To enforce defense-in-depth across a multi-tenant cloud infrastructure hosting both virtual machines and container workloads, a platform security engineer must align security mechanisms with their specific operational boundaries. Match each virtualization or containerization technology on the left with its primary isolation boundary or resource control capability on the right.
- Linux NamespacesPartitions global operating system resources (such as PIDs, network stacks, and mount points) to provide distinct process visibility.
- Control Groups (cgroups)Limits, allocates, and monitors physical hardware consumption (CPU shares, memory limits, I/O bandwidth) to prevent resource exhaustion.
- Type-1 Bare-Metal HypervisorEnforces hardware-assisted CPU/memory abstractions and Ring-0 execution isolation between distinct guest operating systems.
- Kernel-level Security Modules (e.g., AppArmor / SELinux)Restricts process privileges, host file access, and permitted system calls using Mandatory Access Control (MAC) profiles.
Answer
Linux Namespaces matches with partitioning system resources; Control Groups (cgroups) matches with limiting hardware consumption; Type-1 Bare-Metal Hypervisor matches with enforcing hardware-assisted ring isolation between guest OS instances; and Kernel-level Security Modules matches with restricting process privileges via Mandatory Access Control profiles.
Each technology provides a specific layer of defense-in-depth: Linux Namespaces partition system resource visibility (PIDs, network interfaces, mount points); Control Groups (cgroups) govern hardware resource consumption limits (CPU, memory, I/O rates); Type-1 Bare-Metal Hypervisors manage guest virtual machines via hardware-assisted execution boundaries; and Kernel-level Security Modules enforce Mandatory Access Control policies to restrict process capabilities and syscall access on the shared host kernel.
Step-by-Step Solution
Key Concept
Containerization vs. Virtualization Isolation Architecture
Estimated Time:2m 0s