Question

Difficulty: HardVirtualization and Containerization Security

A system administrator is auditing isolation and runtime protection controls across a enterprise infrastructure hosting both virtual machines and containerized microservices. Match each security control on the left with the specific operational threat or attack vector it directly mitigates on the right.

  • Hypervisor patch management and memory isolation baselinesA guest operating system exploiting virtual machine escape code to reach host memory and adjacent workloads
  • Linux Control Groups (cgroups) quota enforcementA compromised microservice exhausting host CPU and RAM, creating a denial-of-service state for neighbor containers
  • Read-only root file system configuration for container runtimesAn adversary writing malicious persistent scripts or modifying system binaries within a running container instance
  • Static image scanning integrated into the CI/CD deployment pipelineDeployment of microservices built from base images containing known unpatched software vulnerabilities

Answer

Hypervisor patch management matches VM escape exploitation; Control Groups (cgroups) enforcement matches resource exhaustion denial-of-service; Read-only root file system configuration matches malicious file persistence; Static image scanning matches deployment of unpatched software vulnerabilities.
Each security mechanism directly addresses a distinct layer of virtualization or container architecture: hypervisor patching protects hardware abstraction boundaries; cgroups manage shared kernel resource allocation; read-only root file systems enforce immutability at runtime; and static scanning secures software components in the build pipeline.

Step-by-Step Solution

1
Analyze virtual machine isolation mechanisms.
Identify that hypervisor patching specifically targets vulnerabilities allowing guest-to-host privilege escalation and VM escape.
Hypervisors manage hardware virtualization boundaries; failure to patch allows guest workloads to break out of hardware abstraction.
2
Differentiate container resource boundary controls from namespace isolation.
Map Linux Control Groups (cgroups) directly to resource consumption limits.
cgroups set boundaries on system resources like CPU, memory, and disk I/O, preventing neighbor starvation.
3
Evaluate container file system runtime security.
Connect read-only root file systems to preventing unauthorized file modifications and persistence.
Immutable runtime container storage prevents attackers from dropping binaries or modifying system binaries during runtime compromise.
4
Examine pre-deployment supply chain security controls.
Associate CI/CD static image scanning with identifying known vulnerabilities in container images.
Automated scanning checks container layers against vulnerability databases before code is deployed.

Key Concept

Virtualization vs Containerization Security Boundaries
Rate this question