Examkin

Question

Difficulty: HardVirtualization and Containerization Security

A security engineer is hardening a shared Linux host operating system that runs multiple microservices inside runtime containers. To prevent a compromised container process from escalating privileges on the host or compromising adjacent workloads sharing the same host kernel, which TWO security mechanisms should the engineer implement? (Select TWO.)

  1. Apply custom secure computing mode (seccomp) profiles to restrict unneeded system calls available to containerized applications.Answer
  2. Utilize Linux kernel namespaces and control groups (cgroups) to isolate process environments and strictly limit resource consumption.Answer
  3. C
    Deploy a dedicated Type 2 hypervisor inside each container image to achieve hardware-level CPU instruction separation.
  4. D
    Rely on the host's physical network perimeter firewall to implicitly trust all inter-container traffic on the internal virtual bridge.

Answer

The engineer should apply custom secure computing mode (seccomp) profiles to restrict system call access and utilize Linux kernel namespaces and control groups (cgroups) to isolate process resources and limit consumption.
Because containerized workloads share the host operating system kernel, securing them requires kernel-level isolation controls. Applying custom secure computing mode (seccomp) profiles restricts the specific host system calls accessible to container processes, minimizing the impact of potential kernel exploits. Utilizing Linux kernel namespaces provides process, mount, and network interface isolation, while control groups (cgroups) set resource limits to prevent container workloads from consuming excessive host CPU or memory.

Step-by-Step Solution

1
Analyze container isolation architecture and risks
Containers execute as user-space processes directly on the host kernel, making system call access and resource boundary enforcement essential defenses against kernel exploitation and host denial-of-service.
Unlike virtual machines, containers share kernel resources, requiring OS-level primitives for isolation.
2
Identify system call restriction controls
Applying custom seccomp profiles blocks unnecessary host system calls from being executed by container processes.
Restricting system calls limits the host kernel surface exposed to potential exploits.
3
Identify process isolation and boundary controls
Configuring kernel namespaces partitions system views (PID, NET, IPC, MNT), while cgroups enforce memory and CPU quotas.
Namespaces restrict visibility into host processes and network interfaces, and cgroups prevent container resource exhaustion.

Key Concept

Kernel-level isolation and surface reduction for containerized environments
Estimated Time:2m 0s
Rate this question

Topics

Virtualization and Containerization Security

More questions from this topic