Examkin

Question

Difficulty: MediumVirtualization and Containerization Security

A security architect is designing an enterprise deployment strategy incorporating both virtual machines and application containers. Match each architectural isolation mechanism on the left with its corresponding security function or boundary property on the right.

  • Control Groups (cgroups)Limits, meters, and isolates hardware resource consumption (such as CPU, memory, and disk I/O) across running processes.
  • Linux NamespacesProvides virtualized views of system resources (such as process IDs, network interfaces, and mount points) to isolate process visibility.
  • Type 1 HypervisorExecutes directly on physical hardware to provide full bare-metal abstraction and complete guest operating system separation.
  • Secure Computing Mode (seccomp)Restricts the specific system calls (syscalls) that a process or container can issue directly to the shared host kernel.

Answer

Control Groups (cgroups) matches with hardware resource limiting; Linux Namespaces matches with resource visibility partitioning; Type 1 Hypervisor matches with direct bare-metal hardware abstraction; Secure Computing Mode (seccomp) matches with syscall filtering.
Control Groups (cgroups) enforce resource allocation limits; Linux Namespaces enforce logical visibility boundaries; Type 1 Hypervisors provide bare-metal hardware abstraction; and Secure Computing Mode (seccomp) restricts kernel system call access.

Step-by-Step Solution

1
Analyze container resource governance mechanisms.
Control Groups (cgroups) regulate compute, memory, and storage bandwidth limits per container process group.
cgroups prevent resource exhaustion and noisy neighbor issues.
2
Analyze container visibility isolation controls.
Linux Namespaces segment global system resources (process trees, network devices, filesystem mount points) into isolated process environments.
Namespaces ensure one container cannot see or interact directly with another container's processes or file mounts.
3
Evaluate hypervisor virtualization architectures.
A Type 1 hypervisor operates directly on raw host hardware, enforcing strong VM boundary separation at the virtual CPU and memory abstraction level.
Type 1 hypervisors eliminate host OS vulnerability exposure present in Type 2 virtualization.
4
Identify kernel surface attack reduction controls.
Seccomp restricts the system call interface exposed by the host kernel to running container processes.
Filtering unused or dangerous syscalls reduces container escape vulnerabilities.

Key Concept

Virtualization and Containerization Isolation Mechanisms
Rate this question

Topics

Virtualization and Containerization Security

More questions from this topic