GIAC Cloud Security Automation (GCSA)

Exam Certification Objectives & Outcome Statements

• Architecture and Fundamentals of Container OrchestrationThe candidate can identify the core components of container orchestration by utilizing Kubernetes. The candidate can use the kubectl command line interface to interact with Kubernetes resources.
• Automated Cloud RemediationThe candidate can explain how policy-as-code tools detect and correct cloud configuration drift. The candidate can construct rules to automatically evaluate and remediate cloud resource misconfigurations.
• Cloud Native ObservabilityThe candidate can summarize the components of microservice observability such as Kubernetes cluster's metrics, logs, and traces.
• Compliance as CodeThe candidate will demonstrate understanding of continuous compliance and policy approaches that integrate enforcement and automation directly into the DevOps toolchain.
• Container Lifecycle SecurityThe candidate can identify the lifecycle steps towards container security. The candidate can apply various techniques towards hardening and scanning containers.
• Deploying Cloud Infrastructure as CodeThe candidate can define IaC concepts and utilize typical tooling to define and deploy IaC. The candidate can identify common IaC security misconfigurations using automated scanning tools.
• Edge Identity and AuthenticationThe candidate can identify common approaches to authenticating external users before they reach microservices. The candidate can utilize foundational concepts such as IAM and managed identify providers and identify core components such as users, groups, and JWT best practices.
• Managing SecretsThe candidate can summarize how secrets flow through the DevOps pipeline. The candidate can utilize common secure storage approaches for secrets management.
• Microservice API GatewaysThe candidate can apply the benefits of establishing intra-cluster microsegmentation using Kubernetes components such as network policy and service mesh.
• Microservices Architecture and DeploymentThe candidate can identify the security implications of using microservices. The candidate can apply secure deployment changes to a running microservice environment.
• Policy EnforcementThe candidate can explain how application security posture management (ASPM) platforms ingest and deduplicate findings from multiple pipeline sources. The candidate can apply policy-as-code controls to enforce deployment approvals based on application security posture.
• Risks, Authentication, and Access-Control of Container OrchestrationThe candidate can identify essential security controls used by Kubernetes, such as authentication and role-based access control. The candidate can identify known risks and attack vectors targeting Kubernetes clusters.
• Runtime Security in Container OrchestrationThe candidate can identify how Kubernetes admission controllers enforce security policy and prevent misconfigured or malicious workloads at runtime.
• Securing the DevOps WorkflowThe candidate can utilize security features made available in CI/CD systems. The candidate can identify secure objectives within the pre-commit and pre-merge phases. The candidate can apply workflow hardening utilizing AI-augmented controls.
• Software Supply Chain SecurityThe candidate can apply standard steps towards securing the container image supply chain. The candidate can apply standard management techniques, such as artifact signing or SBOM vulnerability scanning.
• Understanding the DevOps WorkflowThe candidate can define DevOps practices and principles. The candidate can identify risks and key weaknesses to a vulnerable DevOps workflow.
• Utilizing Configuration ManagementThe candidate can identify security benefits of building hardened, trusted, machine images. The candidate can utilize programs that enable the use of gold images within the DevOps pipeline.
• Workload Security in Container OrchestrationThe candidate can summarize documented issues with how Kubernetes pods authenticate to cloud services. The candidate can utilize core solutions such as OIDC-based workload identity.