A system administrator is auditing isolation and runtime protection controls across a enterprise infrastructure hosting both virtual machines and containerized microservices. Match each security control on the left with the specific operational threat or attack vector it directly mitigates on the right.
- Hypervisor patch management and memory isolation baselinesA guest operating system exploiting virtual machine escape code to reach host memory and adjacent workloads
- Linux Control Groups (cgroups) quota enforcementA compromised microservice exhausting host CPU and RAM, creating a denial-of-service state for neighbor containers
- Read-only root file system configuration for container runtimesAn adversary writing malicious persistent scripts or modifying system binaries within a running container instance
- Static image scanning integrated into the CI/CD deployment pipelineDeployment of microservices built from base images containing known unpatched software vulnerabilities
Answer
Hypervisor patch management matches VM escape exploitation; Control Groups (cgroups) enforcement matches resource exhaustion denial-of-service; Read-only root file system configuration matches malicious file persistence; Static image scanning matches deployment of unpatched software vulnerabilities.
Each security mechanism directly addresses a distinct layer of virtualization or container architecture: hypervisor patching protects hardware abstraction boundaries; cgroups manage shared kernel resource allocation; read-only root file systems enforce immutability at runtime; and static scanning secures software components in the build pipeline.
Step-by-Step Solution
Key Concept
Virtualization vs Containerization Security Boundaries