The 4C's model of cloud native security describes four layers, each secured within the layer surrounding it. Which statement correctly reflects the model?
- AThe layers are Cloud, Cluster, Container and Code, but each layer is fully independent, so hardening the Code alone is enough to secure the whole stack.
- BThe layers are Compute, Cluster, Container and Code, listed in order from the most trusted layer down to the least trusted.
- CThe layers are Cloud, Cluster, Container and Code, and a weakness in an outer layer such as the Cloud undermines the security of the layers nested inside it. Correct
- DThe 4C's are four RBAC verbs, create, connect, control and configure, applied to the resources in a cluster.
Why A is wrong: The layer names are right, which makes this tempting, but the model's core idea is that the layers are nested and interdependent, not independent.
Why B is wrong: This is close enough to mislead, but the outermost layer is Cloud, not Compute, and the model is about nesting rather than a trust ranking.
Why C is correct: Correct: the model names Cloud, Cluster, Container and Code as nested layers, and because each sits within the one outside it, a weak outer layer erodes the protection of the inner ones.
Why D is wrong: It borrows the memorable four-letter framing, but the 4C's are architectural security layers, not RBAC verbs, and those verbs are not part of RBAC.