Examkin

Question

Difficulty: MediumVirtualization and Containerization Security

During a technical security assessment of an enterprise cloud environment, a security engineer discovers that a process running within a containerized workload executed a host kernel exploit to access memory allocated to neighboring containers on the same host. To mitigate this risk, the organization must implement an architecture that prevents shared-kernel vulnerability exploitation by providing an independent kernel and hardware-enforced separation for each workload. Which of the following solutions should the engineer recommend?

  1. Type-1 hypervisor virtual machinesAnswer
  2. B
    Linux control groups (cgroups) with strict CPU quotas
  3. C
    Host-based stateful firewalls for network microsegmentation
  4. D
    Role-based access control policies on the container management API

Answer

Type-1 hypervisor virtual machines provide hardware-enforced isolation and separate OS kernels for each workload, eliminating shared-kernel vulnerabilities inherent to containers.
Implementing Type-1 hypervisor virtual machines guarantees that each workload operates within its own virtualized hardware environment and runs its own isolated kernel. Because virtual machines do not share a kernel with the host or neighboring workloads, a kernel compromise in one VM cannot directly reach another VM.

Step-by-Step Solution

1
Analyze the security breach vector presented in the scenario.
Identified that the vulnerability exploited the shared kernel model of standard application containers.
Containers share the underlying host operating system kernel, making all co-located containers vulnerable if a kernel-level exploit occurs.
2
Evaluate the architectural requirements specified by the organization.
Determined that the target architecture requires dedicated OS kernels and hardware-backed isolation boundaries.
Eliminating shared-kernel exploits requires moving from OS-level virtualization (containers) to hardware virtualization (virtual machines).
3
Select the appropriate technology component.
Type-1 hypervisors manage virtual machines directly on bare-metal hardware, supplying separate kernels and strong isolation for each instance.
Virtual machines running on a bare-metal hypervisor maintain completely independent kernel spaces.

Key Concept

Virtual Machine Isolation vs. Shared-Kernel Container Architecture
Rate this question

Topics

Virtualization and Containerization Security

More questions from this topic