Question

Difficulty: MediumVirtualization and Containerization Security

An enterprise cloud security architect is establishing baseline control requirements for host operating systems, hypervisors, and container runtime environments across a hybrid infrastructure. Match each security mechanism to its corresponding isolation property or security enforcement role.

  • Linux NamespacesProvides processes with isolated, scoped views of system resources, including process IDs, network interfaces, and mount tables.
  • Linux Control Groups (cgroups)Limits, accounts for, and throttles hardware resource consumption (such as CPU, RAM, and disk I/O) among process groups.
  • Type-1 Bare-Metal HypervisorExecutes directly on host hardware to enforce strict hardware-level domain abstraction and virtual machine separation.
  • Secure Computing Mode (seccomp)Filters and restricts the specific system calls an isolated containerized process is permitted to issue to the host kernel.

Answer

Linux Namespaces match isolated process views of system resources; Linux Control Groups (cgroups) match limiting hardware resource consumption; Type-1 Bare-Metal Hypervisor matches executing directly on host hardware for virtual machine separation; Secure Computing Mode (seccomp) matches filtering host kernel system calls.
Each mechanism aligns directly with its underlying operating system or hypervisor security control role: Namespaces restrict system visibility, cgroups control resource limits, Type-1 hypervisors provide bare-metal hardware separation, and seccomp limits system call access to the host kernel.

Step-by-Step Solution

1
Analyze container kernel isolation controls.
Identify that Linux Namespaces control resource visibility (what a process can see), whereas cgroups control resource allocation (how much a process can consume).
Differentiating process boundaries from resource constraint enforcement is essential in container runtime security.
2
Analyze kernel interface reduction mechanisms.
Identify seccomp as the Linux security capability that restricts privileged kernel syscall execution.
Syscall filtering mitigates container escape vulnerabilities that target host kernel flaws.
3
Analyze hypervisor virtualization mechanisms.
Identify Type-1 hypervisors as bare-metal software layers enforcing hardware abstraction for guest VMs.
Hardware-assisted hypervisors create a distinct security boundary separate from container OS-level virtualization.

Key Concept

Virtualization vs. Containerization Isolation Primitives
Rate this question