Kubernetes and Cloud Native Security Associate Roadmap

Begin with security outcomes and shared responsibility rather than memorizing product names. Learn why cloud, cluster, container, and code controls overlap but do not replace one another.

• Draw Cloud, Cluster, Container, and Code layers for a simple application and assign owners
• Follow build, distribution, deployment, and runtime stages from the CNCF security lifecycle
• Compare process isolation with virtual-machine and sandbox boundaries without treating any boundary as absolute
• Map NIST SP 800-190 image, registry, orchestrator, container, host, and operational risks
• Explain preventive, detective, corrective, and recovery controls using one original scenario
• Separate a security framework from evidence that a particular control works
• Practice shared-responsibility decisions for self-managed and managed Kubernetes

Learn what each component does, which credentials and data it handles, how it communicates, and what compromise could enable.

• Trace a request through kube-apiserver authentication, authorization, admission, persistence, and audit
• Explain etcd confidentiality, authenticated TLS, encryption at rest, backups, and key custody
• Distinguish scheduler placement from controller reconciliation and protect their API identities
• Harden kubelet access and understand Node authorization plus NodeRestriction
• Protect container runtime sockets and understand CRI as a privileged node boundary
• Explain kube-proxy, Service forwarding, CNI networking, DNS, and NetworkPolicy enforcement
• Treat kubeconfig files, client keys, storage classes, volumes, snapshots, and reclaim behavior as security assets

Turn architecture knowledge into practical control decisions. Test expected denials as carefully as expected successes.

• Compare Privileged, Baseline, and Restricted Pod Security Standards
• Use enforce, audit, and warn modes with pinned Pod Security Admission versions
• Apply non-root, no privilege escalation, RuntimeDefault seccomp, dropped capabilities, and constrained volumes
• Separate authentication, authorization, and admission; use namespace-scoped least-privilege RBAC
• Review transitive privilege through workload creation, bind, escalate, impersonate, token, CSR, webhook, and nodes/proxy access
• Disable unnecessary ServiceAccount token mounting and prefer short-lived, audience-bound tokens
• Protect Secrets at rest, in transit, in manifests, in mounts, in application memory, and in logs
• Apply default-deny ingress and egress with explicit DNS and required paths on an enforcing plugin
• Design ordered audit policy rules and monitor the audit backend for errors and loss

Connect cluster controls to realistic threats: persistence, denial of service, malicious execution, network interception, sensitive-data access, and privilege escalation.

• Inventory assets, actors, entry points, data flows, identities, trust boundaries, assumptions, and owners
• Model controller, admission, volume, credential, image, and node persistence beyond one Pod
• Use ResourceQuota and least privilege to reason about denial-of-service paths
• Correlate compromised application execution with reachable service accounts, networks, storage, and cloud authority
• Understand PKI identity, certificate purpose, trust roots, rotation, expiry, and key protection
• Explain how a service mesh may add authenticated service communication and telemetry while introducing new trust
• Build privacy-minimized observability and state when missing evidence makes coverage unknown
• Validate admission timeout, scope, failure policy, certificate, bypass, and recovery decisions

Finish by joining source, builder, artifact, admission, runtime, and governance evidence while preserving uncertainty and exam integrity.

• Build once and identify the artifact by digest instead of trusting mutable tags
• Distinguish SBOM inventory, vulnerability findings, signatures, and SLSA provenance
• Use Sigstore verification policy to constrain digest, identity, issuer, and required attestations
• Represent pass, fail, exception, unknown, stale, provider-managed, manual, and not-applicable evidence separately
• Automate evidence gathering without calling a dashboard an audit or compliance guarantee
• Complete all three synthetic projects with failure injection, security validation, cost, privacy, and cleanup
• Answer all 50 original questions and explain every rejected option from first principles
• Review the 40 flashcards with spaced repetition and revisit weak domains by official weight
• Read the current candidate handbook and official exam page before scheduling