Acronym study
Terms 1–19 of 19 CKS acronyms and key terms. Each entry includes a plain-English definition and a link to the full 800-word glossary page with exam context and practice questions.
Term 1
Admission controllers are plugins that intercept and process requests to the Kubernetes API server after authentication and authorization, but before the request is persisted, allowing policies to be enforced on objects being created, modified, or deleted.
Term 2
API Server Security refers to the practices, configurations, and controls that protect the Kubernetes API server from unauthorized access, data breaches, and malicious attacks.
Term 3
AppArmor Profiles are security policies that restrict the system resources and actions a program can access, acting like a permission badge for software.
Term 4
Audit logging is the process of recording a chronological, tamper-evident trail of who did what, when, and where inside a computer system or network.
Term 5
A container runtime sandbox is a security boundary that isolates a container from the host system and other containers, preventing malicious or broken processes from escaping and causing harm.
Term 6
etcd encryption is the process of protecting data stored in etcd, the key-value store used by Kubernetes, by encoding it so that unauthorized users cannot read it even if they gain access to the storage.
Term 7
Falco Runtime Security is an open-source tool that continuously monitors system and container behavior to detect unexpected or malicious activities.
Term 8
Image scanning is the automated process of inspecting container images for known vulnerabilities, misconfigurations, and malware before they are deployed into production environments.
Term 9
Image signing and verification is the process of digitally signing a container image to prove its origin and integrity, and then checking that signature before using the image to ensure it was not tampered with.
Term 10
Kubelet security refers to the practices and configurations that protect the kubelet, the primary node agent in Kubernetes, from unauthorized access and malicious actions.
Term 11
Kyverno Policy Engine is a Kubernetes-native tool that enforces rules on resources to ensure security, compliance, and best practices across your cluster.
Term 12
A Kubernetes admission controller that limits what a kubelet can modify on its own node to prevent privilege escalation and unauthorized access.
Term 13
OPA Gatekeeper is a Kubernetes admission controller that enforces custom security and compliance policies on resources before they are created or updated in a cluster.
Term 14
Pod Security Admission is a Kubernetes feature that enforces security standards on pods at creation time to prevent running containers with dangerous privileges.
Term 15
Pod Security Standards are a set of predefined Kubernetes policies that control the security context of pods to prevent privilege escalation and enforce least privilege.
Term 16
RBAC Configuration is the process of defining who can do what with which resources in a system by assigning roles that carry specific permissions.
Term 17
Seccomp profiles are security filters that restrict which system calls a containerized application can make to the Linux kernel, reducing the attack surface.
Term 18
Service Account Hardening is the set of security practices to restrict and protect Kubernetes service accounts from unauthorized access or misuse.
Term 19
TLS Certificate Management is the process of creating, deploying, renewing, and revoking digital certificates that encrypt communication between computers over a network.