When managing Kubernetes clusters on Google Cloud Platform (GKE), Google manages the control plane infrastructure. Under the shared responsibility model, what is the customer primarily responsible for securing?
A platform engineering team is reviewing security layers for a newly provisioned Kubernetes cluster on AWS using Amazon EKS. Which layer of the 4Cs of Cloud Native Security encompasses patching the underlying Linux kernel of the worker nodes?
An organization adopts immutable infrastructure principles for their Kubernetes worker nodes. When a patch is required, they replace the entire node instance rather than updating packages in place. This practice primarily enhances security at which of the 4Cs layers?
An organization is performing a threat modeling exercise for a Kubernetes cluster. They identify that an attacker could exploit a vulnerability in the container runtime (e.g., containerd) to access the underlying host. Which of the 4Cs does the container runtime belong to?
According to the shared responsibility model, when deploying a managed database service on cloud infrastructure, who is responsible for patching the database software and managing database user access control?
Which THREE of the following activities fall under the customer's responsibility in the shared responsibility model when running Kubernetes on cloud infrastructure? (Choose THREE)
An organization is reviewing its shared responsibility model for a Kubernetes deployment hosted on a public cloud. An auditor asks who is responsible for patching a zero-day Linux kernel vulnerability affecting the worker node operating system. Who holds primary responsibility in a managed Kubernetes environment?
Under the cloud native shared responsibility model, who is responsible for ensuring that the underlying physical servers and hardware security modules (HSMs) are secure and compliant?
An enterprise is deploying a zero-trust architecture across their Kubernetes environments. They mandate that all container images must be signed using Cosign and verified at admission time using Kyverno. This technical control directly hardens which of the 4Cs layers?
An administrator is designing a security posture for a microservices application deployed in a Kubernetes cluster. According to the 4Cs of Cloud Native Security, which component falls under the 'Code' layer?
A security incident response team discovers that a vulnerability in a third-party Python library allowed remote code execution inside a pod. In the context of defense-in-depth and the 4Cs, which layer primarily failed or was unmitigated, requiring remediation at the source?
A security auditor is evaluating a cloud-native deployment. The team states they practice 'shift-left' security. Which of the 4Cs does this practice primarily target?
An organization uses AWS IAM to restrict access to their EKS cluster control plane endpoints. According to the shared responsibility model, configuring and maintaining these access entries and cluster RBAC roles is the responsibility of whom?
When evaluating cloud native security principles, why is reliance on a traditional network firewall (perimeter security) considered insufficient for modern Kubernetes environments?
A security engineer is hardening a Kubernetes cluster against container breakout attacks. They configure AppArmor profiles and ensure pods run with a non-root user. Which of the 4Cs layers are these security measures primarily designed to protect?
An organization wants to enforce that no containers run with privileged security contexts across multiple clusters. They implement admission control validation. In the context of cloud native security principles, what type of control is this?
A security team implements mutual TLS (mTLS) between all microservices using Istio Service Mesh. Which principle of cloud native security does this implementation primarily exemplify?
A security analyst reviews an incident where an attacker compromised a container running with the `CAP_SYS_ADMIN` capability and subsequently escaped to the host node. Which cloud native security principle was violated during the initial pod configuration?
According to the shared responsibility model for a cloud-managed Kubernetes service, who is responsible for managing application data encryption keys (using KMS) and application-level secrets?
An enterprise security policy states that all infrastructure must be defined as code (IaC) and scanned for security misconfigurations before deployment. Which part of the cloud native security lifecycle does this control target?
A DevOps team is building container images using Dockerfiles. They decide to use official minimal distroless base images instead of standard Ubuntu images containing package managers and shell utilities. Which security benefit does this provide?
An organization's security team mandates that all Kubernetes worker nodes must be scanned for Common Vulnerabilities and Exposures (CVEs) on a scheduled basis. Under the 4Cs, what layer does node vulnerability scanning address?
A security architect is designing a multi-tenant Kubernetes platform. They need to ensure that a compromise in one tenant's namespace cannot allow packet sniffing or unauthorized traffic interception from another tenant's pods. Which Kubernetes feature should they implement to satisfy cloud native network isolation principles?
An administrator notices that unauthorized users can view sensitive ConfigMaps across different namespaces because default RoleBindings were overly permissive. Which security principle was violated?
A security engineer is reviewing the security posture of an enterprise Kubernetes deployment. They note that developers push container images directly to a private registry without vulnerability scanning. Which of the 4Cs is directly impacted by this gap?
An organization wants to prevent supply chain attacks where compromised base images are pulled from public registries. Which control directly addresses this risk in a cloud native environment?
An attacker gains execution inside a container and attempts to modify the container's root filesystem. The platform team has configured the deployment with `securityContext.readOnlyRootFilesystem: true`. What security mechanism does this enforce?
In a cloud native environment, what is the primary security purpose of using static code analysis (SAST) and software composition analysis (SCA) tools in the CI/CD pipeline?
Under the cloud native shared responsibility model for a managed Kubernetes service, which TWO tasks are typically the responsibility of the cloud provider? (Choose TWO)
An enterprise is conducting a security review of their container build and deployment pipeline. Which TWO security controls should they implement to secure the Container layer? (Choose TWO)
An organization is hardening their Kubernetes cluster configuration to secure the Cluster layer. Which THREE configurations or practices should they implement? (Choose THREE)
When designing a defense-in-depth strategy across the 4Cs, which THREE independent security controls can be applied at different layers? (Choose THREE)
An organization is adopting Kubernetes and wants to understand where their responsibility lies under the shared responsibility model. According to the 4Cs of Cloud Native Security, who is primarily responsible for configuring the RBAC rules and network policies within the Kubernetes control plane and worker nodes?
An auditor is assessing an organization's cloud-native supply chain security posture. Which THREE controls should be in place to ensure artifact integrity and safety across the Code and Container layers? (Choose THREE)
An administrator is auditing a managed Kubernetes service (such as Amazon EKS, Google GKE, or Azure AKS) to verify compliance with cloud native security principles. The administrator attempts to SSH directly into the underlying worker node to inspect system logs. The connection is refused. Why is this restriction expected under the cloud native security model?
A security engineer is designing a defense-in-depth strategy for a cloud native application deployment. Which of the following best exemplifies the 'defense-in-depth' principle across the 4Cs layers?
A developer builds a Docker container image using an outdated base image that contains known critical operating system vulnerabilities. Before deploying this image to a production Kubernetes cluster, which security practice should be enforced to detect this issue?
A security team discovers that a vulnerability in a third-party open-source npm library has been exploited inside a running container in a production Kubernetes cluster. Based on the 4Cs of Cloud Native Security, which layer should be modified first to fix the root cause of this vulnerability?
When considering the principle of least privilege within a cloud native architecture, what is the recommended approach for granting permissions to a Kubernetes application running in a Pod?
Which THREE of the following components are typically the responsibility of the user (rather than the cloud provider) in a managed Kubernetes service (like EKS, GKE, or AKS) under the shared responsibility model?
A healthcare company is designing a new cloud native platform and wants to apply the principle that no single security control should be the sole barrier protecting a critical asset. Their architects propose encrypting data at rest and relying on that encryption as the primary defense against unauthorized database access by a compromised pod. Which design change best reflects the intended principle?