KCNA - Container Orchestration (28% of the exam) - Section 2.2
Explain the security controls that govern access to a cluster and the workloads inside it.
Authentication, authorisation and admission control as the three API-request gates; RBAC roles and bindings; ServiceAccounts; NetworkPolicy; and Pod-level security context. The 4C model (Cloud, Cluster, Container, Code) frames where each control sits.
authentication, authorisation, admission controlRBAC Role and RoleBindingServiceAccountNetworkPolicysecurityContextthe 4C's of cloud native security
Practice question for this objective
lock_openFree sampleContainer Orchestrationmedium
The 4C's model of cloud native security describes four layers, each secured within the layer surrounding it. Which statement correctly reflects the model?
AThe layers are Cloud, Cluster, Container and Code, but each layer is fully independent, so hardening the Code alone is enough to secure the whole stack.
BThe layers are Compute, Cluster, Container and Code, listed in order from the most trusted layer down to the least trusted.
CThe layers are Cloud, Cluster, Container and Code, and a weakness in an outer layer such as the Cloud undermines the security of the layers nested inside it.check_circle Correct
DThe 4C's are four RBAC verbs, create, connect, control and configure, applied to the resources in a cluster.
State the four nested layers of the 4C's cloud native security model and how an outer layer's weakness affects inner ones. The 4C's are Cloud, Cluster, Container and Code, drawn as concentric layers. Each layer is secured within the one around it, so a compromise in an outer layer weakens every layer nested inside it.
Why A is wrong: The layer names are right, which makes this tempting, but the model's core idea is that the layers are nested and interdependent, not independent.
Why B is wrong: This is close enough to mislead, but the outermost layer is Cloud, not Compute, and the model is about nesting rather than a trust ranking.
Why C is correct: Correct: the model names Cloud, Cluster, Container and Code as nested layers, and because each sits within the one outside it, a weak outer layer erodes the protection of the inner ones.
Why D is wrong: It borrows the memorable four-letter framing, but the 4C's are architectural security layers, not RBAC verbs, and those verbs are not part of RBAC.
Answers that look right on this material and are not. Each one is a distractor from a different question in the KCNA bank for this domain.
Set automountServiceAccountToken to true on the Pod so it can reach the API server successfully.
errorWhy it is wrong: Mounting a token is tempting because API calls need credentials, but the default ServiceAccount token is already mounted; the 403 is an authorisation failure, not a missing token.
Authentication, which verifies the identity of the requester before the request proceeds.
errorWhy it is wrong: Authentication is a genuine early stage of the request, but it only confirms who is calling; it does not inspect the Pod spec or reject it for requesting privileged mode.
Authorisation, which decides whether the identity may perform the action and rewrites the object to satisfy policy.
errorWhy it is wrong: Authorisation does gate the action, which makes it tempting, but it only permits or denies the request and never modifies the object being submitted.