Examkin

Question

Difficulty: MediumVirtualization and Containerization Security

A security analyst is reviewing the security architecture for a hybrid cloud deployment containing both virtual machines and containerized applications. Match each security mechanism on the left with its primary isolation property on the right.

  • Kernel NamespacesProvides process-level visibility segregation and partition of system resources within a shared OS kernel
  • Control Groups (cgroups)Restricts hardware resource consumption (CPU, RAM, I/O) per workload to prevent denial-of-service
  • Type 1 HypervisorAbstracts physical hardware to enforce strong virtual machine boundary isolation directly above bare metal
  • MicrosegmentationEnforces granular network traffic control and boundaries between individual workloads regardless of physical location

Answer

Kernel Namespaces match process-level visibility segregation within a shared OS kernel. Control Groups (cgroups) match restricting hardware resource consumption. Type 1 Hypervisor matches abstracting physical hardware for strong VM isolation. Microsegmentation matches enforcing granular network traffic control and boundaries.
Kernel namespaces isolate what processes can see (PIDs, network adapters, filesystems). Control groups (cgroups) control how much host hardware resources a container can use. Type 1 hypervisors run directly on hardware to deliver rigid virtual machine isolation. Microsegmentation creates micro-perimeters around workloads to control east-west network traffic.

Step-by-Step Solution

1
Analyze container OS kernel isolation constructs.
Linux kernel namespaces isolate process visibility (e.g., PID space, mount points), while control groups (cgroups) govern resource usage constraints like CPU and memory limits.
Distinguishing between resource visibility isolation and resource consumption limiting is fundamental to container host hardening.
2
Evaluate hypervisor virtual machine abstraction capabilities.
A Type 1 bare-metal hypervisor mediates guest operating system interactions directly on hardware, creating strong isolation boundaries that prevent inter-VM compromises.
Virtual machines run discrete guest kernels, providing stronger containment than shared-kernel container architectures.
3
Identify network security mechanisms for virtualized environments.
Microsegmentation implements policy-driven network access controls around individual microservices or VMs to restrict east-west lateral traffic.
Network-level isolation complements host-level container and hypervisor execution boundaries.

Key Concept

Virtualization and Container Isolation Mechanisms
Rate this question

Topics

Virtualization and Containerization Security

More questions from this topic