KCSA — Cloud Native Security Tools
Cloud Native Security Tools
The Cloud Native Security Tools domain is part of the Platform Security area (16% of the KCSA exam). This section tests your knowledge of the open-source tools and technologies used to secure Kubernetes clusters at runtime, scan for vulnerabilities, enforce policies, encrypt service-to-service traffic, and observe security events.
Knowing the security theory is essential — but the KCSA also expects you to know which tool does what and when to use each one.
What You Will Learn
This chapter covers the five core areas of cloud native security tooling that the KCSA exam expects you to understand.
| # | Topic | Description |
|---|---|---|
| 1 | Falco — Runtime Threat Detection | eBPF-based runtime security, rules engine, alerting |
| 2 | Trivy — Vulnerability Scanning | Image, filesystem, IaC, SBOM scanning |
| 3 | OPA & Kyverno — Policy Enforcement | Admission control, policy-as-code, audit |
| 4 | Service Mesh Security (Istio/Linkerd) | mTLS, authorization policies, traffic encryption |
| 5 | Security Observability Stack | Prometheus, Grafana, EFK/ELK, tracing for security |
After completing all five sub-topics, test yourself with the Practice Questions.
Why This Domain Matters
Kubernetes security is not a single tool — it is a toolchain. Each tool in the cloud native ecosystem addresses a specific layer of the security stack:
- Runtime detection — catch threats as they happen inside running containers (Falco)
- Vulnerability scanning — find known CVEs before they reach production (Trivy)
- Policy enforcement — prevent misconfigurations from ever being deployed (OPA, Kyverno)
- Traffic encryption — secure service-to-service communication automatically (service mesh)
- Observability — detect anomalies, investigate incidents, and prove compliance (Prometheus, Grafana, EFK)
The KCSA exam asks conceptual questions — you need to know what each tool does, how it integrates with Kubernetes, and why you would choose one over another.
Prerequisites
Before starting this chapter, ensure you have completed:
- Chapter 1 — Introduction (KCSA exam structure and domains)
- Chapter 2 — Cloud Native Security (4Cs, security principles)
- Chapter 3 — Cluster Component Security (API server, etcd, kubelet)
- Chapter 4 — Authentication & Authorization (RBAC, service accounts)
- Chapter 5 — Pod & Network Security (Pod Security Standards, Network Policies)
- Chapter 6 — Threat Modeling (STRIDE, attack vectors)
- Chapter 7 — Platform Security (node hardening, admission controllers, image assurance)
- Chapter 8 — Compliance & Security Frameworks (CIS, NIST, audit)
Security tools build on the concepts introduced in every prior chapter. Understanding threat models, admission control, and compliance requirements makes the tooling chapters significantly easier.
Exam Tips for This Domain
- Know the CNCF landscape — Falco (Graduated), OPA (Graduated), Kyverno (Incubating), Trivy (community-driven by Aqua Security)
- Understand tool categories — don’t confuse runtime detection (Falco) with vulnerability scanning (Trivy) or policy enforcement (OPA/Kyverno)
- Know when mTLS matters — service meshes provide automatic encryption, but NetworkPolicies operate at L3/L4 without encryption
- Observability is security — the exam treats monitoring and logging as security capabilities, not just operational ones
- Focus on concepts, not commands — the KCSA does not ask you to run tools, but you must know what each tool does and when to use it
