A. Incorrect.
etcd is the backing store for Kubernetes cluster state.

B. Incorrect.
Authorization decisions are handled by the API server authorization chain, such as RBAC.

C. Correct.
The Scheduler watches for unscheduled Pods and selects suitable nodes by evaluating resources and constraints.

D. Incorrect.
Metrics collection and dashboards are handled by observability tools such as Prometheus and Grafana, not the Scheduler.

A. Correct.
The --profiling flag enables pprof profiling endpoints when true. Disabling it reduces unnecessary debug exposure in production.

B. Incorrect.
--scheduler-name identifies a scheduler profile/name and is not the profiling endpoint control.

C. Incorrect.
--secure-kubeconfig is not the standard flag used for this scheduler hardening control.

D. Incorrect.
RuntimeClass is configured for Pods and runtimes, not as a kube-scheduler profiling flag.

A. Incorrect.
Spoofing is impersonating an identity or system. The main issue here is modified image content.

B. Incorrect.
Repudiation is denying an action because of insufficient auditability. It is not the best fit for a changed image artifact.

C. Incorrect.
Denial of Service targets availability. This scenario targets integrity.

D. Correct.
Tampering is unauthorized modification of data, code, or artifacts. A trojanized image is a modified supply chain artifact.

A. Incorrect.
The private key must remain secret with the signer. It should not be needed by verifiers.

B. Correct.
The signer uses the private key to create the signature. Verifiers use the public key and signature to validate authenticity and integrity.

C. Incorrect.
Tags are mutable labels and do not prove authenticity. The private key should never be distributed for verification.

D. Incorrect.
Registry credentials may allow pulling an image, but they do not prove the image was signed by a trusted authority.

A. Incorrect.
Logs and metrics belong in logging and monitoring systems, not etcd.

B. Incorrect.
etcd stores PersistentVolume and PersistentVolumeClaim objects, but not the actual application files stored on the volume.

C. Correct.
etcd is Kubernetes' consistent key-value backing store for cluster data such as resource definitions, metadata, ConfigMaps, Secrets, and RBAC objects.

D. Incorrect.
Runtime binaries live on nodes or host images; they are not stored in etcd.

A. Incorrect.
Security through obscurity relies on hiding details and is not the principle behind the 4C model.

B. Incorrect.
Cloud native environments require multiple layers of control, not one perimeter.

C. Incorrect.
Repudiation is a STRIDE threat category, not the security approach represented by the 4C model.

D. Correct.
The 4C model encourages layered controls across cloud, cluster, container, and code. That is a defense-in-depth approach.

A. Correct.
Mutating admission runs first so the request object can be changed. Validating admission then checks the final object before it is persisted.

B. Incorrect.
Validating first would allow later mutation to change an object after validation, which would weaken policy enforcement.

C. Incorrect.
The admission chain has ordered phases rather than simultaneous execution.

D. Incorrect.
Admission happens before the object is accepted and stored.

A. Incorrect.
Manual per-workload configuration is slow and error-prone.

B. Incorrect.
Audits can find issues, but without automated policy they do not consistently prevent misconfiguration.

C. Correct.
Declarative policy as code makes expectations reviewable, repeatable, testable, and easier to enforce consistently across clusters.

D. Incorrect.
Ad-hoc scripting creates inconsistent behavior and can become difficult to maintain.

A. Incorrect.
Resource limits can cause throttling or termination, but that is not a breakout.

B. Correct.
A container breakout means escaping the container boundary and accessing the underlying host, which can allow broader node and cluster compromise.

C. Incorrect.
Network visibility or service routing issues are not the definition of host escape.

D. Incorrect.
Using a service account token is an identity and authorization risk, but not a container isolation breakout by itself.

A. Incorrect.
Scheduling is unrelated to egress NetworkPolicy behavior.

B. Incorrect.
Base64 is encoding, not encryption, and egress control does not change Secret storage.

C. Incorrect.
kubelet TLS authentication is a node/control-plane communication setting, not a result of egress policy.

D. Correct.
Without egress restrictions, a compromised Pod can often connect outward freely and send stolen data to attacker-controlled infrastructure.