Examkin

Question

Difficulty: EasyVirtualization and Containerization Security

A security administrator is configuring host-level hardening for an application running in a Linux container environment. Which of the following security mechanisms directly restrict container resource usage and limit accessible host kernel system calls? (Select TWO.)

  1. Control groups (cgroups)Answer
  2. Secure Computing Mode (seccomp) profilesAnswer
  3. C
    Hardware-level Type-1 hypervisor abstraction
  4. D
    Perimeter network firewall rules

Answer

Control groups (cgroups) and Secure Computing Mode (seccomp) profiles are the correct choices.
Control groups (cgroups) provide resource metering and limiting (CPU, memory, storage I/O) for containerized processes on the host. Secure Computing Mode (seccomp) restricts the system call interface exposed by the host kernel to the container, minimizing potential kernel exploitation vectors.

Step-by-Step Solution

1
Identify the host-level mechanism that restricts hardware resource allocation for containers.
Control groups (cgroups) manage and limit resources like memory, CPU, and disk I/O per container.
Prevents a single container from consuming all host resources.
2
Identify the mechanism that restricts process interactions with the host kernel interface.
Seccomp restricts system call privileges available to containerized processes.
Reduces kernel attack surface by blocking unnecessary system calls.

Key Concept

Linux kernel mechanisms for container resource governance and system call filtering
Rate this question

Topics

Virtualization and Containerization Security

More questions from this topic