccomp? |
|---|---|---|---|---|
| Privileged | Unrestricted | Yes | Yes | No |
| Baseline | Prevent known escalations | No | Yes | No |
| Restricted | Maximum hardening | No | No | Yes |
Domain 5: Kubernetes Threat Model (16%)
~9–10 questions on the exam
- Can you explain all 6 STRIDE categories with Kubernetes-specific examples?
- Spoofing → stolen service account tokens, impersonating another user
- Tampering → modifying ConfigMaps, injecting malicious containers
- Repudiation → deleting audit logs, no logging enabled
- Information Disclosure → exposed Secrets, readable etcd, kubelet read-only port
- Denial of Service → resource exhaustion, fork bombs, no resource limits
- Elevation of Privilege → container escape, privileged containers, hostPID
- Can you identify at least 3 control plane attack surface areas (API server exposed publicly, etcd without mTLS, kubelet anonymous auth)?
- Can you describe container escape techniques (privileged containers, hostPID, hostNetwork, host path mounts)?
- Can you map threats to mitigations (e.g., spoofing → strong authentication, tampering → admission control, info disclosure → encryption)?
- Can you explain the cloud metadata attack (IMDS at 169.254.169.254, role credential theft, mitigation via Network Policy or IMDSv2)?
- Can you describe persistence techniques in Kubernetes (malicious DaemonSets, backdoor containers, CronJobs, modified RBAC)?
- Can you identify MITRE ATT&CK for Containers tactics relevant to Kubernetes (Initial Access, Execution, Persistence, Impact)?
Quick Reference — STRIDE
| Category | Threat | K8s Mitigation |
|---|---|---|
| Spoofing | Identity impersonation | Strong AuthN (OIDC, certificates) |
| Tampering | Unauthorized modification | Admission control, RBAC |
| Repudiation | Denying actions | Audit logging |
| Info Disclosure | Data exposure | Encryption (etcd, TLS), RBAC |
| Denial of Service | Resource exhaustion | Resource limits, quotas |
| Elevation of Privilege | Gaining higher access | PSS, security context, sandboxing |
Domain 6: Compliance and Security Frameworks (10%)
~6 questions on the exam
- Can you describe CIS Kubernetes Benchmark sections (control plane, etcd, worker nodes, policies) and the tool kube-bench?
- Can you explain NIST SP 800-190’s focus (container security: images, registries, orchestrators, containers, host OS)?
- Can you name policy-as-code tools (OPA/Gatekeeper and Kyverno) and their key architectural difference (Rego vs YAML)?
- Can you map GDPR requirements to Kubernetes controls (audit logging → accountability, encryption → data protection, RBAC → access control)?
- Can you explain compliance automation (continuous CIS scanning, policy enforcement via admission control, drift detection, audit trails)?
- Can you describe Falco (runtime detection via syscalls/eBPF), Trivy (vulnerability/image scanning), and service mesh mTLS (traffic encryption)?
- Can you distinguish between preventive controls (admission controllers) and detective controls (audit logging, Falco, monitoring)?
Quick Reference — Compliance Tools
| Tool | Category | Primary Function |
|---|---|---|
| kube-bench | CIS Benchmark | Check cluster config against CIS recommendations |
| Falco | Runtime Detection | Monitor syscalls for threats (eBPF/kernel module) |
| Trivy | Vulnerability Scanning | Scan images, IaC, SBOM for CVEs |
| OPA/Gatekeeper | Policy Enforcement | Admission control via Rego policies |
| Kyverno | Policy Enforcement | Admission control via Kubernetes-native YAML |
| Istio/Linkerd | Service Mesh | mTLS, traffic encryption, authorization policies |
Cross-Domain Quick Facts
These high-frequency facts span multiple domains and are worth memorizing:
| Fact | Detail |
|---|---|
| KCSA passing score | 75% |
| Exam format | ~60 MCQ, 90 minutes, online proctored |
| 4Cs order | Cloud → Cluster → Container → Code |
| API server pipeline | AuthN → AuthZ → Admission → etcd |
| RBAC order of precedence | Deny by default. Any allow wins. |
| 3 PSS levels | Privileged, Baseline, Restricted |
| 3 PSA modes | enforce, audit, warn |
| etcd default encryption | None (identity — plaintext) |
| Projected token benefits | Time-bound, audience-bound, object-bound |
| NetworkPolicy logic | Same from item = AND; separate items = OR |
| Audit levels | None, Metadata, Request, RequestResponse |
| STRIDE | Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege |
| Service account attack | Overly permissive RBAC + long-lived tokens |
| Container escape vectors | privileged, hostPID, hostNetwork, host path mounts |
| CIS Benchmark tool | kube-bench |
| Runtime detection tool | Falco (eBPF/kernel module → syscalls) |
| SBOM formats | SPDX, CycloneDX |
| NIST SP 800-190 | Container security guide (images, registries, orchestrators, containers, host OS) |
| Kubelet read-only port | 10255 — disable with --read-only-port=0 |
| gVisor | User-space kernel (Sentry) — intercepts syscalls |
| Kata Containers | Lightweight VMs with separate guest kernel |
Your Readiness Score
Go back through the checklist above and count how many boxes you can honestly check:
| Domain | Total Items | Your Check Count |
|---|---|---|
| Domain 1: Cloud Native Security | 7 | ___ / 7 |
| Domain 2: Cluster Security | 8 | ___ / 8 |
| Domain 3: Component Security | 8 | ___ / 8 |
| Domain 4: Security Fundamentals | 7 | ___ / 7 |
| Domain 5: Threat Model | 7 | ___ / 7 |
| Domain 6: Compliance & Frameworks | 7 | ___ / 7 |
| Total | 44 | ___ / 44 |
Interpretation
| Score | Readiness |
|---|---|
| 40–44 | ✅ Schedule the exam with confidence |
| 33–39 | ⚠️ Almost there — review unchecked items |
| 25–32 | ❌ Significant gaps — revisit weak chapters before scheduling |
| Below 25 | ❌ Not ready — go through the tutorial systematically |
You Are Ready
If you have:
- ✅ Completed all 10 chapters of this tutorial
- ✅ Scored 75%+ on both mock exams
- ✅ Reviewed every wrong answer and understood why
- ✅ Checked 40+ items on this final checklist
- ✅ Prepared your exam environment and tested PSI Secure Browser
Then you are ready. Schedule the exam and pass it.
The KCSA validates that you understand Kubernetes security at a conceptual level — the 4Cs, RBAC, admission control, threat modeling, Pod Security Standards, compliance frameworks, and the security tools ecosystem. You have studied all of it. Trust your preparation.
Good luck. You have earned this.
This is the final page of the KCSA Tutorial.
To revisit any chapter:
| Chapter | Topic | Link |
|---|---|---|
| 1 | Introduction | Go to Chapter 1 |
| 2 | Cloud Native Security | Go to Chapter 2 |
| 3 | Cluster Component Security | Go to Chapter 3 |
| 4 | Authentication & Authorization | Go to Chapter 4 |
| 5 | Pod & Network Security | Go to Chapter 5 |
| 6 | Threat Modeling | Go to Chapter 6 |
| 7 | Platform Security | Go to Chapter 7 |
| 8 | Compliance & Frameworks | Go to Chapter 8 |
| 9 | Security Tools | Go to Chapter 9 |
| 10 | Exam Tips & Mock Exam | Go to Chapter 10 |
