KCNA - Container Orchestration - Section 2.2

Explain the security controls that govern access to a cluster and the workloads inside it.

Authentication, authorisation and admission control as the three API-request gates; RBAC roles and bindings; ServiceAccounts; NetworkPolicy; and Pod-level security context. The 4C model (Cloud, Cluster, Container, Code) frames where each control sits.

authentication, authorisation, admission controlRBAC Role and RoleBindingServiceAccountNetworkPolicysecurityContextthe 4C's of cloud native security

Practice question for this objective

Free sampleContainer Orchestrationmedium

The 4C's model of cloud native security describes four layers, each secured within the layer surrounding it. Which statement correctly reflects the model?

  • AThe layers are Cloud, Cluster, Container and Code, but each layer is fully independent, so hardening the Code alone is enough to secure the whole stack.
  • BThe layers are Compute, Cluster, Container and Code, listed in order from the most trusted layer down to the least trusted.
  • CThe layers are Cloud, Cluster, Container and Code, and a weakness in an outer layer such as the Cloud undermines the security of the layers nested inside it. Correct
  • DThe 4C's are four RBAC verbs, create, connect, control and configure, applied to the resources in a cluster.
State the four nested layers of the 4C's cloud native security model and how an outer layer's weakness affects inner ones. The 4C's are Cloud, Cluster, Container and Code, drawn as concentric layers. Each layer is secured within the one around it, so a compromise in an outer layer weakens every layer nested inside it.

Why A is wrong: The layer names are right, which makes this tempting, but the model's core idea is that the layers are nested and interdependent, not independent.

Why B is wrong: This is close enough to mislead, but the outermost layer is Cloud, not Compute, and the model is about nesting rather than a trust ranking.

Why C is correct: Correct: the model names Cloud, Cluster, Container and Code as nested layers, and because each sits within the one outside it, a weak outer layer erodes the protection of the inner ones.

Why D is wrong: It borrows the memorable four-letter framing, but the 4C's are architectural security layers, not RBAC verbs, and those verbs are not part of RBAC.

See more KCNA practice questions, answers explained.

More in this domain

Back to all Container Orchestration objectives, or the KCNA cert hub.

Examworthy is not affiliated with or endorsed by Cloud Native Computing Foundation. Original, blueprint-aligned practice material only.