Examkin

Question

Difficulty: MediumVirtualization and Containerization Security

An organization is deploying a multi-tenant cloud platform where microservices processing sensitive financial records will run alongside third-party analytics services on the same physical host node. The software engineering team proposes relying solely on standard Linux container runtime features, claiming that container namespaces provide security boundary isolation identical to dedicated virtual machines on a Type-1 hypervisor. Which of the following statements best describes the primary security risk associated with this deployment architecture?

  1. Containers share the underlying host operating system kernel, so a privilege escalation or kernel vulnerability could allow a compromise of one container to break isolation and impact adjacent tenant workloads.Answer
  2. B
    Containers instantiate separate hardware abstraction layers via dedicated hypervisors, making host kernel vulnerabilities non-exploitable across tenants.
  3. C
    Container network namespaces automatically consider all internal inter-container traffic trusted, disabling the ability to enforce authentication between microservices.
  4. D
    Restricting container CPU and memory usage using control groups (cgroups) serves as an inline authorization mechanism, replacing identity management controls.

Answer

Container workloads share the underlying host operating system kernel, meaning a kernel flaw or container escape vulnerability could allow an attacker to bypass isolation and access adjacent tenant microservices on the host node.
The correct answer highlights that containers virtualize at the operating system level and share the host kernel. If an attacker exploits a flaw in the kernel or container runtime, they can escalate privileges to the host and access other containers sharing that host kernel.

Step-by-Step Solution

1
Analyze the isolation mechanism of containers versus virtual machines.
Containers share the host operating system kernel and use kernel features (namespaces, cgroups) for isolation, while virtual machines run separate guest operating systems on virtualized hardware managed by a hypervisor.
Understanding the fundamental architectural difference determines the blast radius of a security compromise.
2
Evaluate the risk of running untrusted third-party microservices on a shared container host.
A vulnerability in the shared host kernel or container runtime can be exploited to achieve a container escape.
Because the host kernel is shared across all containers on that host, breaking the kernel boundary compromises all co-located container workloads.

Key Concept

Shared Kernel Isolation Risks in Containerization
Rate this question

Topics

Virtualization and Containerization Security

More questions from this topic