An enterprise cloud security architect is establishing baseline control requirements for host operating systems, hypervisors, and container runtime environments across a hybrid infrastructure. Match each security mechanism to its corresponding isolation property or security enforcement role.
- Linux NamespacesProvides processes with isolated, scoped views of system resources, including process IDs, network interfaces, and mount tables.
- Linux Control Groups (cgroups)Limits, accounts for, and throttles hardware resource consumption (such as CPU, RAM, and disk I/O) among process groups.
- Type-1 Bare-Metal HypervisorExecutes directly on host hardware to enforce strict hardware-level domain abstraction and virtual machine separation.
- Secure Computing Mode (seccomp)Filters and restricts the specific system calls an isolated containerized process is permitted to issue to the host kernel.
Answer
Linux Namespaces match isolated process views of system resources; Linux Control Groups (cgroups) match limiting hardware resource consumption; Type-1 Bare-Metal Hypervisor matches executing directly on host hardware for virtual machine separation; Secure Computing Mode (seccomp) matches filtering host kernel system calls.
Each mechanism aligns directly with its underlying operating system or hypervisor security control role: Namespaces restrict system visibility, cgroups control resource limits, Type-1 hypervisors provide bare-metal hardware separation, and seccomp limits system call access to the host kernel.
Step-by-Step Solution
Key Concept
Virtualization vs. Containerization Isolation Primitives