Overview OF Cloud Native Security

An organization adopts immutable infrastructure principles for their Kubernetes worker nodes. When a patch is required, they replace the entire node instance rather than updating packages in place. This practice primarily enhances security at which of the 4Cs layers?

An organization is adopting Kubernetes and wants to understand where their responsibility lies under the shared responsibility model. According to the 4Cs of Cloud Native Security, who is primarily responsible for configuring the RBAC rules and network policies within the Kubernetes control plane and worker nodes?

Which TWO layers complete the remaining set of the 4Cs of Cloud Native Security model alongside Code and Container? (Choose TWO)

An organization is hardening their Kubernetes cluster configuration to secure the Cluster layer. Which THREE configurations or practices should they implement? (Choose THREE)

A security architect is designing a multi-tenant Kubernetes platform. They need to ensure that a compromise in one tenant's namespace cannot allow packet sniffing or unauthorized traffic interception from another tenant's pods. Which Kubernetes feature should they implement to satisfy cloud native network isolation principles?

Which TWO of the following practices directly address security concerns within the 'Container' layer of the 4Cs of Cloud Native Security?

A platform engineering team is reviewing security layers for a newly provisioned Kubernetes cluster on AWS using Amazon EKS. Which layer of the 4Cs of Cloud Native Security encompasses patching the underlying Linux kernel of the worker nodes?

Which of the following best describes the principle of 'Defense-in-Depth' in cloud native security architectures?

An administrator is designing a security posture for a microservices application deployed in a Kubernetes cluster. According to the 4Cs of Cloud Native Security, which component falls under the 'Code' layer?

Which TWO of the following practices are core principles of cloud native security? (Choose TWO)

An auditor is assessing an organization's cloud-native supply chain security posture. Which THREE controls should be in place to ensure artifact integrity and safety across the Code and Container layers? (Choose THREE)

Which THREE of the following statements regarding cloud native security principles are correct? (Choose THREE)

An administrator is auditing a managed Kubernetes service (such as Amazon EKS, Google GKE, or Azure AKS) to verify compliance with cloud native security principles. The administrator attempts to SSH directly into the underlying worker node to inspect system logs. The connection is refused. Why is this restriction expected under the cloud native security model?

Which of the following is a core tenet of Zero Trust architecture in cloud native environments?

When considering the principle of least privilege within a cloud native architecture, what is the recommended approach for granting permissions to a Kubernetes application running in a Pod?

An organization is performing a threat modeling exercise for a Kubernetes cluster. They identify that an attacker could exploit a vulnerability in the container runtime (e.g., containerd) to access the underlying host. Which of the 4Cs does the container runtime belong to?

An enterprise security policy states that all infrastructure must be defined as code (IaC) and scanned for security misconfigurations before deployment. Which part of the cloud native security lifecycle does this control target?

When discussing cloud native security, what does 'ephemeral infrastructure' refer to, and why is it beneficial for security?

A security analyst reviews an incident where an attacker compromised a container running with the `CAP_SYS_ADMIN` capability and subsequently escaped to the host node. Which cloud native security principle was violated during the initial pod configuration?

An attacker gains execution inside a container and attempts to modify the container's root filesystem. The platform team has configured the deployment with `securityContext.readOnlyRootFilesystem: true`. What security mechanism does this enforce?

A security engineer is hardening a Kubernetes cluster against container breakout attacks. They configure AppArmor profiles and ensure pods run with a non-root user. Which of the 4Cs layers are these security measures primarily designed to protect?

A security incident response team discovers that a vulnerability in a third-party Python library allowed remote code execution inside a pod. In the context of defense-in-depth and the 4Cs, which layer primarily failed or was unmitigated, requiring remediation at the source?

According to the shared responsibility model for a cloud-managed Kubernetes service, who is responsible for managing application data encryption keys (using KMS) and application-level secrets?

