Examkin

Question

Difficulty: EasyVirtualization and Containerization Security

Match each virtualization and containerization security mechanism on the left with its primary operational function on the right.

  • Type 1 HypervisorRuns directly on physical hardware to create and manage isolated virtual machines.
  • Linux NamespacesProvides process visibility isolation by restricting what system resources a container can view.
  • Control Groups (cgroups)Restricts and meters resource allocation, such as CPU and memory usage, for container workloads.
  • Container MicrosegmentationEnforces granular network traffic policies to isolate communication between individual containerized services.

Answer

Type 1 Hypervisor pairs with bare-metal hardware virtual machine management; Linux Namespaces pairs with process visibility isolation; Control Groups (cgroups) pairs with resource allocation restrictions; Container Microsegmentation pairs with granular container network traffic policy enforcement.
Each security mechanism is accurately matched to its design purpose: Type 1 Hypervisors manage bare-metal VM isolation, Linux Namespaces restrict container visibility, Control Groups enforce resource limits, and Microsegmentation secures container-to-container network communication.

Step-by-Step Solution

1
Differentiate between hypervisor virtualization and container OS-level isolation.
Identify Type 1 Hypervisor as bare-metal hardware abstraction for VMs.
Bare-metal hypervisors manage virtual machines directly on hardware without relying on a general-purpose host OS.
2
Distinguish between Linux kernel features used for container isolation.
Associate Linux Namespaces with resource visibility and Control Groups (cgroups) with resource limitations.
Namespaces control what a container can see (PIDs, mounts, networking), while cgroups control how much compute capacity a container can consume.
3
Identify network-layer isolation specific to microservice environments.
Link Container Microsegmentation to fine-grained network access controls.
Microsegmentation prevents unauthorized lateral movement by isolating network flows between specific workloads.

Key Concept

Virtualization and Container Isolation Controls
Rate this question

Topics

Virtualization and Containerization Security

More questions from this topic