Examkin

Question

Difficulty: MediumVirtualization and Containerization Security

A security engineer is evaluating an enterprise microservices platform where multiple application containers share the underlying Linux host kernel. The engineer needs to enforce a control that restricts containerized application processes from issuing unauthorized or risky system calls (syscalls) directly to the host kernel. Which of the following mechanisms best satisfies this security requirement?

  1. Applying secure computing mode (seccomp) profiles to restrict allowable kernel system callsAnswer
  2. B
    Deploying container images inside Type 2 hypervisors to provide container-level hardware kernel separation
  3. C
    Configuring network perimeter firewalls to inspect and drop malicious kernel system call payloads
  4. D
    Implementing file integrity monitoring (FIM) as a preventive inline control to intercept system calls

Answer

Applying secure computing mode (seccomp) profiles to restrict allowable kernel system calls
Secure computing mode (seccomp) allows administrators to restrict which system calls a containerized process can execute on the host kernel, significantly reducing the surface area for kernel vulnerabilities and container escape attacks.

Step-by-Step Solution

1
Identify the threat and architecture model
Containers run as isolated process sets sharing a single underlying host kernel.
Because containers share the host kernel, malicious or compromised process execution can leverage unnecessary system calls to achieve host kernel compromise or container escape.
2
Evaluate technical controls for system call filtering
Seccomp (Secure Computing Mode) defines syscall white-lists/black-lists enforced directly by the Linux kernel.
Restricting process syscall access via seccomp profiles effectively minimizes the attack surface against the shared kernel.

Key Concept

Container System Call Filtering via Seccomp
Rate this question

Topics

Virtualization and Containerization Security

More questions from this topic