Examkin

Question

Difficulty: MediumVirtualization and Containerization Security

A system administrator is configuring isolation controls on a host operating system running multiple production application containers. Which of the following security mechanisms directly restrict containerized processes from escalating privileges on the host kernel and limiting system calls? (Select TWO.)

  1. Configuring Secure Computing Mode (seccomp) profiles for container runtime environmentsAnswer
  2. Enabling user namespaces to map container root users to non-root host accountsAnswer
  3. C
    Deploying a Type 1 bare-metal hypervisor to manage execution partitions for each container process
  4. D
    Relying exclusively on enterprise perimeter firewalls to filter inter-container network traffic

Answer

The correct mechanisms are configuring Secure Computing Mode (seccomp) profiles and enabling user namespaces.
Seccomp restricts the syscall boundary exposed by the host kernel to containerized workloads, while user namespaces isolate administrative privileges by ensuring a container's root user does not map to root authority on the underlying host operating system.

Step-by-Step Solution

1
Analyze container kernel isolation requirements
Identify controls that limit kernel attack surfaces and host account exposure.
Containers share the underlying host OS kernel, making system call filtering critical.
2
Evaluate system call restriction mechanisms
Seccomp profiles restrict syscall access per container process.
Restricting syscalls prevents compromised containers from executing dangerous kernel routines.
3
Evaluate identity and privilege boundary controls
User namespaces map container UID 0 (root) to an unprivileged host UID.
This prevents container escapes from granting root privileges on the underlying host machine.

Key Concept

Container Host Isolation and Kernel Hardening Mechanisms
Rate this question

Topics

Virtualization and Containerization Security

More questions from this topic