Examkin

Question

Difficulty: MediumVirtualization and Containerization Security

A security team is evaluating a microservices environment where untrusted code executes inside application containers on a shared host operating system. The development team asserts that Linux control groups (cgroups) and namespaces provide the same level of boundary separation as a hardware-assisted Type-1 hypervisor. Which of the following security risks should the security team highlight as the primary concern with this architecture?

  1. A
    Container namespaces configure virtual hardware abstraction layers that eliminate access to physical system hardware devices.
  2. A kernel-level privilege escalation vulnerability inside a container can lead to a host compromise because containers share the host kernel.Answer
  3. C
    Traffic routed between container instances on an internal container bridge network is inherently trusted and does not require explicit access rules.
  4. D
    Static image scanning acts as an inline preventive control to intercept active memory execution attacks at runtime.

Answer

A kernel-level privilege escalation vulnerability inside a container can lead to a host compromise because containers share the host kernel.
The correct option correctly points out that application containers share the host operating system kernel. While Linux namespaces and control groups isolate system resource views and restrict resource usage, they do not create a separate guest kernel or hardware virtualization layer. Consequently, a privilege escalation flaw or zero-day vulnerability in the host kernel can allow a container escape, granting full host access.

Step-by-Step Solution

1
Analyze the isolation architecture proposed by the development team.
The proposed architecture uses application containers dependent on host OS Linux kernel facilities (namespaces and cgroups) rather than virtual machines with hypervisor isolation.
Understanding the operational boundary of containers vs. hypervisors is essential to evaluating risk.
2
Evaluate the risk associated with shared kernel architectures.
Because all containers running on the host interact directly with the same underlying OS kernel syscall interface, any successful kernel exploit allows an attacker to break out of the container boundary.
Identifying shared components reveals single points of failure in multi-tenant systems.
3
Select the option that accurately describes this structural risk.
The risk of kernel vulnerability exploitation leading to host compromise correctly highlights the security trade-off between containerization and full virtualization.
Virtual machines enforce hardware-level separation via a hypervisor, whereas standard containers share the host kernel.

Key Concept

Container Isolation vs Virtual Machine Hypervisor Boundaries
Rate this question

Topics

Virtualization and Containerization Security

More questions from this topic