Examkin

Question

Difficulty: Very hardVirtualization and Containerization Security

An organization is configuring a shared Linux host operating system to execute unmanaged containerized microservices for multiple untrusted third parties. The security team must minimize the attack surface of the shared host kernel and prevent one tenant's containerized process from inspecting or interacting with processes of another tenant. Which TWO of the following mechanisms directly accomplish these security goals?

  1. Configure Linux kernel namespaces to restrict process IDs, mount points, and network interface visibility between container environments.Answer
  2. Implement custom seccomp (secure computing mode) filters to restrict the set of system calls available to running container processes.Answer
  3. C
    Rely on container layer read-only filesystems to provide hardware-level execution ring isolation between tenant workloads.
  4. D
    Deploy stateful network perimeter firewalls at the cloud edge to prevent containers from exploiting host kernel memory flaws.

Answer

The correct mechanisms are configuring Linux kernel namespaces to restrict process IDs, mount points, and network interface visibility, and implementing custom seccomp filters to restrict system calls executed on the host kernel.
Configuring Linux kernel namespaces isolates process IDs, network stacks, and mount points across containers so tenant workloads cannot view each other's environments. Applying seccomp profiles restricts the syscalls container processes can make to the host kernel, preventing malicious or unneeded syscalls from compromising the host operating system.

Step-by-Step Solution

1
Evaluate the requirement for process and resource visibility separation between containerized tenant environments.
Linux kernel namespaces partition kernel resources so that one container process cannot view or access the processes, network interfaces, or filesystem mounts of another container.
Namespaces establish the core process and visibility isolation boundaries for containers on a shared kernel.
2
Evaluate the requirement for host kernel attack surface reduction against malicious process calls.
Seccomp (secure computing mode) profiles intercept and block arbitrary or risky system calls before they reach the host kernel.
Restricting system calls reduces the potential vector for container escape exploits targeting host kernel vulnerabilities.
3
Identify misconceptions regarding container filesystem controls and network perimeters.
Read-only image layers do not provide hypervisor-like hardware ring isolation, and perimeter firewalls cannot prevent host-local privilege escalations.
Hardware isolation requires hypervisors (VMs), while local kernel exploits bypass network edge firewalls.

Key Concept

Kernel Namespaces and Seccomp Profiles for Container Host Hardening
Rate this question

Topics

Virtualization and Containerization Security

More questions from this topic