Examkin

Question

Difficulty: EasyVirtualization and Containerization Security

Match each virtualization or containerization security control on the left with its corresponding primary isolation capability on the right.

  • Type 1 HypervisorExecutes directly on host hardware to provide virtual machine isolation.
  • Control Groups (cgroups)Limits and allocates system resources such as CPU and memory usage per container.
  • NamespacesRestricts container visibility into host kernel resources, isolating process IDs and network interfaces.
  • MicrosegmentationEnforces granular network traffic policies to isolate individual workload instances.

Answer

Type 1 Hypervisor pairs with bare-metal hardware execution; Control Groups (cgroups) pair with resource allocation limits; Namespaces pair with kernel view isolation; Microsegmentation pairs with granular network traffic isolation.
Each isolation control serves a specific functional role: Type 1 hypervisors execute on bare-metal hardware, control groups (cgroups) regulate host resource allocation per container, namespaces partition kernel visibility to restrict process boundaries, and microsegmentation enforces granular network traffic rules between virtual workloads.

Step-by-Step Solution

1
Identify the virtualization control executing at the hardware level.
Type 1 Hypervisor operates directly on bare-metal host hardware to isolate VMs.
Type 1 hypervisors sit directly on the physical hardware without needing a host OS.
2
Distinguish between container resource metering and system visibility isolation controls.
cgroups govern resource limits, while namespaces govern resource visibility.
cgroups enforce quantitative bounds on host CPU/RAM usage, whereas namespaces restrict process visibility into host kernel structures.
3
Identify the network security control designed for virtualized container/VM traffic.
Microsegmentation restricts network traffic between individual virtualized instances.
Microsegmentation applies fine-grained network policies to prevent lateral movement across virtual environments.

Key Concept

Virtualization and Container Isolation Mechanisms
Rate this question

Topics

Virtualization and Containerization Security

More questions from this topic