In a standard cluster every workload can reach every other workload and most of the network beyond, and that is the contract the platform provides rather than a misconfiguration. This course is for the platform engineer who owns that substrate for fifty or more services and cannot review what any team ships on it. You will work through the default posture and how to confirm your plugin enforces anything at all, why egress is the direction that decides what a compromised workload can do next, the selector semantics that let a narrow looking policy permit far more than intended, what namespaces do and do not isolate at the packet level, egress to the internet, to internal services, to the control plane and to the node metadata endpoint, how to observe what a workload actually talks to before constraining it, where name based egress genuinely helps and where it is weaker than it appears, an audit first rollout onto a running estate, a break glass path that expires on its own, and the small set of numbers that show whether the control is real.
Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.
None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.
You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.
The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.
