A security engineer is establishing defense-in-depth security controls for an enterprise cloud platform hosting both application containers and virtual machines. Match each security control mechanism to its primary protective function.
- Rootless Container ExecutionPrevents administrative host compromise in the event of a container sandbox escape by running container daemons under non-privileged user accounts.
- MicrosegmentationRestricts east-west network traffic between individual workload instances or microservices regardless of underlying network topology.
- Hypervisor HardeningMitigates VM escape risks by applying security patches, disabling unused virtual hardware devices, and enforcing strict host management access.
- Secrets Management DaemonInjects sensitive API keys and certificates dynamically into memory at runtime rather than storing them in container image layers.
Answer
Rootless Container Execution pairs with preventing host root compromise by running under unprivileged accounts; Microsegmentation pairs with restricting internal east-west traffic between microservices; Hypervisor Hardening pairs with mitigating VM escape risks by minimizing hypervisor attack surface; Secrets Management Daemon pairs with dynamically injecting sensitive runtime credentials into memory.
Rootless container execution restricts the container engine daemon to an unprivileged user ID, limiting damage if the container sandbox fails. Microsegmentation enforces policy-driven network boundaries between microservices to prevent unauthorized lateral movement inside the cluster. Hypervisor hardening reduces the attack surface of the virtualization layer to block guest-to-host VM escape exploits. Secrets management daemons dynamically deliver runtime tokens and API keys, ensuring sensitive credentials are never baked into container images.
Step-by-Step Solution
Key Concept
Virtualization and Containerization Security Mechanisms