The 4Cs of cloud native security and security controls
Cloud provider and infrastructure security
Container isolation techniques
Image, registry and application code security
© 2026 Dometrain. All rights reserved.
Learn how to secure Kubernetes and cloud native environments to prepare for the KCSA exam.
A kubelet that answers anonymous requests, a ServiceAccount token that every Pod mounts, an image nobody can trace back to its build: weaknesses like these are what the Kubernetes and Cloud Native Security Associate exam asks you to recognize and fix. This exam-prep course teaches the security model behind each one and then tests it with original scenario questions, with an explanation for every answer option.
The seven chapters cover all six KCSA domains, with Kubernetes security fundamentals spread across two of them. You start with the 4Cs of cloud native security, infrastructure responsibilities and container isolation, then follow a request through authentication, RBAC and admission control. Next come the cluster components: the API server, etcd, the kubelet, the container runtime, Pod networking and storage, followed by Pod Security Standards, Secrets, network policies and audit logging. Later chapters cover platform security (signing and provenance, certificates, service meshes and runtime detection), the Kubernetes threat model from trust boundaries to denial of service, and the compliance and threat modeling frameworks that tie controls to requirements.
Every question can be answered from the lesson it sits in, which makes each lesson a self-contained study session. It is written for developers, platform operators and security engineers who already work with Pods, Deployments and Services and are preparing for the security associate exam.
The lessons teach the behavior of Kubernetes v1.37. This course is independent and is not affiliated with or endorsed by the CNCF or the Linux Foundation, which run the KCSA exam.