An administrator notices that unauthorized users can view sensitive ConfigMaps across different namespaces because default RoleBindings were overly permissive. Which security principle was violated?

Which TWO of the following principles are core tenets of cloud native security?

An enterprise is conducting a security review of their container build and deployment pipeline. Which TWO security controls should they implement to secure the Container layer? (Choose TWO)

When evaluating cloud native security principles, why is reliance on a traditional network firewall (perimeter security) considered insufficient for modern Kubernetes environments?

A security auditor is evaluating a cloud-native deployment. The team states they practice 'shift-left' security. Which of the 4Cs does this practice primarily target?

An enterprise is deploying a zero-trust architecture across their Kubernetes environments. They mandate that all container images must be signed using Cosign and verified at admission time using Kyverno. This technical control directly hardens which of the 4Cs layers?

Which THREE of the following are characteristics of Zero Trust security models in cloud-native environments? (Choose THREE)

A security team implements mutual TLS (mTLS) between all microservices using Istio Service Mesh. Which principle of cloud native security does this implementation primarily exemplify?

A security team discovers that a vulnerability in a third-party open-source npm library has been exploited inside a running container in a production Kubernetes cluster. Based on the 4Cs of Cloud Native Security, which layer should be modified first to fix the root cause of this vulnerability?

A security engineer is designing a defense-in-depth strategy for a cloud native application deployment. Which of the following best exemplifies the 'defense-in-depth' principle across the 4Cs layers?

Under the cloud native shared responsibility model, who is responsible for ensuring that the underlying physical servers and hardware security modules (HSMs) are secure and compliant?

In a cloud native environment, what is the primary security purpose of using static code analysis (SAST) and software composition analysis (SCA) tools in the CI/CD pipeline?

An organization wants to prevent supply chain attacks where compromised base images are pulled from public registries. Which control directly addresses this risk in a cloud native environment?

A developer builds a Docker container image using an outdated base image that contains known critical operating system vulnerabilities. Before deploying this image to a production Kubernetes cluster, which security practice should be enforced to detect this issue?

An organization wants to enforce that no containers run with privileged security contexts across multiple clusters. They implement admission control validation. In the context of cloud native security principles, what type of control is this?

Which THREE of the following components are typically the responsibility of the user (rather than the cloud provider) in a managed Kubernetes service (like EKS, GKE, or AKS) under the shared responsibility model?

An organization's security team mandates that all Kubernetes worker nodes must be scanned for Common Vulnerabilities and Exposures (CVEs) on a scheduled basis. Under the 4Cs, what layer does node vulnerability scanning address?

Which THREE of the following activities fall under the customer's responsibility in the shared responsibility model when running Kubernetes on cloud infrastructure? (Choose THREE)

Which THREE of the following represent security risks or anti-patterns in cloud native application design? (Choose THREE)

Under the cloud native shared responsibility model for a managed Kubernetes service, which TWO tasks are typically the responsibility of the cloud provider? (Choose TWO)

Which TWO of the following are primary components of the 4Cs of Cloud Native Security model? (Choose TWO)

A DevOps team is building container images using Dockerfiles. They decide to use official minimal distroless base images instead of standard Ubuntu images containing package managers and shell utilities. Which security benefit does this provide?

When managing Kubernetes clusters on Google Cloud Platform (GKE), Google manages the control plane infrastructure. Under the shared responsibility model, what is the customer primarily responsible for securing?

A security engineer is reviewing the security posture of an enterprise Kubernetes deployment. They note that developers push container images directly to a private registry without vulnerability scanning. Which of the 4Cs is directly impacted by this gap?

When designing a defense-in-depth strategy across the 4Cs, which THREE independent security controls can be applied at different layers? (Choose THREE)

An organization uses AWS IAM to restrict access to their EKS cluster control plane endpoints. According to the shared responsibility model, configuring and maintaining these access entries and cluster RBAC roles is the responsibility of whom?