Which sequence correctly represents the 4C's of Cloud Native Security?

Which sequence correctly represents the 4C's of Cloud Native Security?

• A. Cloud, Clusters, Code, Containers
• B. Cloud, Clusters, Containers, Code
• C. Cloud, Code, Clusters, Containers
• D. Cloud, Containers, Clusters, Code

Answer: (B)

Start with the outer boundary and move inward. The four Cs map to layers in a cloud-native stack, so the order is Cloud, Clusters, Containers, Code. Securing the cloud layer sets the governance, IAM, encryption, and network boundaries that shape the entire environment. Next, harden the clusters—the Kubernetes control plane, RBAC, admission controllers, and network policies—to control how workloads can run and interact. Then address the containers—the image provenance, vulnerability scanning, and runtime security of the containerized environment. Finally, secure the code itself—secure coding practices, dependency and secret management, and SCA. This outer-to-inner progression ensures protections are in place first so defenses are effective as risks move inward. Other sequences place inner layers before outer ones, which doesn’t align with how risk is introduced and contained in cloud-native setups.

Start with the outer boundary and move inward. The four Cs map to layers in a cloud-native stack, so the order is Cloud, Clusters, Containers, Code. Securing the cloud layer sets the governance, IAM, encryption, and network boundaries that shape the entire environment. Next, harden the clusters—the Kubernetes control plane, RBAC, admission controllers, and network policies—to control how workloads can run and interact. Then address the containers—the image provenance, vulnerability scanning, and runtime security of the containerized environment. Finally, secure the code itself—secure coding practices, dependency and secret management, and SCA. This outer-to-inner progression ensures protections are in place first so defenses are effective as risks move inward. Other sequences place inner layers before outer ones, which doesn’t align with how risk is introduced and contained in cloud-native setups.