A team patches its application but leaves a vulnerable node operating system. Which cloud-native security idea explains the gap?

1. Security spans cloud, cluster, container and code
2. A container image replaces every host dependency
3. Application security automatically patches every lower layer
4. A private cluster has no host-level risk