>_SecOpsLog_
All courses

Zero-trust & workload identity

Advanced5 sections · 15 lessons · ~9h total · 60-question self-test
Start course
01

Zero-trust foundations

3 lessonsTest yourself
01The zero-trust modelNever trust, always verify; assume breach.30 min02Workload identity, not IPCryptographic identity that follows the workload.30 min03Why the perimeter failsFlat interiors, no clean edge, ephemeral workloads.25 min
02

SPIFFE & SPIRE

3 lessonsTest yourself
01SPIFFE IDs & SVIDsTrust domains, X.509 vs JWT identity documents.35 min02SPIRE & attestationNode + workload attestation, the Workload API.35 min03SVIDs & rotationX.509 for mTLS, JWT for requests, short lifetimes.30 min
03

Service mesh & mTLS

3 lessonsTest yourself
01Service mesh architectureSidecar vs ambient; what the mesh enforces.30 min02mTLS at scaleSTRICT mode and the PERMISSIVE migration path.35 min03The mesh CA & trust chainIssuance, custom roots, protecting signing keys.30 min
04

Identity-based authorization

3 lessonsTest yourself
01Identity-based authzAuthorizationPolicy, default-deny, least privilege.35 min02Request-level auth (JWT)Validate tokens; authorize on verified claims.30 min03Policy as code & rolloutVersion, review, audit→enforce the call graph.25 min
05

Federation & egress

3 lessonsTest yourself
01Trust-domain federationExchange bundles; multi-cluster, multi-cloud, B2B.30 min02Egress & east-west controlAuthorize outbound through an egress gateway.30 min03Continuous verificationShort-lived trust, posture, per-request checks.30 min
Final exam
Test yourself on everything
60 questions drawn from all 5 sections — every answer explained as you pick.
Start final exam