A security administrator is configuring runtime security settings for a container execution host that processes untrusted third-party workloads. Which TWO of the following security controls should be implemented to reduce the kernel attack surface and prevent persistent host filesystem modifications during container execution?
- Apply secure computing mode (seccomp) profiles to restrict the system calls containers can make to the host kernel.Answer
- Mount the container's root filesystem as read-only and redirect temporary write operations to volatile memory storage.Answer
- CAssign dedicated vCPUs through hypervisor CPU affinity to prevent cross-container hardware cache leaks.
- DConfigure the network perimeter firewall to automatically trust all outbound network traffic originating from internal container subnets.
Answer
The two correct security controls are restricting host kernel system calls via seccomp profiles and mounting the container root filesystem as read-only while using volatile memory for temporary write operations.
Implementing seccomp profiles directly reduces the kernel attack surface by blocking dangerous or unnecessary syscalls from reach of containerized applications. Additionally, forcing a read-only root filesystem prevents unauthorized file creation or persistent malicious modifications within the container image.
Step-by-Step Solution
Key Concept
Container Host Hardening & Kernel Attack Surface Reduction